What Do Europe’s New Privacy Laws Mean For US-Based Colocation Clients?
Posted March 1, 2018 by Chris & filed under Colocation
On May 28th, the EU will introduce strict new privacy laws through the GDPR (EU General Data Protection Regulation). This is designed to enhance privacy protections for all individuals within the EU, including non-citizens who travel to these countries. Given the significantly stricter nature of these regulations, it’s nearly certain that US colocation clients need to take action before the end of May if they haven’t already prepared.
Why should US-based colocation clients care about the GDPR? The answer is simple: only if their business activities in the EU involve processing and storing personal data of EU citizens. Non-compliance carries stiff penalties, with fines reaching up to €20,000,000 (approximately $24,600,000).
EU data protection organizations are expected to enforce the GDPR rigorously, although the specific enforcement mechanisms remain unclear at this time. If your colocated hardware processes or stores EU citizens’ personal data, your business is liable if it doesn’t comply with the GDPR. Unlike previous regulations, this includes both controllers (companies that collect and "own" the data) and processors (companies that work on the data for a third party). In essence, if the data of EU citizens interacts with your servers, the GDPR applies.
Note: Even though the UK is set to leave the EU, its government has indicated plans to introduce national laws compatible with the GDPR, so US colocation clients may still need to adhere to these regulations even if they only operate in the UK.
What does GDPR compliance entail?
The GDPR itself is a lengthy document, but in essence, it centers around shifting control of personal data from businesses that collect it to the individuals it concerns. This includes any information that can identify an individual, such as names, addresses, images, IP addresses, credit card details, localization data, and more.
Key aspects of the GDPR include:
- Breach disclosure: Notification of data breaches affecting protected data within 72 hours.
- Access: EU citizens have the right to access any personal data stored by a company upon request.
- Consent: Businesses must obtain explicit consent before collecting personal data and disclose how it will be used. Vague privacy policies are no longer acceptable.
- Right-to-be-forgotten: Individuals can request the deletion of their identifying information.
Preparing for GDPR
Any colocation client doing business in the EU should already be prepared. If not, they have only a few months to implement measures. This includes conducting a thorough data survey: identify and assess where EU residents’ data is stored and associated risks.
Current privacy policies and consent processes are likely inadequate. Specifically, ensure that you clearly indicate your intended use of collected data at the point of collection. Avoid automatically opting users into data collection. Any opt-in interfaces should be explicitly set to "opt-in."