How data protection will change under GDPR

摘要

The General Data Protection Regulation (GDPR) should not be news to anyone who runs an organisation, but many remain unaware of its far reaching implications. One of the popular myths doing the rounds is that it is essentially the Data Protection Act (DPA) of 1998 dressed up in new clothes. The truth is that the DPA underpins the GDPR, but the critical difference - and this really has to be driven home to naysayers - is that the DPA was a law that encouraged best practice, but did not enforce compliance. The GDPR is legalisation that enforces compliance on all organisations that hold or process data on individuals.Previously, only a select few people in an organisation needed to understand the rudiments of data protection; under the GDPR everyone needs to understand the levels of compliance involved. Ignorance of these regulations will not be bliss and could result in an expensive fine and far reaching reputational damage.Examples of before and after GDPR include healthcare group Bupa, which suffered a malware attack last year in which criminals stole 108,000 of its customers' data. This involved people's home addresses, health insurance plans and bank account details. The maximum fine the Information Commissioner's Office (ICO) could impose under the DPA was (until May this year) £500,000.