Three years ago, the GDPR, a regulation that defines the principles of working with personal data of European Internet users, came into force. the GDPR, together with CCPA, is a major milestone in the history of personal data protection, and a headache for companies that collect data. A day after the GDPR came into force, Google and Facebook received claims totaling $8.8 billion.

Adsider explains what the GDPR is and how to avoid accidentally violating it.

The General Data Protection Regulation (the GDPR) is legislation that protects the personal data of individuals within the EU and the European Economic Area and punishes violations of standards.

The 88 pages of the regulation spell out what is meant by the concept of "personal data", who has the right to collect and process this information, according to which principles are prescribed the rights of data owners (ie Internet users), as well as obligations and restrictions for companies collecting data , and penalties for violations are determined.

The protection of personal data is enshrined in the European Convention on Human Rights. Article 8 of the Convention states: “Everyone has the right to respect for their private and family life, their home and correspondence”.

Advances in technology and the emergence of the Internet have led to the emergence of new ways of collecting data — for commercial purposes and not only. The more advanced Internet technologies became, the more risks arose associated with issues of confidentiality and the issuance of personal information for lack of information, especially with the advent of social networks.

In 2011, Google wearer of Massachusetts filed against the company's lawsuit accusing the tech giant of scanning her private correspondence.

In 2016, the Cambridge Analytica scandal, when the manipulation of private data allowed to influence the outcome of the elections in the United States, showed that the situation has become critical, and the personal data of users needs to be protected more than ever.

Your location doesn't matter. You can work from the USA, Ukraine, Guatemala, or even manage your company from a base in the Arctic — if you collect and process data from EU citizens or residents, you are also subject to the GDPR.

In short, it is very expensive to violate the GDPR.

There are two levels of penalties. The first, for less serious violations, is a fine of up to € 10 million, or 2% of the company's global annual income for the previous financial year (if this income is more than €10 million).

The second tier of penalties is €20 million, or 4% of the company's global annual income for the previous financial year.

You can read more about the fines on the website.

the GDPR entered into force exactly three years ago, on May 25, 2018, but the basic principles of the regulation were prescribed four years earlier — in 2014.

Work on the creation of relevant legislation began in 1995, with the adoption of the European Parliament Directive on the protection of personal data.

Adsider has collected the main events in the "life" of the GDPR.

Companies subject to the GDPR are required to comply with seven principles of protection and responsibility

It is worth noting that the company is responsible for ensuring the protection of the data that it has collected about its customers or users, and therefore, be responsible if hackers, competitors or someone who should not have had access to this data got to this data. Also, if the company has transferred the collected data to a third party without the informed consent of the user.

The user's consent to the collection and processing of personal data is also clearly regulated by the GDPR. The company cannot simply ask to "agree to whatever we do with your data."