Monday’s €1.2 billion fine for Meta – by far the biggest fine issued under the GDPR since it took effect five years ago – has been taken by many as a sign that the Regulation is at last beginning to be enforced with sufficient vigour. However, the Meta decision illustrates the ongoing difficult of applying a consistent approach to GDPR enforcement, particularly when it comes to cross-border and international data transfers. In particular, the Irish DPC (Data Protection Commission), which is the supervisory authority for numerous US tech giants whose EU headquarters are in Ireland, continues to attract criticism for

The post Changing Attitudes Towards GDPR Enforcement and Compliance: 2018 – 2023 appeared first on IT Governance UK Blog.

For many outside the data privacy and IT governance, risk management and compliance sectors, the GDPR (General Data Protection Regulation) seemed to appear five years ago as if from nowhere. It had barely made the news before May 2018, but in the weeks running up to its effective date of 25 May 2018 it gained the sort of media coverage and popular interest that most aspirant celebrities can only yearn for. (Indeed, the European Commission proudly shared in a since-deleted infographic that ‘GDPR’ was googled more often than Beyoncé or Kim Kardashian.) The Regulation’s time in the media spotlight didn’t

The post Five Years of the EU General Data Protection Regulation and Data Protection Act 2018 appeared first on IT Governance UK Blog.

Article 17 of the GDPR (General Data Protection Regulation) plays a distinctive yet essential role in data protection law. It enshrines “the right to erasure” (sometimes referred to as “the right to be forgotten”), which allows people to request that an organisation deletes any personal data related to them. There are several reasons why someone might make such a request, and in almost all instances, the organisation must comply. Failure to fulfil this requirement is considered a serious breach and could be penalised under the GDPR’s upper tier of fines of €20 million (£17.5 million under the UK GDPR) or

The post GDPR Article 17: What Is the Right to Erasure? appeared first on IT Governance UK Blog.