General Data Protection Regulation comes into force

Implementation date: 25 May 2018

The General Data Protection Regulation (2016/679 EU) (GDPR) replaces the Data Protection Directive (95/46/EC).

The Regulation harmonises data protection law across the EU and extends it to include all foreign companies processing the data of EU residents. The Regulation:

  • provides for the creation of a single data protection authority instead of a supervisory authority for each member state, and the creation of data protection officers for all public authorities and companies processing high volumes of data;
  • provides for the imposition of a fine of €20 million or 4% of global turnover, whichever is greater;
  • requires the positive consent of individuals to have their data processed;
  • provides for the notification of breaches to the data protection authority; and
  • extends the special categories of information, such as trade union membership and religious belief or political opinion, to include information relating to health.

On 7 August 2017, the Government issued a Statement of intent: A new Data Protection Bill - our planned reforms, which set out its proposals for updating the law on data protection. On 13 September 2017, the Government introduced the Data Protection Bill in Parliament. The Bill will repeal the Data Protection Act 1998 and bring data protection rules in the UK into line with the requirements of the GDPR. In particular, the Bill provides for enhanced rights of individuals over their data, for example in relation to consent and erasure of personal data. It creates the requirement for mandatory data protection officers, whose role is to monitor compliance, and applies greater sanctions for data breach. The Bill utilises the derogations contained within the GDPR, including the derogations that permit the Government to legislate on the processing of criminal conviction data.

The Information Commissioner's Office has published Preparing for the General Data Protection Regulation (GDPR): 12 steps to take now and Guidance: what to expect and when, providing guidance on steps that employers can take in preparation for the new law.