From May 2018, the General Data Protection Regulation 2016/679 (GDPR) replaces the Data Protection Directive 95/46/EC, representing a significant overhaul of data protection law in the European Union. Applicable to all EU Member States, the GDPR’s relevance spans not only organisations operating within the EU, but also those operating outside the EU. This commentary, published in association with German Law Publishers, provides a detailed look at the individual articles of the GDPR and is an essential resource aimed at helping legal practitioners prepare for compliance. Content includes: •full text of the GDPR’s articles and recitals; •article-by-article commentary explaining the individual provisions and elements of each article; •a general introduction to data protection law with a focus on issues such as: • how to adapt a compliance management program •whether or not to appoint a data protection officer •‘privacy by design’ and ‘privacy by default’ • the consequences of non-compliance with the GDPR •data portability • the need for data protection impact assessments •a detailed index. In addition to lawyers and in-house counsel, this book is also suitable for law professors and students, and offers comprehensive coverage of this increasingly important area of data protection legislation.

Fragmento. � Reproducci�n autorizada. Todos los derechos reservados.

The EU General Data Protection Regulation (GDPR): A Commentary

By Lukas Feiler, Nikolaus Forg�, Michaela Weigl

Globe Law and Business Ltd

List of abbreviations, 9, 
List of Recitals of the General Data Protection Regulation, 11, 
Introduction to the General Data Protection Regulation, 13, 
Text of the General Data Protection Regulation and commentary, 41, 
Chapter I - General provisions, 43, 
Chapter II - Principles, 73, 
Chapter III - Rights of the data subject, 101, 
Section 1 - Transparency and modalities, 101, 
Section 2 - Information and access to personal data, 105, 
Section 3 - Rectification and erasure, 118, 
Section 4 - Right to object and automated individual decision-making, 131, 
Section 5 - Restrictions, 138, 
Chapter IV - Controller and processor, 141, 
Section 1 General obligations, 141, 
Section 2 - Security of personal data, 159, 
Section 3 - Data protection impact assessment and prior consultation, 169, 
Section 4 - Data protection officer, 181, 
Section 5 - Codes of conduct and certification, 192, 
Chapter V - Transfers of personal data to third countries or international organisations, 203, 
Chapter VI - Independent supervisory authorities, 225, 
Section 1 - Independent status, 225, 
Section 2 - Competence, tasks and powers, 232, 
Chapter VII - Cooperation and consistency, 249, 
Section 1 - Cooperation, 249, 
Section 2 - Consistency, 256, 
Section 3 - European data protection board, 267, 
Chapter VIII - Remedies, liability and penalties, 279, 
Chapter X - Delegated acts and implementing acts, 313, 
Chapter XI - Final provisions, 319, 
Keyword index, 327, 
About the authors, 333,

CHAPTER 1

Introduction to the General Data Protection Regulation

1. Introduction

The General Data Protection Regulation (GDPR) is one of the most ambitious legal projects of the European Union in the last years. From 25 May 2018 the GDPR will replace the Data Protection Directive and the data protection laws in 28 Member States will become obsolete to a large extent. Only those companies that start adapting their contracts, business processes and IT solutions pursuant to the GDPR in a timely manner will achieve a prudent level of compliance when the GDPR applies from 25 May 2018.

Not only the high fines of up to EUR 20 million or 4% of the total worldwide annual turnover illustrate that companies must take the GDPR seriously. Data protection has become one of the largest compliance risk areas and therefore necessarily a priority for the management of every company.

The below introduction allows the reader to quickly get an overview of the GDPR or certain parts of the GDPR. For certain details, the introduction refers to specific articles of the GDPR or specific comments of articles of the GDPR in the commentary section of this book.

2. The most important compliance steps to be implemented before the GDPR applies from 25 May 2018

The GDPR will apply from 25 May 2018 (Art. 99 para. 2). To achieve minimum compliance with the GDPR by then, controllers and processors must begin with compliance steps sooner rather than later.

For controllers the most important compliance steps to be implemented by 25 May 2018 can be summarised as follows:

1) implementation of a basic data protection compliance programme (see chapter 11 below) including the appointment of a data protection officer, to the extent reasonable or required in the particular case (see chapter 14 below);

2) preparation of a record of processing activities (see chapter 12 below);

3) review of the legal basis of the respective data processing operation (see chapter 7 below), in particular the new requirements regarding valid consent (see chapter 7.2 below);

4) development of GDPR compliant privacy notices (see chapter 8 below); and

5) review of the legal basis for international data transfers (see chapter 18 below).

