Real impact!
Understanding GDPR
Shalini Kurapati, CIPP/E
Co-founder, Clearbox AI
Fines and reputation damage are real
Example - Italian SA fines a diabetes app
- Email addresses in CC instead of BCC - information breach + health status disclosure
- Breaches of
- Lawfulness, fairness, and transparency (validity of consent)
- Purpose limitation; security
- Disclosure of special category (health status) - fine EUR 45,000
1 https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9809998
225 million fine - true story
- WhatsApp - Millions of EU users
- Transparency, insufficient safeguards
- Data sharing with its parent companies
- Irish SA- EUR 225 million with a strong reprimand
- The app had to change its privacy policy
1 https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-whatsapp-inquiry
No exemptions for EU bodies
- European Parliament violation of GDPR - EDPS reprimand
- Transparency shortcomings privacy policy
- Inadequate safeguards for data transfers to the US
1 https://noyb.eu/en/edps-sanctions-parliament-over-eu-us-data-transfers-google-and-stripe
International transfers: Adequacy
- GDPR covers 27 EU and three non-EU (Iceland, Liechtenstein, and Norway) countries
- Personal data transfers outside these countries need special safeguards - Adequacy
- Seal of approval - GDPR level protection
- European Commission (Article 45, GDPR) - Decides on adequacy, continuous reviews
- Example
- US adequacy decision revoked in 2020
- Ongoing talks about reinstating adequacy
