New EU Regulation Protects Consumer Data Privacy

After many years of debate, the European Union has passed a comprehensive set of data privacy rules known as the General Data Protection Regulation (GDPR).  These rules, which go into effect on May 25, apply to any company that collects, stores, or uses the personal data of European residents.  The term “data” is defined broadly, encompassing information ranging from credit card numbers to personal demographics to biometrics.  Under these new rules, companies will have a duty to alert consumers of a data breach within 72 hours of becoming aware of the breach and will be required to tell consumers what information is being collected about them and for what purposes.  Consumers will even be entitled to demand companies provide copies of all personal data saved about them and will have the right to demand that these companies delete that data (i.e. the “right to be forgotten”).

It is estimated that it will cost the Fortune 500 companies $7.8 billion to comply with the GDPR. To do this, many companies will need to appoint Data Protection Officers (DPOs).  While it is unclear how EU member states will specifically enforce the GDPR, these new laws are nevertheless an important development that reflect a greater societal concern about consumer privacy.  Given the recent congressional scrutiny of Facebook for its role in the Cambridge Analytica Scandal, investors in companies dependent on the collection of personal information should pay close attention to the impact of the GDPR.  It is likely American regulation will eventually follow.