For processors the most important compliance steps to be implemented by 25 May 2018 can be summarised as follows:

1) appointment of a data protection officer to the extent required or reasonable in the particular case (see chapter 14 below);

2) preparation of records of processing activities (see chapter 12 below);

3) implementation of appropriate security measures (see chapter 15.1);

4) ensuring that subprocessors are engaged only with prior specific or general written authorisation of the controller (Art. 28 para. 2); and

5) assurance that international data transfers take place only if compliant with the requirements of the GDPR (see chapter 18 below).

The above-mentioned measures will not produce full compliance with the GDPR but they help to focus the personnel and financial resources of a controller or processor on central compliance aspects.

For larger organisations it will also be required to assess generally in advance the regulatory risks resulting from the GDPR to allow for an efficient deployment of resources.

3. Basic terms of the GDPR

The GDPR exclusively applies to personal data (see chapter 4.1 below). Personal data are defined as any information relating to an identified or identifiable natural person, who is referred to as the data subject (Art. 4 No. 1).

A subset of personal data is sensitive data (also 'special categories of personal data'). Sensitive data are defined in Art. 9 para. 1 as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, data concerning a natural person's sex life or sexual orientation, data concerning health within the meaning of Art. 4 No. 15, genetic data within the meaning of Art. 4 No. 13 and biometric data (eg, fingerprints or facial images) if processed for the purpose of uniquely identifying a natural person (Art. 9 cmt. 3). Furthermore, social security numbers might be regarded as sensitive data (cf. Art. 4 cmt. 35).

The GPDR applies to controllers and processors (cf. Art. 3 cmt. 4). The GDPR defines the term controller as the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data (Art. 4 No. 7).

Processor means a natural or legal person which processes personal data on behalf of the controller, that is, that it does not determine the purposes and means of the processing of personal data (Art. 4 No. 8). For example, if a company outsources the operation of its customer database to an IT service provider, the company still acts as a controller, whereas the IT service provider acts as a processor.

Processing is defined broadly as any operation which is performed on personal data such as the collection, recording, structuring, alteration, retrieval, use, disclosure by transmission, erasure or destruction (Art. 4 No. 2).

The term transfer is used quite frequently throughout the GDPR. However, it is not defined. Transfer includes the disclosure vis-�-vis another controller or processor, respectively a subprocessor (see Art. 44 cmt. 1).

The term supervisory authority means the data protection authority respectively established by each Member State.

4. The scope of the GDPR

The following provides an outline concerning: (i) the processing activities that are covered by the GDPR (see chapter 4.1 below), (ii) those to whom the GDPR applies (see chapter 4.2 below), and (iii) where the GDPR applies (see chapter 4.3 below).

4.1 Material scope – what processing activities are covered?

The GDPR generally applies to any processing of personal data. As set out above under chapter 3, personal data means any information relating to an identified oridentifiable natural person. Whether a natural person is identifiable must be assessed objectively, not only taking into consideration the legal and factual possibilities of the controller, but also the possibilities of third parties (Art. 4 cmt. 3). For example, the IP address of a user constitutes personal data for the operator of a website, even if the operator of the website cannot identify the person but only the Internet access provider can identify the user (see decision of the CJEU, C-582/14 – Breye/Germany regarding the interpretation under the Data Protection Directive; see also the statement of the advocate general).

If data relate to legal persons, they only constitute personal data pursuant to the GDPR if the name of the legal person contains the name of a natural person (Art. 4 cmt. 1). Moreover, data that relate to deceased persons do not constitute personal data within the meaning of the GDPR (Art. 4 cmt. 2).

The GDPR basically only applies to data processed by automatic means. For data that is processed manually (generally on paper) the GDPR applies only if the personal data form part of a filing system or if they are intended to form part of a filing system (Art. 2 para. 1). 'Filing system' means any structured set of personal data which are accessible according to specific criteria (Art. 4 No. 6) such as HR files organised pursuant to names. Individual paper-based files are not subject to the GDPR (Art. 2 cmt. 4).

As an act of law of the Union, the GDPR does not apply to matters which fall outside the scope of Union law (eg, national security; see Art. 2 para. 2 lit. a). Furthermore, the GDPR does not apply to common foreign and security policy (Art. 2 para. 2 lit. d) or to the areas of the prevention, investigation, detection or prosecution of criminal offences and the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security (Art. 2 para. 2 lit. d; in these areas, Directive (EU) 2016/680 applies which will have to be implemented separately into national laws).

Furthermore, the GDPR does not apply to the processing of personal data by natural persons in the course of a purely personal or household activity ('householdexemption'; Art. 2 para. 2 lit. c). This covers in particular the use of social networks for private purposes (Art. 2 cmt. 7).

