Previous Year Question
Which of the following adopted a law on data protection and privacy for its citizens known as ‘General Data Protection Regulation’ in April 2016 and started implementation of it from 25th May, 2018?
Australia
Canada
The European Union
The United States of America
Correct Answer: C
Detailed Solution
The General Data Protection Regulation (GDPR) is a regulation on data protection and privacy adopted by the European Union. It was adopted on 27 April 2016, entered into force on 24 May 2016 and, following a two-year transition period, became mandatorily applicable from 25 May 2018.
The GDPR applies to the processing of the personal data of individuals in the European Union and the European Economic Area. Under certain circumstances, it may also apply to organisations established outside the EU—particularly when they offer goods or services to individuals in the EU or monitor their behaviour.
Under the GDPR, personal data includes information through which an individual can be identified directly or indirectly. It may include a name, identification number, location data, online identifier and information relating to physical, genetic, economic or social identity.
It grants individuals rights concerning their personal data, including access, rectification, erasure, restriction of processing, data portability and objection. Data processing must comply with principles such as lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation and security.
The GDPR mainly classifies entities handling data as data controllers and data processors. In the event of a personal-data breach posing a serious risk, a controller is generally required to notify the competent supervisory authority within 72 hours of becoming aware of it.
Serious infringements of the GDPR may attract an administrative fine of up to 20 million euros or 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher.