Talk:General Data Protection Regulation/Archives/2021

Granting of the Royal Assent (UK)

The article currently has : "The United Kingdom granted royal assent to ...".

The United Kingdom does not do that. Royal Assent is granted by the Reigning Monarch (except when some form of proxy or deputy, such as I suppose the Prince Regent [1811-1820], has of necessity been formally appointed). 94.30.84.71 (talk) 17:10, 6 January 2021 (UTC)

Summary needs work

The current summary (shown below) does not seem appropriate.

"The proposed new EU data protection regime extends the scope of the EU data protection law to all foreign companies processing data of EU residents. It provides for a harmonization of the data protection regulations throughout the EU, thereby making it easier for non-European companies to comply with these regulations; however, this comes at the cost of a strict data protection compliance regime with severe penalties of up to 4% of worldwide turnover."

While it may seem like a general description of the regulation it is in fact a description from 2012 which was referenced in this article. Please update the summary to reflect the regulation as it was passed. — Preceding unsigned comment added by 149.161.197.247 (talk) 16:21, 23 October 2017 (UTC)

Note that the regulation does not discuss residence in the EU at all. While processors and data controllers have interpreted the regulation as being limited to those residing in the EU, it is not apparent that it excludes EU citizens residing abroad. 65.198.98.16 (talk) 16:42, 28 April 2021 (UTC)Arch

Right to Rectification

The entire section of law relating to right of rectification is missing from the article.

UK Legislation mentioned in summary

I am removing the following text, which is not appropriate to the summary section of an article on the EU GDPR (Even if it might make sense in a section on effects of Brexit on the GDPR, or in an article on English, Scottish or Northern Irish Data Protection law, it's not particularly relevant to the GDPR itself).

The UK Data Protection Bill will update data protection laws for the digital age and was introduced to the House of Lords on 13 September 2017. Until then the UK will be subject to the GDPR. The Data Protection Bill is primarily based on the GDPR.

Also, it's not true - at least not as currently written (I believe intermediate edits have mangled the sense somewhat). The UK will presumably be subject to the GDPR, along with the rest of EU law, until 2 years after the UK's Article 50 notice to leave the EU (possibly longer depending on the nature of any regulatory equivalence which may be negotiated). - Paul (talk) 17:10, 8 December 2017 (UTC)

'Personally Identifiable Information (PII)' vs. 'Personal data'

In the summary ...

[...] the regulation contains provisions and requirements pertaining to the processing of personally identifiable information (personal data) of individuals (formally called data subjects in the GDPR) inside the European Union[...]

To some, "personally identifiable information" (PII) will have a specific meaning, particularly with regard to the US legal definition. Reading the personally identifiable information page itself makes this distinction a bit clearer. The GDPR definition of "personal data" is broader in scope than that of PII.

While the term is sometimes used ubiquitously to refer to a broad range of personal information (granted that a search on Wiki for "personal data" will redirect to the PII page) I think in this context it is better sense to refer solely to "personal data", here in the summary and anywhere else on the page — in particular because the scope of the GDPR does have an impact on firms in the US who might have EU customers. Views?

+1, and very much so. The PII page itself states multiple times that "personal data" is (substantially) wider than PII; hence, the two cannot and should never be used as meaning the same thing. --User:Haraldmmueller 10:34, 11 September 2018 (UTC)

Very true, Haraldmmueller. ♫ RichardWeiss talk contribs 12:23, 11 September 2018 (UTC)

Ok, I have made that change. Different.joy (talk) 11:04, 12 September 2018 (UTC)

Principles section should Cover Article 5 more than Article 6

When the EU describes the GDPR (https://gdpr.eu/what-is-gdpr/), they list seven principles that form the basis:

Data protection principles. 
If you process data, you have to do so according to seven protection and accountability principles outlined in Article 5.1-2:

Lawfulness, fairness and transparency — Processing must be lawful, fair, and transparent to the data subject.
Purpose limitation — You must process data for the legitimate purposes specified explicitly to the data subject when you collected it.
Data minimization — You should collect and process only as much data as absolutely necessary for the purposes specified.
Accuracy — You must keep personal data accurate and up to date.
Storage limitation — You may only store personally identifying data for as long as necessary for the specified purpose.
Integrity and confidentiality — Processing must be done in such a way as to ensure appropriate security, integrity, and confidentiality (e.g. by using encryption).
Accountability — The data controller is responsible for being able to demonstrate GDPR compliance with all of these principles.

The current section on "principles" pulls from Article 6, which is framed by the EU as being about "Lawfulness of processing". I think the prinicples section should cover Article 5, and don't know how important it is to cover Article 6. ★NealMcB★ (talk) 21:29, 29 September 2021 (UTC)

Regulation "Chatcontrol"

In July 2021 the Eu Parliament approved Chatcontrol, a regulation that allowed for the following three years Internet Service Providers to scan extensively the e-mail of their private users in order to prevent child abuses. They don't need of any specific authorization. The regulation derogates GDPR (sources: [1], [2]). — Preceding unsigned comment added by 151.82.218.171 (talk) 15:13, 8 October 2021 (UTC)