What is the operational impact of the GDPR on the processing of personal data by startups?

On May 25, 2018, the General Data Protection Regulation (GDPR) will apply to all personal data processing within the European Union.

It will concern all businesses, regardless of size.

Therefore, it is essential to do what is necessary to be brought into compliance before the fateful date.

The GDPR has a double impact on your activities:

• Strengthening the protection of persons concerned by personal data.
• Adaptation of internal procedures to implement upstream compliance.

The sanctions, in case of non-compliance with the RGPD, are substantial in all cases:

• The highest figure between 10 million euros and 2% of global turnover for technical breaches (Privacy by Design, Privacy by Default, lack of impact assessment)
• The highest figure between 20 million euros and 4% of global turnover for violations of human rights.

Strengthening the rights of individuals with respect to personal data

The GDPR strengthens the rights of individuals whose personal data is collected.

The principles put in place are as follows:

• Processing of personal data in a lawful, loyal and transparent manner.
• Collection for precise, clear, determined, determined, explicit, understandable and legitimate purposes.
• Use only for these purposes.
• Minimization of the data collected to those that are relevant for the purpose.
• Data update — removal of outdated data.
• Storage limited in time to the needs of the treatment.
• Data security protection.
• Privacy by Design: the principles of the GDPR must be integrated as soon as the treatment is implemented.
• Privacy by Default: only the necessary data is processed.

These principles involve the implementation of specific technical procedures: acceptance by check boxes, anonymization, pseudonymization, encryption, logs, security processes.

The persons concerned must also be fully informed of the data collected, the purposes of the treatments and the procedures put in place. They must also be able to obtain from the data controller to modify the data, delete them, transmit or inform them about the personal data they hold about them, within one (1) month from the date of their request. Anyone can also object to the processing of their data at any time.

The rights granted are therefore extensive and must be reflected in your contractual documents (CGV/CGU in particular) and internal procedures.

The need to implement internal compliance procedures

While the rights granted to individuals are extended, they remain an extension of existing regulations.

On the other hand, businesses are now subject to transformed and much greater obligations.

The prior declaration is no longer necessary, as each data controller must guarantee compliance with the RGPD for all processing of personal data.

It is necessary, within each company with more than 250 employees, to maintain a register of processing carried out. Businesses with less than 250 employees should only keep a record of sensitive treatments or if the treatment is regular. However, all businesses are strongly advised to keep a record of the entirety of their processing. The CNIL provides a register template that it is recommended to use: https://www.cnil.fr/sites/default/files/atoms/files/registre-reglement-publie.xlsx

Any processing of sensitive data (health, political, ethnic, ethnic, religious, sexual data) or data that includes profiling must also be subject to a impact analysis. It is also recommended, although not mandatory, for all processing of personal data. The CNIL has made software available to the public that guides this analysis: https://www.cnil.fr/fr/outil-pia-telechargez-et-installez-le-logiciel-de-la-cnil

Companies are also invited to appoint a Data Protection Officer (DPO), who coordinates internal processing, and relationships with the CNIL in the event of an audit. This is mandatory if the company processes personal data on a regular and systematic basis, or if it processes sensitive data. The DPO can be internal to the company or a specific service provider.

Various technical and administrative procedures must also be put in place:

• Procedure for responding to requests from the persons concerned.
• Data portability.
• Follow-up of recipients.
• Procedure for notifying the CNIL in the event of a data breach.
• Documentary monitoring of compliance with the RGPD (regular technical audit, details of the security measures taken).
• Implementation of confidentiality obligations for employees.
• Limitation of access to data (for example via a permission system).
• Establishment of data access logs.
• Data purge system.
• Procedure for accepting the personal data policy by your customers, in particular if services are provided online (check box not pre-checked).

It is also important to ensure that your contracts with your subcontractors provide for a distribution of roles and responsibilities in terms of personal data, and in particular that your partners offer the necessary guarantees of compliance with the GDPR.

It is therefore necessary to take stock of your internal procedures and to adapt them prior to May 25, 2018.

The CNIL will have strengthened powers and resources to verify the compliance of companies with GDPR, as of this date.

Do not hesitate to contact us if you wish to be assisted.