Learn about the new features of the Regulation (EU) that has just come into force
On May 25, Regulation (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, entered into force. This regulation repeals the previous Directive and will require Spanish legislation, and companies themselves, to adapt to it within the required timeframe. Despite its entry into force, the Regulation will not begin to apply until two years later (May 25, 2018).
What are the main new features?
a) Consent for the processing of your personal data must be unambiguous, which requires a statement from the data subject or a positive action indicating their agreement (tacit consent will no longer be valid). Furthermore, it must be verifiable (it should be recorded), and the privacy notice must be written in language that children can understand.
b) The “right to be forgotten,” which will allow for the rectification or erasure of personal data and information. This will not only require the deletion of certain data but will also allow for the blocking of false, outdated, or incomplete information from search engine results.
c) Restrictions are placed on children under 13 years of age in accessing social networks, although each State may increase it to 16, requiring authorization from their parents for the processing of their data.
d) The recognition of new rights such as "portability", which means that the interested party who has provided their data to a controller who is processing it in an automated way may request to recover that data in a format that allows its transfer to another controller.
e) Information regarding security breaches and the right to be informed in such cases when privacy is endangered.
f) New principles, among others, the figure of the data protection officer mandatory for some companies, accountability or privacy by design and by default.
(g) The use of clear and understandable language in privacy clauses. These clauses must, among other information, specify which regulations apply to data processing, the data retention periods, and that data subjects may submit complaints to the Data Protection Authorities.
h) Changes in the sanctioning regime with fines that can reach up to 4% of the global turnover of the offending company.
We also refer you to the article published by the Data Protection Agency itself, where you can find more information than what we have provided. Click here.
The regulation, as we mentioned, provides a relatively comfortable adaptation period, but it is worth starting to assess the risks of the processing carried out by your company, to know what measures should be taken or in what sense, e.g., your privacy notice should be modified.
You can contact this office for any questions or clarifications you may have.
Best regards,
Marc Ivars,
New Technologies Area
Àmbit Assesor
Do you have any questions about this topic?
Our team of expert advisors will help you resolve any issues related to our services.
Contact us now
A Àmbit Assessor, SL has 40 years dedicated to the tax, comptable and labor consultancy of the Pime.
Latest entries from MGI Àmbit
(see all)
Related
