GDPR: What it means for individuals and consumers

Terms of use

Terms of Use

The use of this site and the content contained therein is governed by the Terms of Use. When you use this site you acknowledge that you have read the Terms of Use and that you accept and will be bound by the terms hereof and such terms as may be modified from time to time.

All text, graphics, audio, design and other works on the site are the copyrighted works of nasscom unless otherwise indicated. All rights reserved.
Content on the site is for personal use only and may be downloaded provided the material is kept intact and there is no violation of the copyrights, trademarks, and other proprietary rights. Any alteration of the material or use of the material contained in the site for any other purpose is a violation of the copyright of nasscom and / or its affiliates or associates or of its third-party information providers. This material cannot be copied, reproduced, republished, uploaded, posted, transmitted or distributed in any way for non-personal use without obtaining the prior permission from nasscom.
The nasscom Members login is for the reference of only registered nasscom Member Companies.
nasscom reserves the right to modify the terms of use of any service without any liability. nasscom reserves the right to take all measures necessary to prevent access to any service or termination of service if the terms of use are not complied with or are contravened or there is any violation of copyright, trademark or other proprietary right.
From time to time nasscom may supplement these terms of use with additional terms pertaining to specific content (additional terms). Such additional terms are hereby incorporated by reference into these Terms of Use.

Disclaimer

The Company information provided on the nasscom web site is as per data collected by companies. nasscom is not liable on the authenticity of such data.
nasscom has exercised due diligence in checking the correctness and authenticity of the information contained in the site, but nasscom or any of its affiliates or associates or employees shall not be in any way responsible for any loss or damage that may arise to any person from any inadvertent error in the information contained in this site. The information from or through this site is provided "as is" and all warranties express or implied of any kind, regarding any matter pertaining to any service or channel, including without limitation the implied warranties of merchantability, fitness for a particular purpose, and non-infringement are disclaimed. nasscom and its affiliates and associates shall not be liable, at any time, for any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communications line failure, theft or destruction or unauthorised access to, alteration of, or use of information contained on the site. No representations, warranties or guarantees whatsoever are made as to the accuracy, adequacy, reliability, completeness, suitability or applicability of the information to a particular situation.
nasscom or its affiliates or associates or its employees do not provide any judgments or warranty in respect of the authenticity or correctness of the content of other services or sites to which links are provided. A link to another service or site is not an endorsement of any products or services on such site or the site.
The content provided is for information purposes alone and does not substitute for specific advice whether investment, legal, taxation or otherwise. nasscom disclaims all liability for damages caused by use of content on the site.
All responsibility and liability for any damages caused by downloading of any data is disclaimed.
nasscom reserves the right to modify, suspend / cancel, or discontinue any or all sections, or service at any time without notice.

For any grievances under the Information Technology Act 2000, please get in touch with Grievance Officer, Mr. Anirban Mandal at data-query@nasscom.in.

New

See all

No notification found.

GDPR: What it means for individuals and consumers

dionpwc

@dionpwc

May 17, 2018

Public Policy

450

By: Sivarama Krishnan, Leader, Cyber Security, PwC India

In today’s consumer-driven market, an individual’s personal information lies with various organisations and entities.
Consider an individual like you and me. The person, in all likelihood, would:

own a smartphone, smart devices and wearable technology;
have a social media account to connect with friends;
have accounts with commerce or e-commerce service providers;
have a bank account;
own insurance;
be registered with travel companies, airlines, hotel providers, cab service providers, etc.; and
file income tax and much more.

What all of the above means is that, as consumers, our personal information gets exposed to numerous organisations, both public and private. There have been many instances where this personal information has been used to infringe on individuals’ rights and freedom. Therefore, like any other tangible or intangible item that a person owns and controls, an individual’s personal information and how it is used and handled should also be controlled by the person.

Existing European data protection rules, mainly expressed via the European Union (EU) Directive 95/46/EC, laid out a respectable foundation for the development of data protection regulations by the EU member states. While the framework was comprehensive, considering the time of its introduction (in 1995), it lacked uniformity of data subjects’ rights across the EU and did not provide legal protection from inadequate personal data processing outside of the EU. The EU GDPR replaces the Data Protection Directive 95/46/EC and was designed to harmonise data privacy laws across Europe to protect and empower all EU citizens’ data privacy and to reshape the way organisations across the region approach data privacy. Some of the key changes introduced under the GDPR that benefit data subjects include:

Wider scope

While the GDPR applies to organisations established within the EU, the scope has been extended to include all companies processing the personal data of data subjects residing in the EU, regardless of the company’s location. The GDPR aims to protect consumer data that will impact business in not only the EU but also the US and the rest of the world.

Consent

The conditions for consent have been strengthened. Under the GDPR, consent needs to be ‘freely given, specific, informed and unambiguous’. This means that consumers have the freedom to either choose to provide or withdraw their consent for specific services. For example, a company providing travel services to its consumers shall not be able to deny travel services to its consumers if the consumers do not opt in (consent) or opt out (withdraw consent) from receiving any marketing mailers, subscriptions or newsletters from the company.

Right to access

The previous EU data protection laws provided data subjects with specific rights to promote transparency and control personal data. However, the current GDPR has expanded the rights of data subjects to the provision of a confirmation from the data controller as to whether or not personal data concerning them is being processed, where and for what purpose, as well as a copy of the personal data, free of charge. This essentially means that consumers have the right to know what personal data about them is collected and how such data is being processed by their service providers.

Data portability

This provides data subjects the right to receive personal data concerning them from companies in a ‘commonly used and machine readable format’ and the right to transmit that data to another controller. This means that consumers have the right to request their service provider to support portability of their personal data to another service provider when required.

Right to be forgotten

Also known as data erasure, the ‘right to be forgotten’ gives the data subject the right to have the data controller erase his/her personal data, cease further disclosure and also get the controller’s third parties to comply with such requests. For example, if you as a user of a social networking platform are not comfortable with the information about your ethnicity, sexual orientation or preferences being collected or processed, you have the right to withdraw consent and request erasure of such data from the platform and its associated third parties.

The GDPR has also enforced strict regulations for companies to safeguard personal data of data subjects, respect the privacy of data subjects and minimise the risks to the right and freedom of data subjects. Some of the key measures include:

Enforcement and liabilities: The regulatory liability for non-compliance for companies can exceed 20 million EUR or 4% of the worldwide annual turnover.

Privacy by design: Under the GDPR, it is mandatory for organisations to ensure that appropriate privacy and security measures are identified and implemented at every stage of personal data collection/processing. This may include business processes, applications and technical solutions.

Breach notification: One of the key requirements is the breach disclosure requirement, which will effectively require organisations to ‘wash their dirty linen in public’. Under this requirement, organisations have a mandatory obligation to report to data protection authorities any data breach that may pose a risk to the rights and freedom of individuals. Organisations are also required to inform individuals about the steps they should take to protect their data.

Use of third parties: The GDPR introduces specific requirements for organisations to carry out appropriate due diligence processes and contractual obligations that need to be agreed upon with third-party vendors to address risks around the misuse or inappropriate use of personal data by these companies.

To conclude, we are already looking at a cultural change where organisations are reaping the benefits of adopting a more transparent approach, giving control of data back to individuals, addressing their rights and essentially building trust with their consumers. As consumers, it means more power and control over our own data and its destiny.

Disclaimer

That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.

dionpwc

Call for Inputs: SEBI's consul...

Swapnil