4.2 Personal scope – who does the GDPR apply to?

The GDPR applies to controllers and processors (see chapter 3 above regarding the definition of these terms).

Under the Data Protection Directive the role of the processor was advantageous because the processor was subject to only a few regulatory obligations. The commercial disadvantage was – and still is – the obligation to not use personal data for one's own purposes and to not commercially exploit them. If a company wants to use personal data for its own purposes and wants to commercially exploit the data (ie, is aiming for 'data ownership'), the company has to be qualified as a controller which results in substantial additional obligations.

This has been changed by the GDPR because the GDPR applies to processors as it does to controllers and therefore makes processors subject to substantial regulatory obligations (see chapter 2 above) and subject to the same administrative fines (see chapter 20 below). Due to the alignment of obligations of controllers and processors, the commercial advantages of being a controller will become more attractive. Many companies that have so far limited themselves to being a processor, will likely try to move into a controller role. This would not only result in the applicability of regulatory obligations regarding the legal basis of the data processing such as consent of the data subject (see chapter 7 below) and transparency requirements (see chapter 8 below), but also in the requirement to revise existing contracts with customers, vendors and data subjects to reflect the new regulatory reality.

4.3 Territorial scope – where does the GDPR apply?

The GDPR applies to controllers and processors that are established in the EU or theEEA (see Art. 3 cmt. 5). Processors in the EU are subject to the GDPR even if they process data for controllers that are not subject to the GDPR (Art. 3 cmt. 4).

Furthermore, the GDPR applies if the controller, respectively the processor, is not established in the EU or the EEA, but has an establishment (eg, an affiliate) in the EU or in the EEA and the processing of personal data takes place in the context of theactivities of this establishment. This applies, for example, if the US parent company processes personal data of customers of a German or Austrian affiliate to support the sales activities of that affiliate (see Art. 3 cmt. 2).

To ensure that companies that do not have an establishment in the EU/EEA but are active in the European market are subject to the same conditions of competition as European companies, the GDPR also applies to controllers and processors that are not established in the Union if they are offering their goods or services, irrespective of whether a payment is required, in the Union, respectively the EEA (Art. 3 para. 2 lit. b).

Furthermore, the GDPR applies to controllers and processors that are not established in the Union, but monitor the behaviour of data subjects in the Union (Art. 3 para. 2 lit. b). This applies in particular to online advertising networks which log the web browsing activities of Internet users to deliver personal online advertisement.

5. The relationship with national data protection laws

Like any EU regulation, the GDPR in general applies directly and may not be implemented by national law. The previously existing national data protection laws will therefore be largely superseded by the GDPR as of 25 May 2018.

Outside the scope of the GDPR (see chapter 4 above) national legislatures may enact additional data protection provisions. For example, this applies to data protection laws regarding legal persons where it remains to be seen whether Member States will make use of this possibility. In any case, taking into account the protection under the national laws transposing the Trade Secrets Directive (2016/943/EU), a blanket regulation of personal data relating to legal persons does not seem warranted.

Notwithstanding the above, there are numerous topics within the scope of the GDPR for which the GDPR does not (or not comprehensively) provide an answer but expressly authorises Member States through opening clauses to enact national laws.

The GDPR therefore allows for deviations among Member States. This applies in particular to the following topics (cf. Art. 92 cmt. 4):

1) How old must a minor be to validly consent to the processing of his/her personal data? (Art. 8 para. 1 subpara. 2)

2) When is it not possible to validly consent to the processing of sensitive data? (Art. 9 para. 2 lit. a)

3) Is the processing of genetic data, biometric data or health data subject to additional limitations? (Art. 9 para. 5)

4) Is it permitted at all to process personal data on criminal convictions and offences? (eg, in connection with a whistleblower hotline; Art. 10)

5) Are automated individual decisions and profiling that are not necessary for the performance of the contract with the data subject permitted without consent of the data subject? (Art. 22 para. 2 lit. b)

6) Are the rights of data subjects subject to additional limitations? (Art. 23)

7) Do all controllers and processors have to appoint a data protection officer or only certain controllers and processors? (Art. 37 para. 4)

8) Is it possible to impose administrative fines on public authorities and bodies? (Art. 83 para. 7)

9) May data protection NGOs claim damages on behalf of data subjects? (Art. 80 para. 1)

10) May data protection NGOs initiate legal proceedings against a controller or a processor without a data subject's mandate? (Art. 80 para. 2)

Additionally, the GDPR grants the Member States a very far-reaching legislative competence for the processing of employees' personal data in the employmentcontext (Art. 88) and allows the Member States to regulate the processing of personal data for journalistic purposes and the purposes of academic, artistic or literary expression (Art. 85) and to find reconciliation between the right to public access to official documents and the right to the protection of personal data (Art. 86).

