Privacy and Data Protection: Safeguarding Digital Sovereignty

The GDPR applies to any organization that processes personal data of individuals located in the European Union regardless of where the organization is based, requires a lawful basis for each processing activity, and grants EU data subjects a comprehensive set of rights including the right to erasure, the right to restrict processing, the right to data portability, and the right to object to processing, and imposes maximum administrative fines of up to twenty million euros or four percent of global annual turnover. The CCPA and its successor the CPRA grant California consumers the right to know, delete, and opt out of the sale or sharing of personal information, and companies operating in both markets should build a unified privacy program around the more demanding GDPR requirements.

Data privacy and regulatory compliance counsel can advise on the GDPR and CCPA compliance obligations applicable to the specific business and develop the unified global privacy compliance strategy.

Privacy by Design requires privacy protections to be embedded into the design and architecture of IT systems, business practices, and networked infrastructure proactively and by default rather than added as an afterthought, and it has been codified as a legal requirement under Article 25 of the GDPR, which requires data protection by design and by default. Companies implementing Privacy by Design must limit the personal data they collect to the minimum necessary for the specified purpose, configure their systems to process only the data necessary for each specific processing activity, and document their data protection measures in a manner that demonstrates compliance.

Consumer data protection and data governance accountability counsel can advise on the regulatory framework most applicable to the specific business and develop the multi-framework privacy compliance strategy.

Data privacy and cybersecurity governance counsel can advise on the Privacy by Design requirements, assess the adequacy of the current data minimization practices, and develop the Privacy by Design implementation strategy.

The GDPR requires controllers to notify the applicable supervisory authority of a personal data breach within seventy-two hours of becoming aware of the breach if the breach is likely to result in a risk to the rights and freedoms of natural persons, and to notify affected data subjects without undue delay if the breach is likely to result in a high risk. The CCPA and CPRA require businesses to notify California residents of a breach of their unencrypted personal information within a reasonable time, and most US state data breach notification laws require notification within thirty to ninety days.

Data breach and data breach litigation counsel can advise on the data breach notification obligations applicable to the specific incident and develop the breach response and notification strategy.

Companies defending against data breach class actions must be able to demonstrate that they implemented and maintained reasonable security measures appropriate to the nature and sensitivity of the personal data they processed, that they had an incident response plan in place and followed it when the breach occurred, and that they took prompt and reasonable steps to contain the breach. The evidentiary record includes contemporaneous logs of security events, documentation of the security assessments and penetration testing the company conducted before the breach, and records of the employee security training program.

Data privacy class action and cybersecurity class action counsel can advise on the evidentiary record required to defend against data breach class actions and develop the data breach litigation defense strategy.

The GDPR prohibits the transfer of personal data from the EU to a third country unless the European Commission has issued an adequacy decision or the transferring organization has implemented appropriate safeguards, including standard contractual clauses, binding corporate rules, or other recognized transfer mechanisms. Companies that transfer personal data from the EU to the United States can rely on the EU-US Data Privacy Framework if the US receiving organization has self-certified under the framework, and the standard contractual clauses remain available as a transfer mechanism.

Cross-border data protection and cross-border data breach counsel can advise on the legal mechanisms available for the specific cross-border data transfer and develop the cross-border data transfer compliance strategy.

When personal data is stored in cloud infrastructure operated by US companies, the data may be subject to government access requests under the Foreign Intelligence Surveillance Act and the CLOUD Act, and these legal authorities create a conflict between the company's obligation to comply with government data access requests and its obligation under the GDPR to protect the personal data of EU residents. Companies managing this conflict should implement encryption and other technical measures that limit the government's ability to access personal data in an intelligible form and develop a policy for evaluating and challenging government access requests.

Cloud computing and data security counsel can advise on the data sovereignty and government access issues applicable to the specific cloud architecture and develop the cloud data governance and sovereignty strategy.