The EU’s General Data Protection Regulation: a new competitive factor

What is personal data?

The term “personal data” covers a great deal of information that we wouldn't normally think of as personal data as such. It covers, for example, something as ordinary as the contact details of a contact person at a company – that is, name, phone number, email, address, birthday, IP addresses and so on. It also covers more sensitive information such as religion, health, sexual orientation, political beliefs and trade union membership. And it covers biometric data too, such as the fingerprint used in security systems to get access to a particular room, a phone, an app and so on. In fact, any information that can be used to identify a person can be considered personal data – and is therefore covered by the personal data rules.

What is the purpose of the personal data rules?

The purpose of the personal data rules has several parts. Among other things, they are to ensure that personal data is only collected, processed and stored to the extent necessary for the data processor to carry out the function the information is to be used for. The rules are also to ensure that the information collected isn't used for any purpose other than the one it was collected for – unless the person the information concerns has given clear and informed consent to another use. Finally, the rules are to ensure that personal data isn't passed on to others without the consent of the person concerned.

The last of these can pose some challenges in today's cloud-based software systems with open APIs, apps and other interfaces. Here, personal data can easily be passed on both inside and outside the EU without the company holding the data having approved it. This can happen, for example, if the person concerned has installed an app that can communicate with another company's software system through an open API.

Where do the personal data rules apply?

The EU’s General Data Protection Regulation will apply to everyone who offers products and services to citizens in the EU, and to everyone who processes data about EU citizens.

In global companies (including software marketed globally), data can be collected, processed and stored freely within the EU countries as long as the EU General Data Protection Regulation is complied with, while there will be some special restrictions and security requirements as soon as personal data is transferred for processing outside the EU, for example if a software company uses data centres located outside the EU.

Which requirements could affect software design?

• People have the right to be told what personal data about them is collected, processed and stored. They also have the right to correct errors and inaccuracies and to demand the deletion of all their personal data (also known as the right to be forgotten), and they can demand to have their personal data transferred in a readable format (data portability), for example if they want to switch from one service provider to another in the same field.
• People must also have the right to opt in or opt out of data collection about them, and where required, the systems' default position must be opt-out (privacy by default). Software developers should therefore consider features where users can retrieve their data themselves and correct, delete and transfer it themselves. It also requires a clear and appropriate way of storing data, so there's a guarantee that no copy of it will remain in another application once it has been deleted in the system (apart from data that may be on backup discs, where there can be special exceptions).
• Stricter requirements will apply to both technical and organisational data security, and there must be procedures for notifying the people affected in the event of data loss or data leaks. There must also be procedures for closing a “data breach” and for notifying Datatilsynet within 72 hours of such an incident, and the people affected as soon as possible after that.
• Data processors, who until now have only been responsible under the data processing agreement they have entered into, will have to meet the same requirements as the data controller. They must also be able to assist the data controller with documentation of compliance with the personal data rules.
• As the data controller must be able to document “compliance” with the new rules, there are new and stricter requirements for documentation through tracking/logging and for control of data.

All in all, the new personal data regulation can seem a little complex. That's why work is under way at both EU and national level on guidance and guidelines to help companies understand and implement the rules. In May 2017, the Danish Ministry of Justice published a report on the General Data Protection Regulation (report no. 1565) and a list of the guidance to be published during 2017 (see http://justitsministeriet.dk/sites/default/files/media/Pressemeddelelser/pdf/2017/plan_for_vejledninger_om_forordningen.pdf, in Danish), and Datatilsynet is continuously working on publishing practical guidance in the area.

The road to fines or success?

In most cases, the advisory industry presents the personal data rules as a complicated and overwhelming compliance risk that could lead to very large fines for companies if the rules aren't followed to the letter. Very few choose to see the personal data rules as a business opportunity and a potential competitive factor for companies.

In the start-up community, which includes many software development companies, there is a tendency not to have worked out what personal data actually is and how it is handled. So it comes as no great surprise that many small and medium-sized companies in Denmark aren't aware at all of the special requirements for collecting, processing and storing personal data. Many of them therefore haven't spent resources on finding out what further requirements they must now meet under the EU’s General Data Protection Regulation. And that means some of these companies will get into trouble. Intentionally or unintentionally, they will breach the EU’s personal data rules and incur fines.

Other start-ups, on the other hand, will discover that being able to document that you have personal data under control and comply with the rules can be a very powerful competitive factor. Companies that either work with, or offer their services to, partners in heavily regulated business areas will be able to benefit from this in particular. For banks, insurance companies, lawyers and accountants, for example, it will be a decisive requirement that their partners meet the EU’s General Data Protection Regulation. And, not least, that they can document it.

So what now?

Whether as a company you only want to do the absolute minimum required to avoid fines, or you'd like to use the personal data rules as a business opportunity, you need to get to know what the rules are about. You need to know their purpose and which of them are relevant to your own activities and your customers'. And then you need to set up your organisation and your product to meet the requirements. This applies especially to companies that develop software involving personal data. The EU’s General Data Protection Regulation also sets requirements that affect the way a software system is designed – so it's necessary to build personal data into your design as early as the programming stage.

In light of the new personal data rules, companies should therefore first and foremost map what data they collect, what personal data they need to collect, what the data is used for, where it is stored and whether it is passed on, intentionally or unintentionally. This also applies to companies that develop cloud-based software applications that collect, process and/or store personal data to some extent. Next, you should carefully consider whether your partners also comply with the EU’s General Data Protection Regulation. Do they make sure, for example, that personal data isn't passed on to parties outside the EU without the people's consent? This applies to everything from agreements with data centres on server capacity for data processing and storage, to email servers, providers of payment solutions or other associated services involved in making payments and so on.

It's also important that companies think carefully about the consent they want the people whose data is collected, processed and stored to give. It is considerably harder to change a consent once a system has 100,000 users than when the company is just starting up.

The above is in no way an exhaustive list of the challenges and considerations companies face when the EU’s new General Data Protection Regulation comes into force. We therefore recommend seeking advice from relevant advisers who can help implement the new rules in the company's basic mindset, business procedures and policies.