A few weeks back, I had an opportunity to attend the Coalition for Networked Information (CNI) meeting in San Diego. I particularly like the meeting because there are real-life presentations from institutions working on interesting network, education, library, and information technology problems and projects. All in all, I probably attended around 10 presentations in a one day format. In light of recent Facebook data issues, the most compelling presentation by far was on the European Union’s General Data Protection Regulation (GDPR).
The GDPR is, simply put, an EU regulation on individual data protection and privacy that goes into effect on May 25. It aims to give control of personal data back to citizens. This will have a major effect on all European and foreign companies holding the data of EU citizens. Even England, with its Brexit status, has agreed to enforce and adhere to the new regulation. GDPR compliance will be strictly enforced, with penalties equaling 4 percent of worldwide revenue or 20 million euros, whichever is higher.
The presentation I attended was by a representative of a major European publisher, and it was obvious they were taking the new regulation very seriously. Although the GDPR contains more specifics on how companies will collect, protect, store, and destroy personal data than can be addressed in this column, here are a few key points: Companies that collect personal data must explain what data they intend to collect and why. All personal data a user provides must be available and portable to that user. There are extensive sections on the rights of the consumer. And because the law protects individuals in the EU even when their data is gathered and used elsewhere, the regulation will affect publishers, banks, search engines, universities, tech companies, etc., and will have broad implications for any entity doing business with the 28 EU countries.
If you want to learn more, you can visit the GDPR public portal, read Nitasha Tiku’s overview in WIRED magazine, “Europe’s New Policy Law Will Change the Web, and More“, or simply search the term “GDPR.” Facebook indicated recently that it plans to comply with the GDPR’s data privacy rules, and not just with GDPR “controls and settings.”