The GDPR introduces a right for individuals to have personal data erased. The right to erasure is also known as ‘the right to be forgotten’. What is the right to erasure? The right to be forgotten appears in Recitals 65 and 66 and in Article 17 of the GDPR. It states, “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay” if one of a number of conditions applies. “Undue delay” is considered to

2018 brought about a major shift and more clarity in the world of individual data privacy. Last month marked the one-year anniversary since the European General Data Protection Regulation (GDPR) was introduced. The regulation was an attempt to unify the existing data protection legislation put in place by individual EU member states. GDPR is designed to guide businesses in protecting the personal data of EU citizens and covers any data that could be used to identify an individual. This includes medical records, genetic or economic information – these elements are the target of a data breach. The GDPR required all

It has been over a year and a couple of months since the General Data Protection Regulation (GDPR) went into force. There was a lot of attention focused on the May 25th 2018 “deadline,” as if it was a finish line, when in fact it is just the start of what should be an effort that has no finish line.  The GDPR compliance in general—is like physical fitness. It is an ongoing process, a “lifestyle,” not an event. Think about that analogy for a minute. Every day there are millions of people around the world who make a decision to lose

Data Breaches Across the EU: One year on from the major shift and more clarity in the world of individual EU data privacy.

Section 4 of the GDPR outlines the requirement for applicable firms to appoint a data protection officer (DPO). All emphasis added unless otherwise stated. When a DPO must be appointed According to Article 37(1), data controllers and processors shall designate a DPO where: (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale;