Abstract:The proposed data protection package that the European Commission unveiled on January 25, 2012 provides a sneak preview of the plans for a comprehensive reform of the data protection rules in the European Union. The new data protection framework would be based on two documents: a Regulation, (1) which would address the general privacy issues, and a Directive, (2) which would address the unique issues associated with criminal investigations. The proposed legislative texts are intended to redefine the legal framework for the protection of personal data throughout the European Economic Area. (3) The vision revealed in the documents published on January 25, 2012 (4) is generally consistent with the plan of action that was presented in late 2010. (5) What is new, or was not clearly specified in 2010, is the shift to a single law that would be common to all of the Member States. (6) The publication of the Proposed Regulation and Proposed Directive signals a very important shift in the way data protection will be handled in the future throughout the European Union. If the draft legislative texts are adopted in a form substantially similar to that which was presented on January 25, by 20157, the European Union Member States will be operating--for most types of activities--under a single data protection law that applies directly to all entities and individuals. (8) In many cases, companies will no longer have to suffer the fragmentation resulting from the significant discrepancies in the manner in which the 27 Member States interpreted and implemented the principles set forth in Directive 95/46/EC to create 27 different sets of national laws. (9) A single set of rules on data protection, valid across the EU, would make it easier for companies to know and understand the rules. Unnecessary administrative burdens, such as notification requirements for companies, (10) would be abolished. (11) Instead, the proposed Regulation provides for increased responsibility and accountability for those processing personal data. (12) In the new regime, organizations would only have to deal with a single national data protection authority in the EU country where they have their main establishment. (13) Likewise, people would be able to refer to the data protection authority in their country, even when their data are processed by a company based outside the EU. (14) The proposed reform would create more obligations for companies (15) and more rights for individuals, (16) while removing some of the administrative burdens that currently cost billions of Euros to companies.17 However, numerous additional requirements would come instead. While the new data protection regime would reduce red tape, it would require entities to be more accountable, (18) to have in place written procedures and processes that they actually use, (19) and to be able to show that they do comply with the applicable legal requirements. (20) Entities would be responsible for conducting privacy impact assessments in some circumstances, (21) to comply with individual requests to exercise their "right to be forgotten," (22) and to notify data protection authorities and individuals in the event of a breach of security. (23) U.S. companies that do business in or with the European Economic Area should start preparing for this dramatic change in the data protection landscape. Some of the provisions will require the development of written policies and procedures, documentation, and applications as necessary to comply with the new rules. Security breaches will have to be disclosed, (24) and incident response plans will have to be created accordingly. The development of these new structures will require significant investment and resources. IT and IS departments in companies will need to obtain greater, more significant budgets in order to finance the staff, training, policies, procedures and technologies that will be needed to implement the new provisions. …

Getting ready for the California Consumer Privacy Act: Building on General Data Protection Regulation preparedness

DATA PRIVACY LAWS AND COMPLIANCE: A COMPARATIVE REVIEW OF THE EU GDPR AND USA REGULATIONS

California data privacy law will have national impact

Measuring Compliance with the California Consumer Privacy Act Over Space and Time

Fighting the Fog: Evaluating the Clarity of Privacy Disclosures in the Age of CCPA

The European Union general data protection regulation: what it is and what it means

Privacy Legislation as Business Risks: How GDPR and CCPA are Represented in Technology Companies' Investment Risk Disclosures

The Brussels Effect: How the GDPR Conquered Silicon Valley

China’s draft Personal Information Protection Law

Are we there yet? Understanding the challenges faced in complying with the General Data Protection Regulation (GDPR)

EU General Data Protection Regulation: A Gentle Introduction

European Data Protection 2.0: New Compliance Requirements in Sight - What the Proposed EU Data Protection Regulation Means for U.S. Companies

(Un)clear and (In)conspicuous: The right to opt-out of sale under CCPA

PROACTIVE PRIVACY: ADVANCED RISK MANAGEMENT STRATEGIES FOR PRODUCT DEVELOPMENT IN THE U.S

Two Steps Forward and One Step Back: The Right to Opt-out of Sale under CPRA

The Emerging Challenges of Customer Relationship Management with Customer Data Platforms (CDP): Constraints and Perspectives

Data protection is changing − the new general data protection regulations (GDPR)

A Comparative Analysis of Personal Data Protection Regulations Between the EU and China

HARMONIZING TEAMS AND REGULATIONS: STRATEGIES FOR DATA PROTECTION COMPLIANCE IN U.S. TECHNOLOGY COMPANIES

Dark Patterns in the Opt-Out Process and Compliance with the California Consumer Privacy Act (CCPA)

C3PA: An Open Dataset of Expert-Annotated and Regulation-Aware Privacy Policies to Enable Scalable Regulatory Compliance Audits