DR.

RAM MANOHAR LOHIYA NATIONAL LAW

UNIVERSITY, LUCKNOW

SUBJECT: CYBER LAW

Session: 2018 - 2019

FINAL DRAFT

ON

“GENERAL DATA PROTECTION

REGULATION (GDPR)”

SUBMITTED TO: SUBMITTED BY:

Dr. Amandeep Singh Shubham Singh Rawat

Assistant Professor (Law) B.A. LL.B. (Hons.)

RMLNLU Sec. B; Enroll. No.-134

 ACKNOWLEDGEMENT

Through the mode of this acknowledgement I would thank my subject teacher for allowing me to
choose this topic as my project. Being one of the most important segment of subject, this topic
has given me a lot to learn, therefore I bestow my thanks to my subject teacher to give me an
opportunity to enhance my knowledge through the medium of this work. Working on the topic
was impossible without the assistance I got from the library staff and my friends so they also
deserve a special mention in this acknowledgement.

- Shubham Rawat
 TABLE OF CONTENTS

 INTRODUCTION

 TERMINOLOGIES OF GDPR

 REQUIREMENTS OF GDPR

 KEY TERMS IN GDPR

 LEGAL CASE IN GDPR

 SALIENT FEATURES OF GDPR

 PERSONAL DATA & ITS RELEVANCY IN GDPR

 WHEN CONSENT NOT REQUIRED IN GDPR

 CONCLUSION

 BIBLIOGRAPHY
INTRODUCTION:
The General Data Protection Regulation is a regulation in EU law on data protection and privacy
for all individuals within the European Union (EU) and the European Economic Area (EEA). It
also addresses the export of personal data outside the EU and EEA areas. The GDPR aims
primarily to give control to individuals over their personal data and to simplify the regulatory
environment for international business by unifying the regulation within the EU.
Superseding the Data Protection Directive 95/46/EC, the regulation contains provisions and
requirements pertaining to the processing of personal data of individuals (formally called data
subjects in the GDPR) inside the European Union, and applies to an enterprise established in the
EU or—regardless of its location and the data subjects' citizenship—that is processing the
personal data of people inside the EU. Controllers of personal data must put in place appropriate
technical and organizational measures to implement the data protection principles.

"Data protection by design and by default", means that business processes that handle personal
data must be designed and built with consideration of the principles and provide safeguards to
protect data (for example, using pseudonymization or full anonymization where appropriate),
and use the highest-possible privacy settings by default, so that the data is not available publicly
without explicit, informed consent, and cannot be used to identify a subject without additional
information stored separately. No personal data may be processed unless it is done under a
lawful basis specified by the regulation or unless the data controller or processor has received an
unambiguous and individualized affirmation of consent from the data subject. The data subject
has the right to revoke this consent at any time.

A processor of personal data must clearly disclose any data collection, declare the lawful basis
and purpose for data processing, and state how long data is being retained and if it is being
shared with any third parties or outside of the EU. Data subjects have the right to request a
portable copy of the data collected by a processor in a common format, and the right to have
their data erased under certain circumstances. Public authorities, and businesses whose core
activities centre around regular or systematic processing of personal data, are required to employ
a data protection officer (DPO), who is responsible for managing compliance with the GDPR.
Businesses must report any data breaches within 72 hours if they have an adverse effect on user
privacy.

The GDPR was adopted on 14 April 2016, and became enforceable beginning 25 May 2018. As
the GDPR is a regulation, not a directive, it does not require national governments to pass any
enabling legislation and is directly binding and applicable. In some cases, violators of the GDPR1
may be fined up to €20 million or up to 4% of the annual worldwide turnover of the preceding
financial year in case of an enterprise, whichever is greater.

1
[Link]
 TERMINOLOGIES OF GDPR

• The data controller is the person or organisation who determines the how and what of
data processing.
• The data subject is the person about whom personal data is being processed.
• A data processor is the person or organisation who takes an action with the personal
data you control – this might be a 3rd party acting on your behalf.
• Processing is anything done with/to personal data, including storing it.
• The Data Protection Officer (DPO) is a specific role which will be a legal requirement
for many organisations including large church bodies such as NCIs or dioceses.

