General Data Protection Regulation

Subscribe to General Data Protection Regulation via RSS

By Gail Crawford and Christian McDermott

The recent cyberattack on Tesco Bank’s IT systems has prompted Rt Hon. Andrew Tyrie MP, Chairman of the Treasury Committee, to call on regulators to take action against vulnerable bank IT systems:

“Making sure that banks improve their IT systems, and their resilience to cybercrime, is also a responsibility of regulators. We will raise this issue with them again shortly. We can’t carry on like this.”

The call follows earlier correspondence on this topic between Andrew Tyrie, various major UK banks, the FCA and the PRA.

By Gail Crawford

After over four years of debate, the General Data Protection Regulation (GDPR) recently came into force, taking effect after a two year transition period, i.e. from 25 May 2018. The GDPR introduces a rigorous and far-reaching privacy framework, which will impact many M&A transactions.

The GDPR sets out defined obligations and substantial fines for non-compliance. The new regime will extend the territorial reach of EU data protection law, catching any business that operates in the EU, or offers goods and services to – or monitors the behaviour of – EU data subjects. In the M&A context, a non- EU entity that targets or monitors EU individuals will be subject to the GDPR.

MnAViewsDataProtection imageAug2016The GDPR imposes mandatory data breach notifications and much stronger sanctions for non- compliance. Fines of up to 4% of annual worldwide turnover or €20 million, whichever is higher, can be imposed. This has rightly concerned business – a survey by Ovum in 2015 showed that 94% of IT decision makers are concerned about the GDPR and 52% of respondents thought that the GDPR would result in fines for their company.

By Gail Crawford and Lore Leitner,

Today, after more than four years of debate, the General Data Protection Regulation (GDPR, or the Regulation) enters into force. The GDPR will introduce a rigorous, far-reaching privacy framework for businesses that operate, target customers or monitor individuals in the EU. The Regulation sets out a suite of new obligations and substantial fines for noncompliance. Businesses need to act now to ensure that they are ready for when the Regulation becomes enforceable after …