PREPARING FOR THE GDPR

CD: What for you are the most significant elements of the General Data Privacy Regulation (GDPR)?

White: One of the most significant new elements from a disputes perspective is the addition of several new methods to legitimise the processing of company data without the need for prior consent. These include the invocation of the legitimate interests of the data controlling company, so long as they are balanced against those of the data subjects, and that proper protections and precautions are taken, including such principles as data minimisation, data security and ensuring proper controls and protections for onward transfers. On the flip side, legitimate basis will likely no longer be a reliable instrument when seeking to compel the production of data from third parties, especially public entitles. Article 6 of the GDPR provides that public authorities will no longer be able to rely on ‘legitimate interests’ as a lawful basis for processing personal data in the same way they used to under the Data Protection Directive. Instead, the GDPR sets a new standard and makes clear that any such processing can only be done based on a strict legal obligation or clear public duty as provided by law.

Oct-Dec 2017 issue

AlixPartners

Hogan Lovells International LLP

Join our free mailing list to read the full article