{"id":22995305,"date":"2018-03-15T11:37:34","date_gmt":"2018-03-15T10:37:34","guid":{"rendered":"https:\/\/congrex.com\/allgemein\/gdpr-congrex-switzerland-is-ready-are-you\/"},"modified":"2024-03-26T05:54:59","modified_gmt":"2024-03-26T04:54:59","slug":"gdpr","status":"publish","type":"post","link":"https:\/\/congrex.com\/de\/blog-de\/gdpr\/","title":{"rendered":"GDPR – Congrex Switzerland is ready, are you?"},"content":{"rendered":"

On May 25, 2018 \u2013 GDPR (General Data Protection Regulation) will become fully enforceable throughout the European Union – at which time organisations in non-compliance will face hefty fines. Therefore, Congrex Switzerland is working with a Data Protection Officer<\/a> to present our clients an all-in-one package to be compliant with the EU GDPR change as of 1st May 2018.<\/p>\n

GDPR for the meetings and association industry<\/h2>\n

The European Parliament approved GDPR in April 2016. Once the regulation takes effect, this EU data protection directive will require associations and event organisers to make modifications to how data is collected, stored, and handled.<\/p>\n

Until now, compliance with data security was regulated by the 1995 Data Protection Directive, which set the standard regarding data protection. GDPR will replace and expand the scope of the 1995 regulations. Like its predecessor, the new data protection regulations will apply to the collection and storage of personal data of people who reside in an EU member state (including UK residents), yet it will bring about a significant change involving the extent of its implementation.<\/p>\n

GDPR will apply to all organisations that collect personal data on European residents, irrespective of where those organisations are based. This means that you will be bound by the new regulations even if your association is based outside Europe, or if your event is held outside the EU. If your members or attendees are EU residents, you should fully understand what is entailed in the updated regulations and establish the procedures needed for GDPR compliance.\u00a0 <\/span><\/p>\n

The basics of GDPR terminology<\/h2>\n

The new data protection laws make a clear distinction between two types of data handlers. Controllers are individuals or organisations that oversee operations related to data processing. On the other hand, processors are the individuals or organisations that carry out data processing on behalf of or at the request of a controller. The fundamental distinction is who handles data: is it your organisation, or is it a third party, like an event organiser or a marketing contractor? In any case, both controllers and processors have defined responsibilities and the obligation to carry out all their processing data operations respecting the rights and freedoms of EU residents, who are deemed data subjects.<\/p>\n

Data subjects have fundamental rights<\/a> that associations safeguard, as described in the \u201cWhat are the requirements of GDRP?\u201d section below.<\/p>\n

Implications of non-compliance<\/h2>\n

Both controllers and processors (which may be different entities or the same) are subject to stiff fines for non-compliance<\/a>. These vary depending on the type of the data breaches, levels of cooperation, intention, and mitigation efforts, but can be as high as 4% of the organisation\u2019s annual global revenue or \u20ac20 million, whichever is greater. At the lower level, an organisation can be sanctioned with 2% of their annual revenue or \u20ac10 million, whichever is greater.\u00a0 <\/span><\/p>\n

What are the requirements of GDPR?<\/h2>\n

Under the GDPR, the following rights of data subjects must be respected by both controllers and processors:\u00a0 <\/span><\/p>\n