publications full of ideas

Some Final Thoughts as GDPR Takes Effect on May 25


Given recent headlines, ranging from Facebook to Cambridge Analytica to the City of Atlanta’s ransomware attack, the logical inference is that the European Union’s General Data Protection Regulation (GDPR) is a product of our current privacy-conscious environment. In fact, it was conceived as a long overdue update to the EU’s 1995 data protection directive and has been years in the making.

As GDPR appeared on the horizon, we had occasion to work with a number of clients on related issues. Certain themes emerged as frequent points of concern. Now that we are closing in on GDPR’s effective date, we have collected our thoughts on those points:

  • By far the most frequent question we address is whether the GDPR applies to a particular client with no physical presence in Europe. That is, of course, the million euro question. GDPR’s text and working papers do not establish bright line rules. However, reading Article 3 together with Recital 23 provides some guidance: the GDPR applies if the client’s data processing activities are connected to the offering of goods and services to EU individuals. To some extent, this connection, like beauty, is in the eye of the beholder. Nevertheless, some general extrapolation is possible. At one end, mere incidental sales—e.g., an EU citizen registers to attend a single professional training session in North Carolina—would not implicate the GDPR. At the other end, activities tailored to EU residents—e.g., websites translated into European languages and/or offering products priced in euros—would almost certainly trigger the GDPR. Unfortunately, the scope and reach of GDPR will likely become known with precision only when enforcement begins.
  • The most cautious practitioners suggest that handling any EU personal data brings the organization within the ambit of the GDPR. Our reading of the statutory text and Working Party papers does not support this reading. There is clearly some de minimis standard, e.g., if a North Carolina meal is paid with a European credit card, then that would technically constitute data processing, but it would not implicate the privacy concerns that underpin GDPR. However, discerning where the EU draws the line will require some time and experience.
  • The GDPR does not apply to all EU data. It is limited to personal data. “Personal data” is defined broadly. It encompasses standard data points such as name, address, telephone number, and contact information. There is an additional category of especially sensitive personal data that is considered even more sacrosanct, such as data regarding individuals’ political or religious beliefs, sexual orientation, medical records and the like.
  • Contrary to popular belief, data processing under GDPR does not necessarily entail consumer consent. Additional legal grounds, such as public necessity, are available. However, most businesses will rely on consumer consent. Consent must be clear, specific and unambiguous. In other words, obtaining “consent” via click-through following several paragraphs of dense legal jargon will no longer suffice. Businesses should consider the legal justification for their EU data processing activities.
  • GDPR is not universal. Critics had assailed the GDPR as an effort to foist European privacy requirements on the rest of the world. While a business may find it easier to comply with a single privacy regime for all of its global business, GDPR does not impose such a requirement. A number of businesses, with Facebook being perhaps the highest profile example, have elected to comply with GDPR for their EU clientele, while adhering to their original privacy policies for the rest of the world.
  • The GDPR explicitly provides that the legal processes of a third country—e.g., a United States subpoena—is not a sufficient basis for the transfer of EU residents’ personal data to a third country. On the other hand, the recently enacted CLOUD Act specifically requires that such data be turned over to American law enforcement in certain circumstances. The potential for conflict between these two regulatory regimes (and others like the CLOUD Act) remains real.
  • The GDPR requires the appointment of a Data Protection Officer if the business engages in certain types of data processing, such as processing highly sensitive data. The Data Protection Officer is envisioned as an in-house privacy ombudsman whose role encompasses defense of privacy rights. The position should enjoy a high degree of autonomy within the company hierarchy, including job security.
  • At the Global Privacy Summit 2018, EU officials were clear that enforcement will begin on May 25, 2018, with no grace period.
  • The focus of enforcement is the protection of data privacy, not the imposition of the GDPR’s highly publicized mammoth fines. Fines will be a function of the egregiousness of conduct and the businesses’ track record. Persistent violators will be prohibited from processing EU data.
  • If there is one principle that underpins the GDPR, it is the notion that data belongs to the individual (or, in GDPR parlance, the “data subject”). The GDPR protects certain rights for all data subjects. These include (1) the right to access any personal data the business stores on the subject, (2) the right to revoke consent to data processing, (the famed “Right to be Forgotten”), and (3) if technically feasible, the right to obtain a copy of the subject’s own personal data in a format that could be used by a different service provider (the right to data portability).

The GDPR has been years in the making. The statutory text alone comprises over 100 pages of dense, technical requirements. The text is supplemented by guidance and Working Party papers. The full impact of GDPR implementation will only be evident in hindsight. Until then, U.S.-based organizations should have a firm grasp on (1) what EU personal data they collect; (2) how they protect that data; (3) the GDPR-compliant legal basis of that collection; and (4) the documentation of their compliance with Privacy-by-Design principles. Because despite all the current murkiness about the GDPR, this much is clear: We are going to be hearing a lot more about it in the years to come.

Saad Gul and Mike Slipsky, editors of NC Privacy Law Blog, are partners with Poyner Spruill LLP. They advise clients on a wide range of privacy, data security, and cyber liability issues, including risk management plans, regulatory compliance, cloud computing implications, and breach obligations. Saad (@NC_Cyberlaw) may be reached at 919.783.1170 or Mike may be reached at 919.783.2851 or

Physical Address: 301 Fayetteville Street, Suite 1900, Raleigh, NC 27601 | © Poyner Spruill LLP. All rights reserved.

related information

what's new at the firm

Poyner Spruill names new partner, welcomes three new attorneys to strengthen North Carolina practice


RALEIGH, N.C. — Poyner Spruill LLP, a commercial law firm with offices across North Carolina, is pleased to announce the firm has named Emily Meeker a partner of the firm while also welcoming three new attorneys, one of whom is returning after serving in an in-house counsel role with a healthcare company.

Our Voices - Cultivating Leadership: An Intimate Discussion with Leaders in our Communities


The Poyner Spruill Diversity Committee is celebrating Black History Month by hosting an intimate panel discussion with key leaders who have been successful in the legal field. The hour-long discussion will focus on how young minorities can navigate the legal industry and position themselves as leaders in their respective communities. Diversity is critical for an organization to be able to adapt in a fast-changing environment. The panel will shed light on the challenges of attaining meaningful diversity and create discussion and generate ideas on how to continue advancing diversity within the legal industry.

Eight attorneys earn distinction in Business North Carolina's 2019 Legal Elite


RALEIGH, N.C. — Poyner Spruill LLP is proud to announce that eight attorneys received a total of nine recognitions as members of Business North Carolina’s 2019 class of Legal Elite. This included Keith Johnson becoming a member of the Business North Carolina’s Legal Elite Hall of Fame for Environmental attorneys.

p.s. Lunch & Learn: How Certain Tax Changes Could Impact Your Personal Life


The Tax Cuts and JOBS Act will affect divorce, estate planning, and much more. Join us to learn what you can do to mitigate the impact.

Poyner Spruill named a firm of the year winner in Lawyer Monthly Legal Awards 2018


RALEIGH, N.C. — Poyner Spruill is pleased to have earned recognition in the Lawyer Monthly Legal Awards 2018 as the Administrative and Environmental Law Firm of the Year for the United States.