Definition and purpose of the GDPR

The GDPR (General Data Protection Regulation), known in French as RGPD (Règlement Général sur la Protection des Données), aims to harmonize data management across all European Union countries.

According to the CNIL, "personal data is any information relating to an identified or identifiable natural person, whether directly or indirectly". The most common data includes banking information, loyalty cards, camera footage, web history, employee and candidate data, and customer and prospect files.

Its objective is to give citizens more control over and visibility into their private data, in particular so they know what data is collected, for what purpose and for how long it is kept. The main challenge for companies is therefore to know where this data is and how to provide it to the people concerned. This means that a company must know at all times:

  • What data it holds
  • Where it is located
  • Why it was collected
  • How the data is managed, stored, transferred and erased

Who is affected?

The GDPR applies to all economic and social players offering goods or services on the European Union market whenever their activities involve processing personal data about European Union residents. This includes companies, associations, public bodies, processors and many companies outside the European Union.

These players must become compliant before May 25, 2018 or face penalties. The authorities can impose substantial administrative fines: depending on the category of the infringement, from 10 to 20 million euros or from 2 to 4% of annual worldwide turnover.

Fundamental principles of the GDPR:

Several principles must be respected in order to become compliant before May 25, 2018. There are seven of them:

  • Accountability refers to the obligation for companies to implement internal mechanisms and procedures that demonstrate compliance with data protection rules.
  • The obligation to respect the principles of data protection by design (known as Privacy by Design) and data protection by default (known as Privacy by Default).
  • The GDPR requires companies to carry out a personal data protection impact assessment before implementing new data processing operations that could potentially pose risks to individual rights and freedoms. An assessment must also be carried out in order to reduce the impact of potential harm to the protection of personal data.
  • The obligation to notify the authority and the individuals concerned of personal data security breaches, within 72 hours at most of their discovery.
  • The right to data portability, which allows users who have provided data to a company to receive it in a format that allows it to be transferred to another company.
  • The right to erasure of personal data at the request of users.
  • The appointment of a data protection officer: DPO
    Appointing one is mandatory in specific cases, and the DPO has many duties.

The data protection officer (DPO):

Appointing a DPO is mandatory in three specific cases:

  • When processing is carried out by a public authority or public body.
  • When the core activities of the controller or processor consist of processing operations which, by virtue of their nature, scope and/or purposes, require regular and systematic monitoring of data subjects on a large scale.
  • When the core activities of the controller or processor consist of large-scale processing of so-called "sensitive" data (health data, biometric data, political opinions or religious beliefs).

The data protection officer may not hold another position in the organization that would involve determining the purposes and means of processing personal data.

The DPO's duties are numerous and are key to achieving proper GDPR compliance. There are four of them:

  • Inform and advise the controller or processor, as well as their employees.
  • Monitor compliance with the regulation and with national data protection law.
  • Advise the organization on carrying out a data protection impact assessment and monitor its performance.
  • Cooperate with the supervisory authority and act as its contact point.

Preparing in 6 steps:

The CNIL has defined six steps to become GDPR compliant.

  • Appoint a leader: The company must appoint a data protection officer, who will carry out an internal information, advisory and monitoring role.
  • Map: You must then make a precise inventory of your personal data processing operations. Drawing up a record of processing activities will allow the company to take stock.
  • Prioritize: The company must identify the actions to be taken to comply with current and future obligations. These actions must be prioritized according to the risks to the rights and freedoms of the individuals concerned.
  • Manage risks: An impact assessment must be carried out when personal data processing is likely to result in high risks to the rights and freedoms of the individuals concerned.
  • Organize: The company must define internal processes to ensure that data protection is taken into account at all times. All events that may occur during the life of a processing operation must be taken into account (security breach, handling of information escalation, handling of complaints and requests from the individuals concerned).
  • Document: To prove compliance with the regulation in the event of an inspection, the company must compile and gather the necessary documentation.
    The actions taken and documents produced at each step must be reviewed and updated regularly to ensure continuous data protection.

For more information, here is the complete guide provided by the CNIL: https://www.cnil.fr/fr/principes-cles/reglement-europeen-se-preparer-en-6-etapes

In conclusion:

It should not be forgotten that the GDPR is not a project with a start and end date. Compliance is a process that must evolve with the company and also take into account the case law that will be established.

For more information on the GDPR, you can find its full text here: https://www.cnil.fr/fr/reglement-europeen-protection-donnees/