The new data protection regulation

The new General Data Protection Regulation comes into force across Europe on 25 May 2018.

It states that every organisation that collects or stores personal data must disclose how it handles that data to the owners of the data – in official language, the data subjects. The penalties threatened are high. The law applies throughout Europe, and we store data of people from the EU. This means we need to take action. It helps that we have long applied as standard some of the practices now required.

Let us say right away – the effort resulting from this regulation is a burden for us. But, as the moderator of a workshop at the Austrian Economic Chamber (WKO) in Vienna put it:

“Take a look at what data protection can do for you.”

He has a point, but the bar for GDPR compliance is set high.

GAIA has always taken data protection seriously.

• For years, all data has been strictly SSL-encrypted, in some cases even with SSL (EV):
  1. on the website and in all the queries and forms embedded there
  2. on our own mail servers, both incoming and outgoing
  3. on our own file storage, our ownCloud
• We maintain our own publicly accessible information page on data protection
• To send out information we use exclusively our own hardware and no external service providers.
• We have lived the principle of data minimalism since our foundation.
• Data owners have direct access to their data and can also change it on their own responsibility.
• We are strict when deleting data and provide detailed information about all associated actions. For example, it is impossible to reactivate a membership account once it has been closed.

Nevertheless, we still have a few things to do by May: drawing up a record of processing activities, revising forms with regard to notices on consent, documentation on how data is handled, etc. Useful advice on implementation can be found, for example, on the WKO portal:

CHECKLIST (German) WKO LEAFLET (German)

There is no way around it. Looking closely is important. Despite limited resources for this topic, we recognise the need for action at GAIA. We recommend that everyone tackles the subject if it is necessary for them. As always, time is running out, and it seems likely that with this General Data Protection Regulation in particular, an elegant system Trojan has once again been slipped in on Europe’s entrepreneurs.