There’s a lot of information out there about what the GDPR is and how it operates. Unfortunately a lot of it is not correct. Mistakes about the GDPR and the Privacy Shield still persist.

These mistakes can put many US companies in a situation where they could be facing fines of up to 4% of global turnover or 20 million euros.
EDPO enables US companies to continue to have access to the EU market by correcting these mistakes.

1 THINKING THAT THE PRIVACY SHIELD IS ENOUGH

Self-certification under the Privacy Shield only checks off one requirement of the GDPR.

The EU-US Privacy Shield provides for the transfer of data outside of the EU to the US, but it is not the same as being GDPR compliant.

The Privacy Shield is actually a very specific response to one part of complying with the GDPR and it doesn’t address the other requirements. In fact, the Privacy Shield only answers Articles 44-50, mostly neglecting the other 94 Articles of the GDPR.

So while your company is certified to receive data from the EU, the Privacy Shield does not make it OK for you to offer products and/or services to individuals in the EU and to monitor their behaviour.

2 ASSUMING THAT SMALL VOLUMES OF EU DATA DON’T FALL UNDER THE GDPR

US companies don’t realise how much data they are collecting on EU individuals, particularly in the case of visitors to websites.

Our clients often claim that they only have a website and that no personal data is ever collected through the website. But upon closer inspection, any visitor that lands on your website is already being tracked if you use analytics software such as Google Analytics.

Google Analytics or similar technologies collect IP addresses from the moment a visitor lands on your page. Not only that, a wealth of information is collected about that visitor’s browser, location and even online behaviours – all considered to be personal data under the GDPR as the information can identify or be linked to an identifiable natural person.

Because of such a systematic collection of personal data, a US company cannot argue that volumes of personal data collected are small, nor can it argue that the collection of personal data is occasional.

3 CONFUSING THE DPO WITH THE DPR

Companies that have to appoint a Data Protection Officer (DPO) may choose at their discretion whether to appoint someone within their company or to outsource the DPO function. However, what is not commonly known, and thus most often completely missed by non-EU companies, is the obligation to appoint a Data Protection Representative (DPR). A DPO is not the same as a DPR. The European Data Protection Board (EDPB) made clear under its draft Guidelines 3/2018 that the role of the DPO and DPR are incompatible (to read more on this topic, click here).

Non-EU companies that fall under the scope of the GDPR must appoint a DPR* in an EU Member State so that the EU supervisory authorities can easily communicate with them. The EU-based DPR also handles European data subject requests.

*Unless the limited exceptions of Article 27 (2) apply.

4 OVERLOOKING THE GDPR’S HIDDEN OBLIGATION

Although the GDPR has extra-territorial scope, not much attention has been given to how the GDPR will be practically implemented by non-EU companies.

If you haven’t heard about it, it’s probably because everything that’s been written or discussed around the GDPR has been European-focused. European companies don’t have to appoint a DPR because Article 27 of the GDPR only applies to companies outside of the EU.

Since everything has been written from a European perspective, including guidance issued by the Information Commissioner’s Office, the obligation to appoint a DPR is simply overlooked. 

Is your US-based company overlooking this obligation too? 

Contact

Contact us via e-mail: info@edpo.brussels