What will GDPR mean for your firm?
The General Data Protection Regulation (GDPR) will be enforceable in the UK from May 2018, updating the way businesses must handle personal data, including what they hold on employees. How is this going to affect HR professionals? HR magazine visited a data protection masterclass hosted by Ashfords to find out.
A key change from the DPD is an increased scope on who the GDPR applies to. If you are established in the EEA (or the firm processing your data is), you offer your services to residents of the EEA, or you monitor the behaviour of those in the EEA then the rules will apply to you.
If you are a public authority, carry out large-scale systematic monitoring of individuals, or carry out large-scale processing of special categories of data or data relating to criminal convictions and offences then you will need to welcome a DPO to your team.
Under the old system the maximum fine for a breach was £500,000. However, the GDPR will increase the amount under a two-tier structure. Less serious incidents could result in a maximum fine of either €10 million (£7.9 million) or 2% of an organisation's global turnover, whichever is greater. The most serious offences have a new maximum fine of up to €20 million (£17.9 million) or 4% of turnover, whichever is greater.
The GDPR is a European Directive, so Brexit throws up the question of whether it will still apply.
Secretary of state for culture, media and sport Karen Bradley said it will. “We will be members of the EU in 2018 and therefore it would be expected and quite normal for us to opt into the GDPR and then look later at how best we might be able to help British business with data protection while maintaining high levels of protection for members of the public,” she said.
Take steps now to be ready for when this is implemented in May, advised Coughlan. “It’s important to give someone ownership of this,” he said. “Start to try to streamline the data you have – if you find you have data you don’t need just delete it. Start mapping how data flows through your organisation."