As a result, the GDPR must always be read together with the respectively applicable national 'GDPR implementation act'. Therefore, the GDPR is also called a 'limping regulation'. It is problematic that the GDPR does not contain any 'conflictof law' provisions. Therefore, it remains unclear when to apply the law of which Member State.

In our opinion, this is an unintended gap which must be solved by analogy to the rules of competence under the GDPR (see chapter 19 above). If there is a lead competence of a certain supervisory authority for a controller or processor pursuant to Art. 56, the 'GDPR implementation act' of such Member State applies (see in detail Art. 92 cmt. 5).

6. The principles relating to the processing of personal data

The GDPR stipulates the following principles that must be complied with whenever personal data is processed (Art. 5 para. 1):

1) Lawfulness (Art. 5 para. 1 lit. a): Personal data must be processed lawfully, that is, a legal basis for the processing is required (see chapter 7 below).

2) Fairness (Art. 5 para. 1 lit. a): Personal data must be processed fairly which is of relevance in particular when conducting a balancing of interests test (see, eg, Art. 6 para. 1 lit. f).

3) Transparency (Art. 5 para. 1 lit. a): Personal data must be processed in a transparent manner in relation to the data subject. This principle is further specified by the information obligations contained in the GDPR (see chapter 8 below).

4) Purpose limitation (Art. 5 para. 1 lit. b): The first element of the purpose limitation principle is that personal data may only be collected if an explicit and legitimate purpose was specified no later than at the time of the collection (principle of purpose specification). This may, for example, be done by documenting the processing purposes in the record of processing activities (see chapter 12 below). Since the processing purposes must be legitimate, other laws (eg, consumer protection law) must indirectly also be taken into consideration in data protection assessments. The second element of the purpose limitation principle requires that collected data may not be further processed in a manner that is incompatible with the purposes originally specified (purpose limitation in a strict sense) unless the data subject consented (Art. 6 cmt. 12). Whether the purposes are compatible must be assessed by applying certain criteria stipulated in Art. 6 para. 4. If the new purpose is compatible with the former (original) purpose, the processing is permitted without the need for a new legal basis (eg, new consent) (cf. Art. 6 cmt. 14). However, data subjects must be informed about the new processing purpose (Art. 13 para. 3 and Art. 14 para. 4).

(Continues...)

Excerpted from The EU General Data Protection Regulation (GDPR): A Commentary by Lukas Feiler, Nikolaus Forg�, Michaela Weigl. Copyright � 2018 Globe Law and Business Ltd. Excerpted by permission of Globe Law and Business Ltd.
All rights reserved. No part of this excerpt may be reproduced or reprinted without permission in writing from the publisher.
Excerpts are provided by Dial-A-Book Inc. solely for the personal use of visitors to this web site.

"Sobre este t�tulo" puede pertenecer a otra edici�n de este libro.

Descripci�n de la librer�a

Ver la p�gina web de la librer�a

Informaci�n empresarial del vendedor

Swan Trading Company
TX, U.S.A.

Condiciones de venta y env�o

Condiciones de venta

We accept all Abebooks supported payment options displayed at checkout. Please contact us if you feel you need to return the book.

Swan Trading Company

Mark and Susan Lyons
2915 Brandy Ln
Georgetown, TX 78628
(512) 497-2398

Derecho a cancelaci�n

Si eres un consumidor puedes cancelar el presente contrato de acuerdo con lo indicado a continuaci�n. Son consumidores las personas f�sicas que act�en con un prop�sito ajeno a su actividad comercial, empresarial, oficio o profesi�n.

Documento de informaci�n al consumidor y usuario sobre el desistimiento

Derecho de desistimiento:

Tienes derecho a desistir del presente contrato en un plazo de 14 d�as naturales sin necesidad de justificaci�n.

El plazo de desistimiento expirar� a los 14 d�as naturales del d�a en que t� o un tercero que hayas indicado, distinto del transportista, adquiera la posesi�n material del �ltimo bien, componente o pieza.