REQUIREMENTS OF GDPR

The GDPR imposes a wide range of requirements on organizations that collect or process
personal data, including a requirement to comply with six key principles:

• Transparency, fairness, and lawfulness in the handling and use of personal data. You will
need to be clear with individuals about how you are using personal data and will also need a
“lawful basis” to process that data.

• Limiting the processing of personal data to specified, explicit, and legitimate purposes. You
will not be able to re-use or disclose personal data for purposes that are not “compatible” with
the purpose for which the data was originally collected.

• Minimizing the collection and storage of personal data to that which is adequate and
relevant for the intended purpose.
The aim of GDPR is Regulation on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data. The GDPR aims
primarily to give control to citizens and residents over their personal data and to simplify the
regulatory environment for international business by unifying the regulation within the EU.2

2
[Link]
 KEY TERMS IN GDPR CONCEPT

Article 4 of the GDPR includes a list of defined terms used in the regulation. Several are
particularly important:
“Controller” means the natural or legal person, public authority, agency or other body which,
alone or jointly with others, determines the purposes and means of the processing of personal
data.
“Processor” means a natural or legal person, public authority, agency, or other body which
processes personal data on behalf of the controller.
“Personal data” means any information relating to an identified or identifiable natural person
(“data subject”); an identifiable natural person can be identified, directly or indirectly, in
particular by reference to an identifier such as a name, an identification number, location data, an
online identifier, or to one or more factors specific to the physical, physiological, genetic,
mental, economic, cultural, or social identity of that natural person.
“Processing” means any operation or set of operations which is performed on personal data or
on sets of personal data, whether or not by automated means, such as collection, recording,
organization structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure
by transmission, dissemination or otherwise making available, alignment or combination,
restriction, erasure or destruction.
“Pseudonymization”3 means the processing of personal data in such a manner that the personal
data can no longer be attributed to a specific data subject without the use of additional
information, provided that such additional information is kept separately and is subject to
technical and organizational measures to ensure that the personal data are not attributed to an
identified or identifiable natural person.

LEGAL CASE AROUND GDPR

Max Schrem’s Case: Facebook, Google, Instagram and WhatsApp are accused of forcing users
to consent to targeted advertising to use the services.
Privacy group [Link], led by activist Max Schrem’s, said people were not being given a "free
choice".

If the complaints are upheld, the websites may be forced to change how they operate and they
could be fined.

But those rights don't have the force of law behind them, which means you can't file a
complaint against Microsoft for violating the GDPR if you aren't an EU resident. While you

3
[Link]
enjoy these rights only as long as a company says you do, it does show that the European
regulations are reshaping the way major companies approach user data.

The other way this affects you is with the barrage of privacy policy updates you've likely
received over the past few months. Many companies crafted new privacy policies in advance of
the GDPR going into effect, and then they told you about it all at the same time.

EU Justice Commissioner Vera Jourova said the new GDPR rules "cannot be applied in this
[Cambridge Analytica scandal], because there's no retroactivity possible."

SALIENT FEATURES OF GDPR

1) Broad jurisdiction. The GDPR applies to all companies that process personal data of EU
citizens, regardless of where the EU citizen resides.

2) Strong penalties. Breaches can cost companies up to 20 million Euros or up to 4 percent of

their annual global turnover. Some infractions are less expensive but still represent a significant
penalty.

3) Simplified and strengthened consent from data subjects. Consent must be given in an easy-
to-understand, accessible form, with a clear written purpose for the user to sign off on, and
there must be an easy way for the user to reverse consent.

4) Mandatory breach notification. Any data breach that is likely to “result in a risk for the
rights and freedoms of individuals” must be reported within 72 hours of its discovery. Data
processors will also be required to notify their customers “without undue delay” after first
becoming aware of a data breach.

5) A reiteration of important consumer rights. This includes the data subject’s right to get copies
of their data and information on how it’s being used and the right to be forgotten, also known
as Data Erasure. Additionally, it will also allow customers to move their data from one
service provider to another.

