It has been a year since the new data protection law came into effect. In this article we try to analyze what has changed and what the current reality from the point of view of companies and consumers.
The new General Regulation on Data Protection entered into force on 28 May 2018 but raised many doubts. Despite the numerous clarifications of the National Commission on Data Protection, the truth is that some issues have still been hanging in the minds of many people. This regulation promised to break completely with the previous regulation which was already outdated.
As a year later still many companies are not totally sensitized to the need to adapt new data protection policies, it is important to recall some of the main points that the new law defines.
One of the most important aspects is to provide all means for the holder of the personal data to make changes or delete them. Thus the holder must have easy and timely access to all the information about him stored by a certain entity.
On the other hand, a company when collecting data from a person needs to have their express consent. In this way, the company needs to be in possession of it with clear evidence that the person concerned has agreed to provide certain data.
From the point of view of the company that stores data from several people or other entities, it needs to ensure that all efforts to store them safely are put into practice. That is, there can not be any type of behavior that does not conform to the highest safety standards. For example, storing data on a computer system with poor security and an older operating system version may bring penalties for the company in question. The company has to ensure that it does everything possible so that the data is protected and away from unauthorized access.
During the past year we have witnessed the efforts of many companies to comply with the new regulation. One of the most visible aspects for the general public was the receipt of emails from several companies that had their email address, asking if they wanted to continue receiving messages via that route. In this way it was possible for each person to have a better sense of who has their personal data, namely their email address, making it more transparent to delete them at any time.
Although progress has been made, further development of the procedures will still be expected. More than new provisions, the new law implies generalized behavioral changes which normally takes a significant amount of time until it is perfectly implemented.
The new General Regulation on Data Protection has brought a number of improvements, from the point of view of data subjects. Access to them has become easier and more transparent. Although much progress has been made, the behavioral change required by the new law may take a few more years to be fully implemented.