Re: Is this forum prepared for the GDPR?
- Posted by ghaberek (admin) May 01, 2018
- 2205 views
Not sure I agree. The rules have to be as tough as they are BECAUSE of the nature of the internet - it is distributed, world-wide, with no single centralized authority controlling it.
Without extraterritoriality it'd be too easy for Facebook etc to just set up a website in Bermuda or something and require all European users to use that website, bypassing EU juristiction.
I know, and I get that part. What I'm saying is that, by choosing to sign up for a website, an individual is volunteering some of their personal information to that site. I don't ever expect to get that privacy back, and that's what GDPR is requiring that data controllers do.
Can we start a wiki page for this? The policy part.
Done. See GDPR.
Reporting to who?
Uh... that's a little vague. On the Wikipedia page, under Data breaches it says:
Under the GDPR, the data controller is under a legal obligation to notify the supervisory authority without undue delay unless the breach is unlikely to result in a risk to the rights and freedoms of the individuals. There is a maximum of 72 hours after becoming aware of the data breach to make the report (Article 33). Individuals have to be notified if adverse impact is determined (Article 34). In addition, the data processor will have to notify the controller without undue delay after becoming aware of a personal data breach (Article 33).
And under Single set of rules and one-stop shop, it says:
A single set of rules will apply to all EU member states. Each member state will establish an independent supervisory authority (SA) to hear and investigate complaints, sanction administrative offences, etc. SAs in each member state will co-operate with other SAs, providing mutual assistance and organising joint operations. If a business has multiple establishments in the EU, it will have a single SA as its "lead authority", based on the location of its "main establishment" where the main processing activities take place. The lead authority will act as a "one-stop shop" to supervise all the processing activities of that business throughout the EU (Articles 46–55 of the GDPR). A European Data Protection Board (EDPB) will coordinate the SAs. EDPB will replace the Article 29 Data Protection Working Party.
So if we haven't got any "establishments" in any "member states" (of the EU) then we shouldn't need to assign a "supervisory authority" so I don't think we have to notify anyone. But we might just need to make the breach public? Maybe, I guess? Or notify some regulatory authority in the EU?
This is why I'm so fed up with this whole thing: a lot of it is vague and doesn't provide a lot detail about how non-member states should actually comply.
-Greg
