Privacy & Information Security Law Blog

On November 9, 2016, the Centre for Information Policy Leadership (“CIPL”) at Hunton & Williams LLP and AvePoint released the results of a joint global survey launched in May 2016 concerning organizational preparedness for implementing the EU General Data Protection Regulation (“GDPR”). The GDPR replaces Directive 95/46/EC and will become applicable in May 2018.

The impetuses for the survey were the many significant changes the GDPR will bring to companies’ management and processing of personal data, their privacy compliance programs and their IT systems and infrastructure. CIPL and AvePoint decided to collaborate on this survey to help stakeholders understand the relevant, upcoming challenges and assist organizations in preparing for the implementation of the GDPR.

The survey questions focused on the GDPR topics most relevant to everyday business and compliance concerns. The survey received 233 responses from predominantly multinational organizations, of which 93 percent operate in Europe, more than half operate in the U.S. and less than half operate in South America and Asia. Telecommunication and technology companies were the most represented respondents, followed by insurance and financial services companies, as well as pharmaceutical and healthcare companies. The survey respondents were a mix of both data controllers and data processors, with 57 percent controllers and 43 percent processors. Finally, respondents’ annual revenue size ranged from less than $1 million to more than $100 billion.

The survey results reveal that most respondents have started to assess the impact of the GDPR on their operations, devise company-wide implementation plans and evaluate the need for additional resources. The survey results showed the following key trends:

• GDPR Impact: Respondents believe that the GDPR requirements that will have the largest impact on their organizations include the requirement to implement a comprehensive privacy management program and obligations with respect to processor contracts, data security and breach notification. As expected, senior management is most concerned about the GDPR’s enhanced sanction regime and the data breach notification requirements, as well as how the GDPR will impact their data strategy and ability to use data.
• GDPR Readiness: Respondent organizations appear to be in varying stages of preparation for the GDPR. Most have appointed a data protection officer (“DPO”), and many are either increasing resources in preparation for the GDPR’s implementation or are in the process of considering additional resources to meet the increased obligations.
• Consent and Legitimate Interest: At present, respondent companies rely heavily on the consent of individuals for the processing of their personal data, but results show that only a minority of respondents would be able to meet the enhanced requirements for consent under the GDPR using their current methods. Almost one-third of respondent organizations say that once the GDPR is implemented, they will rely more on the legitimate interest for processing legal basis than they currently do.
• Data Privacy Impact Assessment (“DPIA”) and Privacy by Design: The majority of respondent organizations already carry out, or are preparing to carry out, DPIAs in the circumstances required by the GDPR. More than 36 percent of those organizations have a framework to identify risks to individuals, while another 36 percent are working on developing such a framework. The vast majority of respondent companies tend to incorporate privacy and security by design into the development of new products and services regularly or some of the time.
• Controller/Processor Relationships and Agreements: A majority of respondent organizations’ standard processing agreements already reflect some of the new GDPR requirements. Only 32 percent of respondent organizations are currently undertaking a review or renegotiation of their processing agreements. Apart from the contractual requirements, processors will be most impacted by the GDPR requirement to document all data processing activities and adhere to the restrictions on data transfers outside the EU.
• Data Transfers Outside the EU: Respondent organizations currently appear to use a wide variety of mechanisms for transfers of employee, customer and vendor data. According to the responses, most will continue to do so after the GDPR is implemented. The most popular mechanisms currently used are, in descending order: Model Contracts, consent, the legal basis of necessity and the EU-U.S. Privacy Shield. Once the GDPR is implemented, in addition to Model Contracts, there is expected to be an increase in the use of Binding Corporate Rules, the legitimate interest for processing derogation and the EU-U.S. Privacy Shield.
• Data Breach Notification: The majority of respondent companies currently have a procedure for reporting breaches, as well as an internal response plan and team. This will help them comply with the new requirements to notify data protection authorities and affected individuals after a breach. Only a minority of respondents, however, conduct “dry runs” of their breach notification plans, maintain cyber insurance or retain public relations and forensic experts.
• Compliance Technology Tools and Software: Currently, respondent organizations do not appear to widely use, or have access to, technology tools and software to aid with data privacy compliance tasks. Only a minority of respondents use technology to automate and industrialize their DPIAs, data classification and tagging policies, data processing inventories and delivery of the new data portability right.
• Company-wide Approach to GDPR Implementation: Because of the interdependencies among data privacy compliance, IT systems and infrastructure, and organizations’ data strategy, GDPR implementation should be a company-wide change management program, which includes a concerted effort by senior leadership, including DPOs, CISOs, CIOs, CDOs and GCs.