Two days left until General Data Protection Regulation (GDPR), lots of newsletter opt-outs but does the EU citizen really know?

Just two days left now before the General Data Protection Regulation (GDPR) is fully implemented changing the way companies manage the data of EU citizens globally. A regulation which is much stricter that the current ones is meant to give greater protection rights to individuals from the Old Continent showing that the EU is a safer data privacy environment. Despite the fact that that it was given a two-year deadline to harmonise with the new regulation, lots of companies are strangling to meet the necessary requirements in order to avoid possible fines which can reach up to 4% of their total turnover. Apart from the effect that GDPR will have on the aforementioned level, countries will have to sign up to the General Data Protection Regulation to proceed with a trade deal with the EU. Background All started in the beginning of 2012 when the proposal for the GDPR was released.  After four long years of preparation, the GDPR was approved by the EU Parliament on 14 April 2016. A two year transition period is given to all organisations to be compliant with the new rules which will be enforced on the 25th May 2018. The GDPR is going to replace the 1995 Data Protection Directive. The regulation is of course directly binding and applicable to all companies which face serious penalties of up to 20 million euros or 4% of their total turnover, whichever higher, in case they don’t follow the guidelines of GDPR. U.S. not GDPR exempted GDPR does not apply only for the EU. All countries which use data of European citizens have to comply with the new rules. More specifically, Nathan Snyder, a partner at Brickendon, a financial services consultancy, mentioned on this issue: “US clients who had previously assumed GDPR was a European problem for European people realised the potential impact on them even though they were based outside the EU”. What is more, Robert Bond, a partner at London law firm Bristows, said last Tuesday at an event organized by U.K. body the Direct Marketing Association (DMA) in London that a company may need to comply with GDPR even if it has no direct EU operations. Laywer Bond also mentioned that there lots of U.S. companies which have just realized that they should comply with the regulation but don’t have anything set up yet. Companies still not informed The fact that the GDPR is being deployed on Friday is adding extra pressure to firms, especially small and medium sized ones which are still not aware of what to do and how to act in order to be in line with the new regulation framework. The latter was also stated by EU justice commissioner Vera Jourová. Her exact words were: “Despite a long transition period, many small- and medium-sized businesses without large legal departments are still in the dark about what the new rules mean for them.” However, the EU commissioner said that that quick actions must be taken by businesses but reassured there is no need for panic as fines will not be imposed immediately. In detail, Vera Jourová explained that: “National data protection regulators don’t see their role as being sanctioning machines from day one. They are ready to consult and help in the first year when we expect the system to settle down. We want to see action and corrective measures. If there are breaches, companies must be the object of sanctioning.” EU trade deals The GDPR should also be taken into account in the cases of bilateral trade deals with the EU. Any country which wants to sign a trade deal with the Union has to adopt data protection regulations that are as strict as GDPR. Will GDPR be the beginning of a new era in the data and protection privacy? Will other countries follow the EU path? It seems quite likely as this regulation affects non-EU countries already and according to many companies and data protection authorities GDPR could become the global standard, setting rules for behaviour not only in the EU but in countries where people have little protection rights. Besides, as Sheryl Sandberg, Facebook’s chief operating officer, said a month ago: “Europe was way ahead on this.” All in all, the GDPR is going to change the way companies treat data of EU citizens the moment that scandals such as Cambridge Analytica have caused serious global concerns to individuals. It remains to be seen how this new EU initiative will affect the rest of the world.