Are U.S. Businesses Affected by GDPR?
In short, YES!
Any US company that has a web presence and markets their products over the web.
Well, that doesn’t quite narrow it down.
The regulation applies if the data controller, or organization that collects data from EU residents, or processor, an organization that processes data on behalf of a data controller, such as a cloud service provider, or the person, or data subject, is based in the EU.
In other words, those who must comply with GDPR in the United States include individuals outside of the EU that work with organizations within the EU, according to Forbes.
Rules for Protection
If your business is required to be compliant, there’s a few rules you need to know.
- Controllers of personal data must put appropriate technical and organizational measures into place in order to implement the data protection principles.
That means that individuals and business owners must create a process that specifically exists to handle the care and protection of their personal data, such as using pseudonyms or data anonymization.
- Individuals must setup highly secured privacy settings by default. That way, the data is not available publicly and can only be accessed with explicit, informed consent.
- No personal data can be processed unless it’s done under a lawful basis specified in the regulation.
And this regulation is so strict that even after the data controller grants permission to the processor to access the data, the processor must declare the purpose of the collection, how long it will be retained and if it’s being shared with third parties outside of the EEA, or European Economic Area.
In some cases, personal data can be processed without the data subject’s permission. According to Article 6, there has to be at least one legal basis to process data without consent. The lawful purposes are:
- If the data subject has given consent to the processing of his or her personal data;
- To fulfill contractual obligations with a data subject, or for tasks at the request of a data subject who is in the process of entering into a contract;
- To comply with a data controller’s legal obligations;
- To protect the vital interests of a data subject or another individual;
- To perform a task in the public interest or in official authority;
- For the legitimate interests of a data controller or a third party, unless these interests are overridden by interests of the data subject or her or his rights according to the Charter of Fundamental Rights (especially in the case of children).