The GDPR (General Data Protection Regulation) is a new EU regulation that replaces the EU data protection directive dating from 1995. The new regulation aims to significantly improve the protection of the personal data of EU citizens and to make businesses and public authorities subject to stricter requirements regarding the collection and processing of personal data. The GDPR will be published on 25. This will enter into force on 1 May 2018. The Regulation incorporates many of the requirements of the 1995 EU Data Protection Directive with regard to data protection and security or further development. In addition, several new provisions have been added, which strengthen the rights of data subjects and provide for more severe sanctions for violations.

Whenever a data subject is about to provide personal data, data controllers (usually a company) must ensure that the data subject has given his/her prior consent. The GDPR also redefines the disclosure standards for obtaining consent. These must be expressed & voluntarily, for the specific case, in an informed and unambiguous manner”;. The persons responsible must address the data subjects in a “clear and simple”; legal language which & must be clearly distinguished from the other facts”;. Those responsible must also provide evidence that their processes are compliant with the rules and are always followed. Under the previous EU Data Protection Directive, the consent of a data subject could be inferred if his or her actions or omissions left no doubt as to his or her willingness to consent. The Directive thus allowed for the possibility of opt-out mechanisms. This will change with the GDPR, because now the person concerned must give his or her consent „in the form of a declaration or other clear affirmative act“.

Your customers must therefore not be forced to give their consent or be kept in ignorance of their consent to the processing of their personal data. In addition, your customers must know exactly what they are giving their consent for and they must be informed in advance of their right to withdraw their consent. Obtaining consent presupposes a clear sign of consent – silence, already ticked boxes or inactivity on the part of the persons concerned do not constitute consent. In the future, it is therefore important that you inform your users sufficiently during the consent process.

The Regulation also provides for two new rights for data subjects: a “right to be forgotten”/em>”, which obliges data controllers to inform recipients of requests for erasure, and a “right to data transferability”/em>”;, which allows data subjects to request a copy of their data in a standard format. These two rights make it easier for users to request the deletion of any information stored about them or the transmission of any information collected.

Data subjects have already had the right to request access to their data. The DSGVO extends these rights. In most cases you will not be able to charge a fee for a request for information unless you can prove that the costs involved are excessive. There is also a significant change in the deadline for processing an application for information. The currently applicable period of 40 days will be significantly shortened. In certain cases, undertakings may refuse to process a request for information, for example if the request is considered manifestly unfounded or unreasonable. However, in order to be able to admissibly reject an application, companies need clear guidelines and procedures, and they must be able to justify why a particular application meets the criteria laid down. (Vgl. https://www.hubspot.de/data-privacy/gdpr, 2020)