background image
34
T H E P R I M E R U S P A R A D I G M
New Privacy Rules for European Union
Will Apply to Companies Worldwide
A new regulation will apply to all
European Union (EU) citizens and
therefore to all companies in and outside
the EU that process data of citizens of
the EU, e.g. data related to the offering
and selling of goods or services. In order
to protect the privacy of EU citizens, the
European Parliament adopted a General
Data Protection Regulation on March 12,
2014, which is likely to become effective
in 2017. This regulation will change the
current privacy law and will have direct
effect in the whole EU. As there will be
severe fines for (repeated) breaches of
the new regulation, it is very important
that businesses take timely measures
to comply with it. It is expected that
the new European regulation will also
have implications for privacy rules in,
for instance, the United States, as many
American businesses are active on the
European market.
So what are the most important
provisions of this regulation? The EU
citizens will get new rights, for example
the right to information and the right
to be forgotten. On the other hand,
companies which are working with
personal data have to deal with new
obligations, for instance: appointing a
data protection officer, assessing the
processing of data in their company
and providing information to those
concerned.
Fines
One important aspect of this regulation
will be the introduction of new penalties
including extremely severe sanctions
for (repeated) breaches of privacy of
EU citizens. At the moment, e.g. the
Dutch Data Protection Agency (College
bescherming persoonsgegevens) can
impose a maximum fine of EUR 4,500.
However, the new fines could be up
to maximum of EUR 100,000,000 or
5 percent of the global annual turnover of
a company, depending on which amount
is higher. Fines are imposed for the
following violations, for instance:
·
Processing of personal data without
consent or legal basis.
·
Processing of personal data with
regard to:
-
Racial or ethnic origin
-
Political opinions
-
Religious or philosophical beliefs
-
Trade union membership
-
Genetic information
-
Health
-
Sex life
-
Criminal convictions and related
security measures
·
Not taking appropriate technical and
organizational measures to prevent
data leaks, unauthorized access to
and elimination of data.
·
Not reporting data leaks in time,
for instance, loss of a USB device
or website hacking.
International ­ Europe, Middle East & Africa
Reinier W.L. Russell is managing partner of the law firm of
Russell Advocaten B.V. He is an experienced outside corporate
counsel to both domestic and foreign businesses in the
Netherlands. He deals with business formation and reorganization,
corporate governance, insolvency law, employment issues, real
estate issues and all aspects of e-commerce and contract law.
Russell Advocaten B.V.
Reimersbeek 2
1082 AG Amsterdam
Netherlands
Phone: +31 20 301 55 55
Fax: +31 20 301 56 78
reinier.russell@russell.nl
russell.nl
Reinier W.L. Russell