The New EU Data Protection Regime From An HR Perspective

1. Introduction

Just before Christmas and after years of negotiations, the EU institutions agreed on the text of the EU's successor privacy legislation: the General Data Protection Regulation (GDPR).

The GDPR will replace the 'patchwork quilt' of 28 different EU Member States' laws with a single, unifying data protection law, which should lead to significantly greater data protection harmonization throughout the EU.

In addition to harmonizing the EU data protection legal framework, its main objectives are threefold:

First, the GDPR increases the rights for individuals.

Secondly, it strengthens the obligations for companies.

Thirdly, the GDPR dramatically increases sanctions in case of non-compliance. Data protection regulators will have the powers to impose fines up €20,000,000 or 4% of the total worldwide annual turnover. Add to that the possibility for the regulators to impose a ban on processing or the suspension of data transfers, the risk of class actions,