Crew project

General Data Protection Regulation (GDPR) is a privacy and security law concerning the protection of personal data. Personal data are considered to be any information that can, directly or indirectly, lead to the identification of an individual (Goddard, 2017, p. 703). Personal data include information regarding the location, ethnicity, gender, biometric data, religious beliefs or web cookies. Pseudonymous data can also be included in personal data’s context, if it is easy to reveal an individual’s identity. GDPR was carried out and passed by the European Union (EU), however it imposes obligations onto organizations worldwide as long as they interact and collect data related to citizens in the EU (Wolford, 2019). In this way all EU residents are protected from the location of data processing.

Brief historical look 

Penalties 

In case GDPR is violated, then fines are really high. There are two kinds of penalties. The first one is a fine of about 20 million euros or 4% of the global revenue, and the second is that people, whose data weren’t protected, have the right to ask for compensation (Wolford, 2019).  

Principles of data protection (Wolford, 2019).

Processing of personal data should be carried out according to seven core principles:

1. Transparency – Lawfulness – Fairness.
2. Purpose limitation: Data should only be used for the purposes the subject has been informed about. 
3. Data minimization: You should collect only the data that is totally necessary for your purpose.
4. Accuracy: Data must be kept accurate and up to date.
5. Storage limitation: You can save the data for as long as your purpose requires.
6. Integrity and confidentiality: Processing of data must be conducted in such a way, to ensure protection and confidentiality.
7. Accountability: The person processing the data is in charge of demonstrating GDPR compliance with all the aforementioned principles.

Consent

It is mandatory that the data subjects give their consent, in order to allow the process of their data. But what does consent constitute?

1. Consent should be freely given, be specific and unequivocal.
2. Requests for consent should be clear, distinguishable and presented in simple words. 
3. Data subjects have the right to retract their consent any time they feel like.
4. When it comes to children under age 13, parents’ permission is compulsory.
5. Documentary evidence of consent needs to be saved.

Privacy rights

The individual, who agrees to reveal personal data, also has privacy rights. They are listed below (Wolford, 2019):

1. The right to be informed
2. The right of access
3. The right to correction
4. The right to deletion
5. The right to limit processing
6. The right to data portability
7. The right to express objections
8. Rights in relation to automated decision making and profiling.

An example of how access to personal data is asked through the internet

The California Consumer Privacy Act (CCPA) reinforces privacy rights and consumer protections for California residents. It’s a California state law that was actually voted in June 2018 but didn’t go into effect until January 1^st, 2020 (Cooman, 2020). According to CCPA personal data are considered to be any information that may lead to an individual’s identification (such as name, address, email, passport number, social security number etc), commercial information (such as products purchased), electronic network activities, audio or visual data and conclusions drawn from any of the aforementioned information to create a profile about a consumer reflecting his preferences.

Objectives of CCPA

1. Own your personal data
2. Control your personal data
3. Protect your personal data
4. Hold big companies liable

CCPA’s basic elements

 
Main differences between GDPR and CCPA

Although GDPR and CCPA share common points, they are not interchangeable. Their key differences relate to the territorial scope and application of the law, to penalties – in case of violation – to nature and collection limitations and to the fact that GDPR requires lawful basis for all processing of personal data (A., 2021). The aforementioned are indicated in the following picture (A., 2021).