One year of GDPR, sanctions and relations between the various Authorities

The relevant changes that have emerged one year after the entry into force of the Regulation are as follows:

• Simultaneous application of the same rules in all EU countries and the European Economic Area
• Uniform sanctions 
• Obligation in many cases to appoint a Data Protection Officer (DPO);
• End of the absolute centrality of the consent and equal emergence of other conditions of lawfulness of the treatment;
• Enlargement of the category of sensitive data, openness to pseudonymisation mechanisms;
• Obligation to notify the Guarantor and to notify the data subject of personal data breaches (data breach);
• Obligation to conduct a privacy impact assessment;
• Joint and several liability between data controller and data processor;
• Obligation to keep a record of processing operations
  

But what is most important are the principles of law that are emerging in the new course of privacy, whose watchwords are: responsibility, proportionality of the measures to the risk, centrality of the protection of fundamental rights and their primacy over patrimonial rights and cooperation between independent authorities that leads to increasing liquidity between antitrust and privacy laws.

 
Click here to read more (in italian) »