The General Data Protection Regulation is the first comprehensive overhaul of European Union data protection rules in 20 years. This two-part article will examine the GDPR’s impact on businesses in Asia, with a focus on territorial scope, controller and processor obligations, and international data transfers.
In our first article on the European Union General Data Protection Regulation (Regulation (EU) 2016/679 or ‘GDPR’) we focused on the global territorial scope of the new rules and how they could affect businesses based in Asia. In particular, we highlighted how the enhanced rights of data subjects in the EU and the expanded obligations on data controllers and data processors — even if they are located outside the EU — provide much for businesses to consider as they become compliant with the new rules. In this second article, we will focus on the new regulatory-enforcement regime and international data transfers, and then draw comparisons with the Asia-Pacific Economic Cooperation (APEC) Cross-Border Privacy Rules (CBPR) system.
The exit of the United Kingdom from the EU has caused turmoil in world markets and has far reaching consequences for those companies in the European Union doing business with the country – and vice versa. There has also been some uncertainty about how the authorities based in London will be treating data security and privacy issues. The consensus seems to be that companies doing business with the second largest economy in Europe (after Germany) should be adopting a ‘business as usual’ approach. However, will this necessarily be the case in the future? Will global companies with a British connection (including those in Asia) be forced to revisit how they treat data security and privacy issues when dealing with the United Kingdom – and will British companies move away from the rules that have been set in place by Brussels? We take a closer look.
In this final instalment of an ongoing series on the issues that affect compliance in an ever more complex world Teresa Troester-Falklooks at how organisations can demonstrate compliance using an accountability approach.
We give some insight into how companies could use a privacy impact assessment (PIA) in conjunction with data mapping practices to understand how data flows through an organisation, making it the perfect tool to document and track new initiatives.
This article is based on a presentation made during the Data Privacy Asia 2016 conference held on 9-11 November 2016. The new EU General Data Protection Regulation aims to implement uniform data protection rules within the EU, boost the Digital Single Market and increase cooperation across its member states. The current rules have been sharpened to provide more enforcement teeth with penalties up to 4% of annual global turnover or EUR 20 million for firms in breach with the GDPR. In this article Héloïse Bock, a Partner at Arendt & Medernach, a law firm located in Luxembourg, examines the core principles and applicability of the GDPR, and discusses what companies in Asia must do to avoid missteps.
This article is based on a presentation made by Steven Klimt, a partner in the Sydney office of Clayton Utz during the Data Privacy Asia 2016 conference held on 9-11 November 2016. It outlines the new mandatory data breach reporting legislation, how Australian privacy regulation impacts Big Data and the differences between Australian Privacy legislation and the proposed EU GDPR.
Big data in politics has become big news in the United Kingdom as the Guardian newspaper reports that the vote for the UK to leave the European Union saw two international companies manipulating public opinion through the use of big data mining techniques.
The 21st of June 2017 saw UK’s Queen Elizabeth give what is generally known as ‘The Queen’s Speech’ in which Her Majesty gave some insights into just how seriously the UK government is taking issues of online privacy and data protection.