The General Data Protection Regulation (GDPR) becomes effective May 25, 2018, and there are at least three areas of concern for the compliance practitioner that are explored below.
First, data privacy. Leaving aside the issues raised in the Facebook/Cambridge Analytica matter around the behavioral advertising business model, companies will now be faced with a very robust requirement to protect personal identifiable information and will also be prohibited from harvesting such data for an investigation, absent informed consent. This consent is not a condition of employment, but rather a matter of employee agreement. This means that data review, oversight, and monitoring, currently routine procedures in American companies, are now illegal, absent this consent. This will mean a big change in procedure for how companies gather and maintain data.
