The General Data Protection Regulation replaced the European Union’s 1995 Data Protection Directive. When that directive was written, only about one European in a hundred used the internet. By 2018 the figure was about 80%.
more
The new law did not start from nothing. Most of its principles were already in the earlier rules.
How long the rewrite took
Negotiation on the final text ran for more than four years. The European Parliament and the European Council adopted it in April 2016. Enforcement began across Europe on May 25, 2018. The finished regulation holds 99 articles.
The GDPR left countries room for small changes of their own. The UK used that room to pass the Data Protection Act 2018, which replaced its 1998 act. The EU says one aim was to bring members’ privacy laws into line with each other.
What stayed the same
Article 5 of the GDPR sets out seven principles for handling personal data. Wired reports that these match the earlier rules closely. Only one, accountability, is new. The other six cover these ideas:
- processing that is lawful, fair, and open
- using data only for the stated purpose
- collecting as little data as needed
- keeping data accurate
- holding data no longer than needed
- keeping data secure and confidential
Elizabeth Denham, then the UK information commissioner, described the GDPR as an evolution rather than a complete overhaul. Her view was that a firm already following the old rules faced a step change, not a fresh start.
What the regulation added
Writing for the BBC in 2018, Mozilla Foundation director Mark Surman listed the rights the regulation set out. People could ask a company what data it held on them and how it used it. They could take their data from one platform to another. They gained a right to erasure, also called the right to be forgotten.
Companies now had to report a data breach within three days. The penalty for breaking the rules could reach 4% of worldwide revenue or €20 million.
The reach grew as well. A business outside the EU, such as one based in the US, can fall under the GDPR if it trades in the EU. In April 2018 Mark Zuckerberg told reporters that Facebook would offer the same controls everywhere, not only in Europe.
