3,197
edits
Changes
Jump to navigation
Jump to search
Line 7:
Line 7: − + + + Line 33:
Line 35: + +
General Data Protection Regulation (view source)
Revision as of 22:50, 22 January 2021
, 3 years agono edit summary
==Applicability and Scope==
==Applicability and Scope==
Under the Data Protection Directive of 1995 only applied to companies with legal establishment in an EU country or uses equipment located in the country to process the data. The GDPR expands the territorial reach to include controllers or processors outside of the EU for data processing activities relating to the offering of goods or services to individuals in the EU or to the monitoring of their behavior.<ref>[https://www.wileyrein.com/newsroom-newsletters-item-May_2017_PIF-The_GDPRs_Reach-Material_and_Territorial_Scope_Under_Articles_2_and_3.html The GDPR's Reach: Material and Territorial Scope Under Articles 2 and 3]</ref>
Under the Data Protection Directive of 1995 only applied to companies with legal establishment in an EU country or uses equipment located in the country to process the data. The GDPR expands the territorial reach to include controllers or processors outside of the EU for data processing activities relating to the offering of goods or services to individuals in the EU or to the monitoring of their behavior.<ref>[https://www.wileyrein.com/newsroom-newsletters-item-May_2017_PIF-The_GDPRs_Reach-Material_and_Territorial_Scope_Under_Articles_2_and_3.html The GDPR's Reach: Material and Territorial Scope Under Articles 2 and 3]</ref> EU guidance has made it clear that any website that offers goods or services to EU residents, or that routinely processes and/or stores data of website visitors is technically subject to GDPR enforcement.<ref name="gdproutsideEU">[https://gdpr.eu/companies-outside-of-europe/ GDPR.eu - Companies Outside of Europe]</ref> Two exceptions apply to this broad statement:
#The GDPR only applies to organizations engaged in “professional or commercial activity.” Note that "professional or commercial activity" is only defined in contrast to "personal or household activity."<ref name="recital18">[https://gdpr.eu/Recital-18-Not-applicable-to-personal-or-household-activities/ GDPR Recital 18 - Not Applicable to Personal or Household Activities]</ref> "Enterprise" is defined in Article 4 as "a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity."<ref>[https://gdpr.eu/article-4-definitions/ GDPR Article 4]</ref> This seems to assign "professional or commercial activity" by inference to the activity of "enterprises," while "personal or household activity" is described as a "natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity."<ref name="recital18" /> However, natural people can be "enterprises" under the definition. The EU guidance suggests, for example, that "if you’re collecting email addresses from friends to fundraise <nowiki>[for]</nowiki> a side business project, then the GDPR may apply to you."<ref name="gdproutsideEU" />
#Small- and medium-sized enterprises (SMEs - defined as having less than 250 employees) are not totally exempt from the GDPR, but they do not have to comply with the record-keeping regulations in Article 30.<ref>[https://gdpr.eu/article-30-records-of-processing-activities/ GDPR Article 30 - see specifically Article 30.5]</ref>
==GDPR and WHOIS==
==GDPR and WHOIS==
== Similiar Initiatives in Other Countries ==
== Similiar Initiatives in Other Countries ==
India is exploring a [[White Paper on Data Protection framework for India|similar data protection measure]], and has a call for public comments on a white paper. It is available for comment as of March 2018.
India is exploring a [[White Paper on Data Protection framework for India|similar data protection measure]], and has a call for public comments on a white paper. It is available for comment as of March 2018.
Brazil's legislative is currently debating two Data Protection Bills, one of which was designed as to be GDPR-compliant.
== References ==
== References ==