4 of the most common mistakes made about the GDPR

There’s a lot of information out there about what the GDPR is and how it operates. Unfortunately a lot of it is not correct. Mistakes about the GDPR and the Privacy Shield still persist.
These mistakes can put many US companies in a situation where they could be facing fines of up to 4% of global turnover or 20 million euros.
EDPO enables US companies to continue to have access to the EU market by correcting these mistakes.
1 THINKING THAT THE PRIVACY SHIELD IS ENOUGH
Self-certification under the Privacy Shield only checks off one requirement of the GDPR.
The EU-US Privacy Shield provides the legal mechanism for the transfer of data outside of the EU to the US, but it is not the same as being GDPR compliant.
The Privacy Shield is actually a very specific response to one part of complying with the GDPR and it doesn’t address the other requirements. In fact, the Privacy Shield only answers Articles 44-50, mostly neglecting the other 94 Articles of the GDPR.
So while your company is certified to receive data from the EU, the Privacy Shield does not make it OK for you to offer products and/or services to individuals in the EU and to monitor their behaviour.
2 ASSUMING THAT SMALL VOLUMES OF EU DATA DON’T FALL UNDER THE GDPR
US companies don’t realise how much data they are collecting on EU individuals, particularly in the case of visitors to websites.
Our clients often claim that they only have a website and that no personal data is ever collected through the website. But upon closer inspection, any visitor that lands on your website is already being tracked if you use analytics software such as Google Analytics.
Google Analytics or similar technologies collect IP addresses from the moment a visitor lands on your page. Not only that, a wealth of information is collected about that visitor’s browser, location and even online behaviours – all considered to be personal data under the GDPR as the information can identify or be linked to an identifiable natural person.
Because of such a systematic collection of personal data, a US company cannot argue that volumes of personal data collected are small, nor can it argue that the collection of personal data is occasional.
3 CONFUSING THE DPO WITH THE DPR (REPRESENTATIVE)
Companies that have to appoint a Data Protection Officer (DPO) may choose at their discretion whether to appoint someone within their company or to outsource the DPO function. However, what is not commonly known, and thus most often completely missed by non-EU companies, is the obligation to appoint a Representative as per Article 27 of the GDPR. A DPO is not the same as a Representative. The European Data Protection Board (EDPB) made clear under its Guidelines 3/2018 that the role of the DPO and Representative are incompatible (to read more on this topic, click here).
Non-EU companies that fall under the scope of the GDPR must appoint a Representative* in an EU Member State so that the EU supervisory authorities can easily communicate with them. The EU-based Representative also handles European data subject requests.
*Unless the limited exceptions of Article 27 (2) apply.
4 OVERLOOKING THE GDPR’S FORGOTTEN OBLIGATION
Although the GDPR has extra-territorial scope, not much attention has been given to how the GDPR will be practically implemented by non-EU companies.
If you haven’t heard about it, it’s probably because everything that’s been written or discussed around the GDPR has been European-focused. European companies don’t have to appoint a Representative because Article 27 of the GDPR only applies to companies outside of the EU.
Since everything has been written from a European perspective, including guidance issued by the Information Commissioner’s Office, the obligation to appoint a Representative is simply overlooked.
Is your US-based company overlooking this obligation too?
Contact
Contact us via e-mail: info@edpo.com

IAPP Intensive – London, UK – March 2023
DAY 1 The IAPP - International Association of Privacy Professionals Data Protection Intensive: UK 2023 kicked off this Wednesday with John...

EDPO participated in the Belgian Economic Mission to Japan – Dec. 2022
EDPO is thrilled to have been part of the Belgian Economic Mission to Japan with HRH Princess Astrid of Belgium last week - and what a crazy...

Belgian Economic Mission to the United States – June 2022
BLCC – London calling WebinarIn order to keep you up-to-date in a fast changing environment where we all lack time, the BLCC in Great Britain is