The EU's General Data Protection Regulation (GDPR) comes into force this week. The GDPR is one of the important legal documents in Data Protection law which shall be applicable in whole EU by the 25th of May 2018. The GDPR shall be directly applicable to all EU states by replacing Data Protection Directive.
However, by application of its extra-territorial jurisdiction, the GDPR shall have an impact not only on the EU states, but on all states in the world. The GDPR shall apply to all organizations that collect, control and/or process personal information (PI) of EU Citizens, no matter where these organizations are incorporated in the world. In other words, the GDPR protects all PI of EU natural persons such as name, address, ID numbers, web data (location, IP address, cookie data and RFID tags), biometric data health and genetic data, racial or ethnic data and political opinions or personal lifestyle preferences.
As the GDPR has an extra-territorial jurisdiction, azerbaijani organizaitons also have to be aware of its requirements and take certain necessary measures, in order to avoid legal obstacles to be occurred. So, the organizations established in Azerbaijan that store or process PI about EU residents should comply with the GDPR rules, even though they do not have a business establishment or presence in the EU. It means that no matter if an azerbaijani organization is incorporated in EU or not, that should abide by the personal data protection rights of EU residents, if it does control and/or process such a PI information. Moreover, the EU organizations which are being functioned or operated in the territory of Azerbaijan, are also obliged to conform to the GDPR policy and requirements.
In order to act in accordance with the GDPR rules, all organizations, including azerbaijani organizations are required to receive a clear and simple consent for the collection, storage and processing of PI of an EU resident that is stored, controlled and/or processed. The purpose for such an use in a consent form must be clearly and simply explained to EU residents whose IP is used. In addition, all organizations have to obtain a consent for children's IP rights only from the holders of parental responsibility which is one of the GDPR requirements.
However, such a consent may be withdrawn at any time, if an organization decides to delete the information about this person. Such a requirement is directly linked to the rights of data subjects, strictly speaking, data subjects have the rights to request access to review their PI and to receive it in a portable version collected by organizations, or to ask their information to be deleted, or to be forgotten, or to be corrected if there are any inaccuracies.
Thereby, azerbaijani organizations are advised to implement the following measures, in order to conform to the GDPR requirements:
- To prepare internal policies in accordance with the GDPR
- To have to undertake data flow analysis to realize if any EU resident PI is being stored and controlled and/or processed in organizations' IT systems, websites and email lists.
- If there is any EU resident in the system, by receiving his/her consent to keep their personal data and use it for the purposes of marketing updates, email notifications related to any event.
- To implement advanced IT web and technology solutions for the protection of IP and the compliance with the GDPR requirements, and safeguard the EU data subjects rights (to be informed, to be reviewed, to be forgotten and to be corrected).
- To notify their customer and data protection authority within 72 hours of first having become aware of a breach which could jeopardize the PI protection of the EU residents.
- To preclude all EU residents from the system if there is not any reason for the storage of his/her PI.
- To conduct relevant trainings on the policies and procedures prepared in accordance with the GDPR requirements.
- In case, if needed, to appoint a Data Protection Officer (DPO)
Lastly, worth to be noted, taking into consideration that the PI of EU residents are mostly stored in the IT system of the big organizations, such as banks, insurance companies, oil and gas companies etc., they shall have to ensure the internal data protection policy and procedures to be strictly in compliance with the GDPR rules.
Comments
Post a Comment