The General Data Protection Regulation enacted by the European Union is scheduled to go into effect on May 25. The effect of this regulatory framework will differ across European jurisdictions; in the United Kingdom, for example, companies will only have to follow GDPR guidelines until Brexit is formalized. As for Ireland and other EU member states, the GDPR is not exactly a rigid proposition.
The Seanad opted to adopt some of the flexibility offered by the GDPR when it passed the Irish Data Protection Bill earlier this year. This new law is filled with complexities for government and public entities, but the situation is not as strict for private companies.
Article 37 of the new law directs certain companies to appoint a data protection officer; specifically, business enterprises that collect, store and process large amounts of sensitive data will be expected to appoint a DPO. Some examples of sensitive digital information include: health records and data that can reveal the political and religious inclinations of Irish or European citizens. With this in mind, it is safe to assume that certain barristers and solicitors offices will have to abide by this article; moreover, private hospitals, insurance offices, and psychologists may have to do so as well. Banks and private funds can also expect to be subject to GDPR compliance.
Larger business enterprises in Ireland have more at stake under the new laws, but small companies should not believe that they will be impervious to the expensive penalties that can be imposed under GDPR. The reality of personal information stored in digital records these days is that it must be protected, and not just because of GDPR. If anything, the enactment of the Irish Data Protection Bill should prompt company owners to look at how their office network is protected.
Any company that has been managing its own server on premises should strongly consider migrating its data infrastructure to the cloud. The security advantage in this regard is that cloud technology has become very competitive, which means that providers are mindful about using secure and GDPR compliant options. There is more than compliance to consider when choosing cloud solutions; the ability to automate the data backup process and ease of recovery should also be factored in.
In the end, GDPR may become a wake-up call for Irish companies that have neglected the overall security of their office networks and the integrity of their data.