Gdpr Laws: Implications For Who And Global Health

The General Data Protection Regulation (GDPR) is a privacy and security law that applies to organisations based in the European Union (EU) and the European Economic Area (EEA). It also applies to organisations outside of the EU and EEA if they target or collect data from people in the EU. The regulation, which came into effect in 2018, gives consumers more control over their personal data and holds companies responsible for the way they handle this information. It also imposes harsh fines on those who violate its privacy and security standards.

Who does GDPR apply to?

The General Data Protection Regulation (GDPR) applies to any company or entity that processes personal data as part of its activities and is based in the European Union (EU), regardless of where the data is processed. This includes small and medium-sized enterprises (SMEs) that process personal data, even if it is not a core part of their business.

The GDPR also applies to companies established outside the EU that offer goods or services (paid or for free) or monitor the behaviour of individuals within the EU. In such cases, non-EU-based businesses must appoint an EU-based representative.

The regulation does not apply if the data subject is deceased, the data subject is a legal person, or the processing is done by a person acting outside their trade, business, or profession.

Under the GDPR, personal data is defined as any information about an identified or identifiable individual, including basic identity information, web data (such as IP addresses and cookie data), health and genetic data, and racial or ethnic data.

The GDPR imposes obligations on organisations to protect the privacy and security of personal data, with harsh fines for those who violate its standards. It gives individuals more control over their personal data and simplifies the regulations for international businesses.

What is personal data?

Personal data is a crucial term when it comes to the application of the General Data Protection Regulation (GDPR). The definition of personal data is outlined in Article 4 of the GDPR.

Personal data is any information relating to an identified or identifiable natural person. This means that, for the data to be considered personal, it must be able to identify a person, either directly or indirectly. Direct identification could be through obvious identifiers such as a name or number, but also includes less obvious identifiers such as IP addresses or cookie identifiers. Indirect identification means that, while the data alone cannot identify an individual, other reasonably accessible information could be used to identify them. For example, the police can quickly match a name to a license plate number.

The definition of personal data is very broad and inclusive. It includes "objective" information, such as an individual’s height, and “subjective” information, like employment evaluations. It is also not limited to any particular format. Video, audio, numerical, graphical, and photographic data can all contain personal data. For example, a child’s drawing of their family that is done as part of a psychiatric evaluation could be considered personal data as it reveals information about the child and their parents.

In addition to general personal data, there are special categories of personal data, also known as sensitive personal data, which are subject to a higher level of protection. These include genetic, biometric and health data, as well as personal data revealing racial and ethnic origin, political opinions, religious or ideological convictions, or trade union membership.

It is important to note that personal data must relate to a natural person, meaning that data about companies or other legal entities do not fall under the definition of personal data. Furthermore, personal data must relate to a living person; data related to deceased persons are not considered personal data in most cases.

Who processes personal data?

The General Data Protection Regulation (GDPR) applies to any organisation that processes personal data. This includes any information relating to an identified or identifiable natural person.

Personal data is defined as any information that can be used to identify a person, directly or indirectly, and includes names, identification numbers, location data, online identifiers, and factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of a natural person.

Data processing, on the other hand, refers to any action performed on data, whether automated or manual, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, and destruction.

Under the GDPR, organisations that process personal data must comply with certain principles, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

The regulation applies to companies or entities that process personal data as part of their activities within the EU, as well as companies established outside the EU that offer goods or services to individuals in the EU or monitor their behaviour.

It's important to note that the GDPR does not apply to information about legal entities such as corporations, foundations, and institutions.

When does GDPR apply?

The General Data Protection Regulation (GDPR) applies to any company or entity that processes personal data as part of its activities and is based in the European Union (EU), regardless of where the data is processed. It also applies to companies established outside the EU that offer goods or services (paid or for free) or monitor the behaviour of individuals within the EU.

In other words, if your company processes personal data and is based in the EU, or if your company is established outside the EU but targets people living in the EU, then the GDPR applies to you.

The GDPR does not apply if the data subject is deceased, the data subject is a legal person, or the processing is done by a person acting outside of their trade, business, or profession.

Personal data is defined as any information about an identified or identifiable person, including basic identity information, web data (like IP addresses and cookie data), health and genetic data, and racial or ethnic data.

To ensure compliance with the GDPR, companies must implement measures to protect a data subject's privacy from the outset and be transparent about their data processing activities. They must also obtain explicit consent from individuals before collecting, storing, or processing their personal data.

When does GDPR not apply?

The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information from individuals who live in and outside of the European Union (EU). The GDPR applies to any company or entity that processes personal data as part of the activities of its branch established in the EU, regardless of where the data is processed.

However, there are certain scenarios in which the GDPR does not apply. Here are some cases where the GDPR may not be applicable:

• Geographical Scope: The GDPR does not apply to companies or entities that are based outside the EU and do not offer goods or services to individuals in the EU. It is important to note that simply having a website accessible in the EU is not sufficient for the GDPR to apply. The company must specifically target EU individuals or monitor their behaviour.
• Purely Personal or Household Activity: The GDPR does not apply to "purely personal or household activity." It only applies to organizations engaged in "professional or commercial activity." So, personal activities like organizing a picnic with friends or fundraising for a side business project are exempt from the regulation.
• Small and Medium-Sized Enterprises (SMEs): While SMEs are not completely exempt from the GDPR, they are generally freed from record-keeping obligations. If processing personal data is not a core part of their business and their activities do not create risks for individuals, then some obligations of the GDPR, such as the appointment of a Data Protection Officer (DPO), may not apply.
• EU Citizens Living Outside the EU: The GDPR specifically refers to "data subjects who are in the Union." Therefore, if an EU citizen is living outside the EU, such as in the US, the GDPR does not apply to them.
• No Targeting of EU Residents: Foreign companies are required to comply with the GDPR only if they intentionally target EU residents with their marketing or business activities. For example, if a Canadian company created ads in German or included pricing in euros on its website, it would be considered targeting EU citizens and thus subject to the GDPR.
• Public-Sector Organizations: Many public-sector organizations, particularly those that do not collect or process personal data of EU citizens, are not subject to the GDPR. Only specific federal agencies that have a reason to collect and monitor personal data of EU citizens, such as for security or tourism purposes, would fall under the scope of the regulation.

It is important to note that the applicability of the GDPR can vary depending on the specific circumstances and the nature of the organization's activities. The above-mentioned scenarios provide a general overview of when the GDPR may not apply.

Frequently asked questions