English
Magyar
Personal data is the most important ‘currency’ in the modern online world, so it is no surprise that increasingly stringent laws are being introduced to regulate both its handling and its use.
Even an online shop or an average small or medium-sized enterprise now handles a vast amount of data, as both customers and employees provide not only their names but also their addresses, email addresses and telephone numbers, and often even their place and date of birth, as well as their tax reference numbers.
As this data is extremely valuable on the World Wide Web, the General Data Protection Regulation (better known as the GDPR), which aims to protect the personal data of individuals, came into force in Hungary on 25 May 2018. Its purpose is to ensure that individuals enjoy uniform data protection across all Member States of the European Union.
What is the GDPR?
GDPR is an acronym. The full name of the regulation is the General Data Protection Regulation, which could loosely be translated as the ‘General Data Protection Regulation’. It is in force in all 28 Member States of the European Union and has caused problems in several countries, as it has cast the data protection guidelines previously in force in an entirely new light.
It is considered one of the strictest sets of regulations of its kind globally, meaning that the National Data Protection Authority can impose fines of up to 20 million euros on those who fail to comply with the GDPR.
What does the GDPR protect?
The GDPR was created solely for the protection of personal data. According to the official definition, any data from which the data subject can be identified or recognised in any way – even indirectly – is considered personal data.
This does not only refer to obvious data such as a name, address or telephone number, but may also include a person’s opinion or comment.
Who needs to comply with the GDPR?
Compliance with the GDPR is mandatory for anyone who has at least one customer, client or employee.
How can you comply with the GDPR?
Although the regulation consists of clear provisions, putting it into practice is extremely difficult. The process itself is complex, so it is no coincidence that comprehensive GDPR packages soon appeared on the market; by purchasing these and activating them on their websites, most organisations can tick this task off their list.
In many cases, however – particularly for businesses handling large volumes of data – this is not sufficient, and as no suitable practical guidance has yet been published, it is particularly difficult to follow appropriate data management practices.
However, if our data processing to date has not encountered any obstacles, then we have probably applied the GDPR correctly; but in future, it is expected that businesses and website owners can expect a great many changes and refinements.
If everyone wishes to comply with these requirements, it is not out of the question that entirely new processes or systems may need to be established within the organisation in order to comply with the data protection policy.
Are there really penalties for breaching the GDPR?
The regulation is in force, so anyone who breaches the GDPR rules will be fined. The amount of the fine may be 4 per cent of the company’s annual turnover or a maximum of 20 million euros.
Furthermore, breaches of the GDPR can often result not only in fines but also in the risk of claims for damages or criminal liability. In the case of minor infringements, of course, it is possible that we may only receive a warning.
However, if we fail to take action even after receiving a warning, the next step will be a fine. To prevent this, both major business partners and customers now expect compliance with the GDPR.
How does the GDPR affect users?
From the user’s perspective, the GDPR can only benefit people, as the data protection regulations were created precisely for their sake.
Most importantly, the GDPR sets out precise provisions regarding personal data. It grants the right to prior information, access, rectification and restriction of data use, whilst also making it much easier for users to hold data controllers to account.