General Data Protection Regulation

If you are processing personal data in the context of an organization established in the EU, the GDPR applies to you, regardless of whether you are processing personal data in the EU or not. “Processing” means any operation performed on personal data, such as collection, storage, transfer, dissemination, or erasure. If you are not established in the EU, the GDPR applies to you if you are offering goods or services (whether paid or free) to EU data subjects or monitoring the behavior of EU data subjects within the EU. Monitoring can be anything from putting cookies on a website to tracking the browsing behavior of data subjects to high-tech surveillance activities. Under European data protection laws, organizations processing personal data are divided into “Controllers”, or the entities which control the personal data, and “Processors”, the entities that process personal data only on the instructions of the Controllers. The GDPR applies to both Controllers and Processors.

The GDPR changed former EU data protection laws in several ways: 

1. Expanded definition of “personal data”: The GDPR expands and clarifies the concept of personal data. While the basic concept of personal data largely remains the same, the GDPR makes it clear that location data and online identifiers, such as IP addresses, are considered personal data. The GDPR also expands the concept of “sensitive personal data,” which is more highly regulated, to include genetic data and biometric data. 
2. Expanded and new rights for EU individuals: The GDPR provides expanded rights for EU data subjects such as: 

• Deletion: This right is sometimes referred to as the “right to be forgotten.” The data subject has the right to require that the Controller erase personal data about him or her in certain conditions, including if the personal data is no longer necessary for the original purpose of the processing or if the data subject withdraws consent for the processing. 
• Restriction: Under the GDPR, a data subject has the right to obtain from a Controller a restriction on the processing of personal data in certain circumstances, including if the data subject contests the accuracy of the personal data. A restriction on processing means that the data may be stored but cannot be further processed. 
• Portability of personal data: Data subjects also now have the right, in certain circumstances, to receive the personal data that they have provided to a Controller in a structured, commonly used and machine-readable format. ConnectWise’s data processing addendum reflects these expanded and new rights. 

3. Security measures: The GDPR requires Controllers and Processors to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks presented. At ConnectWise, we have robust security measures in place. We have our security certification from the American Institute of CPAs’ (AICPA) System and Organization Controls (SOC) report covering the trust service criteria of security, confidentiality, and privacy. 
4. Breach notification: The GDPR requires organizations to report certain personal data breaches to the relevant supervisory authority, and in some circumstances, to the affected data subjects. Controllers must notify the relevant supervisory authority “without undue delay” (and where feasible, within 72 hours of having become aware of it), unless the breach is not likely to present any risk to the rights and freedoms of the data subjects concerned. If circumstances require it, Controllers may also be required to communicate the data breach to data subjects. Processors, for their part, are required to notify Controllers “without undue delay” after becoming aware of a personal data breach. ConnectWise’s data processing addendum reflects this new obligation. 
5. Data Protection Impact Assessments (DPIA): Where certain processing is likely to be classified as “high risk” to data subjects, the Controller may be required to carry out a data protection impact assessment identifying the impact of the proposed processing operations on the personal data. ConnectWise’s data processing addendum reflects this obligation. 
6. International transfers: European data protection laws restrict the transfer of personal data outside the EU unless there are appropriate safeguards in place to protect that data. The GDPR continues to recognize current mechanisms (e.g., EU standard contractual clauses, EU Commission adequacy decisions, etc.) for legally transferring personal data outside of the EU. 
7. Consent: Consent is subject to additional requirements under the GDPR. The GDPR defines consent as “any freely given, specific, informed, and unambiguous indication of a data subject’s wishes through a statement or clear affirmative action.” The concept of consent is used throughout the GDPR as a means to legitimize certain processing activities from a legal perspective. 
8. Transparency: The GDPR requires that Controllers provide data subjects with information about their processing operations at the time when personal data is collected. This information includes the identity and contact details of the Controller, the contact details of the data protection officer (if relevant), the purposes and the legal bases for the processing of the personal data, the recipients of the data, and a number of other fields to ensure that the personal data is being processed in a fair and transparent manner. In addition, Controllers are required to provide information to data subjects even in circumstances where the personal data has not been obtained directly from the data subject. 
9. Profiling: The GDPR introduces the concept of “profiling” or any form of automated processing that uses personal data to evaluate personal aspects and in particular to analyze or predict aspects relating to an individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. Data subjects must be informed of the existence of profiling and any consequences of the profiling. 
10. Enforcement: Fines for non-compliance under the GDPR can be substantial. Supervisory authorities have a number of enforcement powers under the GDPR, including the ability to fine organizations up to €20 million or 4% of annual global turnover, whichever is higher. These are maximum fines, and it remains to be seen how supervisory authorities will use these enforcement powers.

The GDPR does not require information to be stored in Europe. However, transfers of European personal data outside the European Economic Area (EEA) generally, require that a valid transfer mechanism be in place to protect the data once it leaves the EEA (Articles 44-50). The CJEU has recently confirmed the validity of the European Commission’s standard contractual clauses as a legal mechanism for the transfer of EU personal data but invalidated the EU-US Privacy Shield framework. ConnectWise’s customers can use our services, relying on the European Commission’s standard contractual clauses which are already included in our Data Processing Addendum.

The GDPR requires organizations to take technical and organizational security measures which are appropriate to the risks presented. Article 32 of the GDPR includes encryption as an example of an appropriate technical measure, depending on the nature and risks of your processing activities. In other words, encryption at rest and pseudonymization may be appropriate depending on the circumstances, but they are not mandated in every instance.

The right to have one’s data deleted is often referred to as “the right to be forgotten.” However, the right to be forgotten is not an absolute right. It has a limited scope and is subject to certain limitations. In most cases, when considering a request for deletion several relevant factors should be taken into account; this right will not apply, for example, if the processing is necessary for compliance with a legal obligation.

Fact: A data protection officer is required by the GDPR only when one of the following applies:

• the organization is a government institution
• the organization processes certain sensitive types of data (such as data on health or religion) on a large scale as part of its core activities; or
• the organization systematically monitors people (for example, via cameras, or software which tracks internet behavior) as part of its core activities.

Fact: A Data Protection Impact Assessment (DPIA) is a process to help you identify and minimize the data protection risks of a project. Under the GDPR, a DPIA is necessary only for processing that is likely to result in a high risk to individuals, such as the following:

• large-scale processing of certain sensitive types of EU personal data, such as data concerning a person’s health
• systematic and extensive automated decision-making which produces legal or similarly significant effects on individuals, such as the use of fraud detection software; or
• systematic and large-scale monitoring of public space (for example, with cameras).

Fact: Profiling of EU individuals and automated decision-making involving EU personal data are not prohibited, but these processing activities may be subject to certain conditions. In particular, when decisions which legally or similarly significantly affect an individual are made automatically, the data subject:

• must be given meaningful information about the underlying logic, and about the significance and potential consequences for them; and
• must in some cases have the ability to require that a human being is involved in the process.

A DPIA may also be required.

Fact: Regardless of where an organization is established, the GDPR applies to EU personal data which is processed in the context of:

• offering goods and services (whether paid or not) to people in the EU; or
• monitoring the behavior of people in the EU, for example by placing cookies on the devices of EU individuals (Article 3(2)).