Better systems. In order to comply with the core foundation of “privacy by design,” GDPR
requires processes to be built with data protection in mind, rather than treated as an afterthought.

6) Specific protection for children. Since kids are generally more vulnerable and less aware of
risks, GDPR includes guidance that includes parental consent for children up to age 16.

7) Introducing the data protection officer

GDPR requires companies that process large amounts of data to hire dedicated personnel to
manage all aspects of GDPR compliance. The Data Protection Officer (DPO) is expected to be
in addition to any current IT or data security personnel working for the company and is the point
person in terms of compliance and liability for GDPR.

8) From its charter: “The protection of natural persons in relation to the processing of
personal data is a fundamental right.”

Companies that wish to stay in compliance must implement processes (and in many cases, add
personnel) to ensure that when data is handled, it remains protected. To comply with this
requirement, GDPR promotes pseudonymization, anonymization and encryption.

Anonymization is the encryption or removal of identifiable information so that it can never be

tied back to a user. Pseudonymization is somewhere between identified and anonymous. With
pseudonymization, the data components are anonymized and separated but can be put
back together. For example, a system might assign a user one identifier for location and another
for browser that can only be tied back to the user if it is put together with their date of birth,
which is kept separately. The regulation promotes pseudonymization over anonymization.

Even if you personally aren’t in Europe, and you aren’t working for a European firm, you still
need to abide by GDPR principles if you store or process the data of European individuals.
The simplest example is if your business builds new software. If you make it available to buy on
the internet, and let people from all countries buy it, then GDPR applies to the way you process
the data of your European customers.

What is Personal Data and how is it relevant with GDPR?

The ICO (Information Commissioner’s Office) defines personal data as any information relating
to an identifiable person who can be directly or indirectly identified in particular by reference to
an identifier e.g., Name, Address, Data of birth, Location, data gathered from browser history,
Identification number, such as a customer reference number, as long as that can be tied back to a
person, Online identifier, like a social media user name.

When Consent is NOT required in GDPR?

GDPR (and DPA) are all about making sure data processing and sharing is done properly – they
aren’t there to prevent legitimate data sharing, so there is a lot you can do without consent. For
example, you can process personal data without consent where it is necessary:

• For the performance of a contract.

 • For compliance with a legal obligation.
• To protect the vital interests of the data subject or another person.
• In the exercise of official authority or in the public interest.
• For the purposes of legitimate interests you are undertaking.

CONCLUSION

With the growing era of cyber-crimes including cyber stalking, cyber bullying and other
communal hatred activities going, it is high time that Govt. of India should bring appropriate
legislation to deal with GDPR concept so as to protect the rights of individuals in our country.
GDPR helps to combat cyber terrorism and protect the personal data’s of individual’s and help
the minority in the world to combat against the large MNC’s like Facebook, Google who uses
third party cookies to transfer your personal data’s at anonymous places without your free and
willing consent. Hence the aim of GDPR is Regulation on the protection of natural persons with
regard to the processing of personal data and on the free movement of such data. The GDPR
aims primarily to give control to citizens and residents over their personal data and to simplify
the regulatory environment for international business by unifying the regulation within the EU
countries. As the GDPR is a regulation, not a directive, it does not require national governments
to pass any enabling legislation and is directly binding and applicable. In some cases, violators of
the GDPR may be fined up to €20 million or up to 4% of the annual worldwide turnover of the
preceding financial year in case of an enterprise, whichever is greater. Hence it is a good tactic to
keep a check on the growing power of these social websites and make them come under the
purview of GDPR. It even helps to restore your privacy, keep a check on your account and if at
any future course of time period any breach occurs, then GDPR principles would enable the Data
Controllers to protect your personal data and aware you regarding the concerned breach. Even in
India, RBI is coming up with proposals of Data Localization to enable the data controllers to set
up their offices in the concerned countries of where their consumer’s reside of the same
nationality, which could help in processing data at a local place.
 BIBLIOGRAPHY

 [Link]
 [Link]
 [Link]
law-transforms-privacy-rights-for-everyone-without-edward-snowden-it-might-never-
have-happened/?utm_term=.088bebcd7961
 [Link]
protection-officer-role
 [Link]