What Is GDPR, and How Does It Affect Retailers?

The global face of privacy regulation changed in May 2018 with the European Union’s  implementation of the General Data Protection Regulation (GDPR). This sweeping regulation governs the privacy of personal information belonging to EU residents and applies to that information worldwide, not just within the boundaries of the EU.

The regulation sets specific requirements for how organizations, including retailers, handle personal information and imposes some daunting penalties for those that fail to comply. Retailers that haven’t already established a robust compliance program should plan to revise their business practices and implement appropriate controls. 

What Does GDPR Require?

GDPR requires that organizations incorporate data protection and privacy controls in all of their activities. Article 25 of GDPR summarizes the philosophy behind GDPR when it calls for “data protection by design and by default.” While organizations may take cost and other contextual information into account, the bottom line is that they must implement technical and administrative controls that are designed to protect the privacy of personal information. 

Organizations subject to GDPR may not process personal information unless they have an explicit lawful basis for doing so under one of the following six provisions:

1. The data subject has provided explicit consent to the processing for a specific purpose.
2. The processing is necessary to comply with a contract agreed to by the data subject or as part of entering into a contract at the request of the data subject.
3. The processing is necessary to comply with a legal obligation of the processor.
4. The processing is necessary to protect the vital interests of the data subject or another person.
5. The processing is necessary for carrying out tasks in the public interest or in the exercise of official authority vested in the processor.
6. The processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where those interests conflict with the interests, rights or freedoms of the data subject.

Many organizations choose to undertake data processing by exercising the first of these provisions: informed consent. It is important to note that this must be explicit consent, where the data subject affirmatively opted in to a specific use of data. Organizations cannot comply with GDPR while using opt-out approaches or asking subjects to agree to sweeping statements about data processing. GDPR also requires that organizations provide a process for individuals to revoke consent that they’ve already granted, access their own personal information and demand that organizations erase stored information, with some exceptions. This last provision is commonly known as the “right to be forgotten.”

Penalties for Noncompliance

The potential fines for organizations that fail to comply with GDPR can be quite steep and are the cause of significant concern for organizations of all sizes. The fines are progressive in nature, designed to have a substantial impact on any organization, regardless of its size. 

Regulators have wide discretion when assigning penalties under GDPR, and have several important tools at their disposal. For minor, first-time offenses, they may opt to simply warn a business that its practices are out of compliance and that the business must remediate the situation to avoid facing penalties. They may also prescribe compliance audits on a one-time or recurring basis. The major sanctions of GDPR are its financial penalties, which are capped at €20 million (roughly $23 million U.S.) or up to 4 percent of a company’s total revenue, depending on the nature of the offense.

Regulatory agencies in each EU nation are outlining their enforcement priorities under the new regulation. For example, the French data protection authority acknowledged the difficulty of total compliance and said that it will take that into account in its enforcement actions. Dutch authorities have stated that fines will be imposed only when something is very wrong. The general opinion among compliance professionals is that retailers and other businesses that demonstrate good faith efforts at working toward compliance will likely avoid the most severe sanctions under GDPR, at least for the next year or two.

MKT25065