Para ejercer el derecho de desistimiento, deber�s notificarnos a Swan Trading Company, 2111 Simbrah Dr, 78613, Cedar Park, Texas, U.S.A., 1 512-497-2398, de tu decisi�n de desistir del contrato a trav�s de una declaraci�n inequ�voca (por ejemplo, una carta enviada por correo postal, fax o correo electr�nico). Podr�s utilizar el modelo de formulario de desistimiento que figura a continuaci�n, aunque su uso no es obligatorio. Tienes asimismo la opci�n de cumplimentar y enviar electr�nicamente el modelo de formulario de desistimiento o cualquier otra declaraci�n inequ�voca a trav�s de nuestro sitio web a "Mis pedidos" en "Mi cuenta". Si recurres a esta opci�n, te comunicaremos sin demora en un soporte duradero (por ejemplo, por correo electr�nico) la recepci�n de dicho desistimiento.

Para cumplir el plazo de desistimiento, basta con que la comunicaci�n relativa al ejercicio por tu parte de este derecho sea enviada antes de que venza el plazo correspondiente.

Consecuencias del desistimiento:

En caso de desistimiento por tu parte, te devolveremos todos los pagos recibidos de ti, incluidos los gastos de entrega (con la excepci�n de los gastos adicionales resultantes de la elecci�n por tu parte de una modalidad de entrega diferente a la modalidad menos costosa de entrega ordinaria que ofrezcamos) sin ninguna demora indebida y, en todo caso, a m�s tardar 14 d�as naturales a partir de la fecha en la que se nos informes de tu decisi�n de desistir del presente contrato. Procederemos a efectuar dicho reembolso utilizando el mismo medio de pago empleado por ti para la transacci�n inicial, a no ser que hayas dispuesto expresamente lo contrario; en todo caso, no incurrir�s en ning�n gasto como consecuencia del reembolso.

Podremos retenerte el reembolso hasta haber recibido los bienes, o hasta que hayas presentado una prueba de la devoluci�n de los mismos, seg�n qu� condici�n se cumpla primero. Deber�s devolvernos o entregarnos directamente los bienes a Swan Trading Company, P.O. Box 1522, 78630-1522, Cedar Park, Texas, U.S.A., 1 512-497-2398, sin ninguna demora indebida y, en cualquier caso, a m�s tardar en el plazo de 14 d�as naturales a partir de la fecha en que nos comuniques tu decisi�n de desistimiento del contrato. Se considerar� cumplido el plazo si efect�as la devoluci�n de los bienes antes de que haya concluido dicho plazo. Deber�s asumir el coste directo de devoluci�n de los bienes. Solo ser�s responsable de la disminuci�n de valor de los bienes resultante de una manipulaci�n distinta a la necesaria para establecer la naturaleza, las caracter�sticas y el funcionamiento de los bienes.

Excepciones al derecho de desistimiento:

La entrega de peri�dicos, publicaciones especializadas o revistas con la excepci�n de contratos de suscripci�n; y
La entrega de contenido digital (incluyendo apps, software digital e-books, MP3, etc.) que no hubiera sido entregado en un medio tangible (por ejemplo: CD o DVD), si al realizar tu pedido has aceptado que podemos proceder al env�o del producto y que no resulta posible su cancelaci�n una vez comienza la entrega.

Modelo de formulario de desistimiento

(S�lo debe cumplimentar y enviar el presente formulario si desea desistir del contrato)

A la atenci�n de: (Swan Trading Company, 2111 Simbrah Dr, 78613, Cedar Park, Texas, U.S.A., 1 512-497-2398)

Por la presente le comunico/comunicamos* que desisto de mi/desistimos de nuestro* contrato de venta del siguiente bien/prestaci�n del siguiente servicio*

Pedido el/recibido el*:

Nombre del consumidor y usuario o de los consumidores y usuarios:

Domicilio del consumidor y usuario o de los consumidores y usuarios:

Firma del consumidor y usuario o de los consumidores y usuarios (solo si el presente formulario se presenta en papel):

Fecha:

* Eliminar en su caso

Condiciones de env�o

We normally ship in one to two business days. If your book order is heavy or oversized, we may contact you to let you know extra shipping is required. We ship US Media Mail, Priority Mail, First Class International, and Priority Mail International.

Tarifas de env�o en Estados Unidos de America

Tarifas de env�o en Estados Unidos de America
Cantidad del pedido	De 5 a 14 d�as h�biles	De 3 a 6 d�as h�biles
Primer art�culo	EUR 0.00	EUR 7.11

Los plazos de entrega los establecen los vendedores y var�an seg�n el transportista y la ubicaci�n. Los pedidos que pasan por la aduana pueden sufrir retrasos y los compradores son responsables de los aranceles o tarifas asociadas. Los vendedores pueden ponerse en contacto con usted en relaci�n con cargos adicionales para cubrir cualquier aumento en los costes de env�o de los art�culos.