Transparency & Trust: Privacy in a Data Centric WorldNick Stringer – Public Policy Consultant

20 October 2016

“The EU provides the right to have your personal data protected by strong, European laws…because in Europe privacy matters.”

- Jean-Claude Juncker, President of the European CommissionBrussels, 14 September 2016

The EU General Data Protection Regulation (GDPR)

• An overhaul of existing EU data protection laws. • Aims to:

Update the legal framework to reflect today’s digital world; Give citizens greater control over their personal data; and Streamline the rules across EU markets – facilitating availability

of commerce across the EU ‘single market’.

• To apply directly in all EU markets from 25 May 2018.• Existing ePrivacy Directive (aka ‘cookie law’) remains in place, for

now.

But what does it mean for advertising?

1.The new law has a broader definition of personal data -

pulling more advertising data into the ‘regulatory net’.

But what does it mean for advertising?

2.It will be ‘Data Protection Year 0’ for many advertising businesses - new obligations, such as on transparency

and accountability.

But what does it mean for advertising?

3.The new law has global significance.

It will apply to where the individual is located not to where the [data processing] equipment is located.

But what does it mean for advertising?

4.The new law will make the obtaining of user consent tougher: likely to benefit organisations with a direct user

relationship.

But what does it mean for advertising?

5.The new law ramps up the penalties for breaches or non-

compliance:€20m or 4% of annual global turnover.

“Brexit should not mean Brexit when it comes to standards in data protection”

– Elizabeth Denham, UK Information Commissioner

London, 29 September 2016

And there’s more to come…• The ePrivacy Directive (aka ‘cookie law’) is under review to

ensure it is aligned with GDPR.• Its provisions (for advertising) are covered by the GDPR.• But EU regulators are calling for (a) tougher yet more user-

friendly consent provisions; and (b) a similar territorial scope to the GDPR.

• Legislative proposals expected at the end of 2016.• GDPR preparation needs to take review into consideration.

Thanks!

@nickstringernick@njstringer.com