![\"GDPR](\"https:\/\/blog.atinternet.com\/wp-content\/uploads\/2019\/07\/markus-spiske-wIUxLHndcLw-unsplash-1024x604.jpg\")
<\/figure>\nThe GDPR has just turned one and to herald this landmark for EU data privacy, AT Internet has created a guide <\/a>to staying one step ahead of the regulation and making sure that your data processing is fully compliant. To accompany the guide, we are running blog series and GDPR quiz<\/a> to get you up to speed!<\/p>\n In the first blog, we looked at the top 12 teething troubles for the GDPR 12 months in<\/a>. Part two looks at the future of the regulation. Where does the GDPR go from here?<\/p>\n A range of surveys were published on the first anniversary of the GDPR which found that many businesses are still in breach of the regulation. A poll<\/a> by Infosecurity Europe indicated that more than two-thirds of businesses are not GDPR-compliant one year in. Many respondents to the survey believe that organisations are not taking the regulation seriously and that the GDPR regulators are being too relaxed and lenient in enforcing the regulation. While an earlier survey carried out by IT Governance<\/a> with companies across a range of industries indicated that only 29% had implemented all of the necessary changes to be GDPR-compliant. Up to 25 of the 28<\/a> official EU government websites may not be compliant either.<\/p>\n The US tech giants are The UK ICO announced While, the Irish Data Protection Commissioner Helen Dixon said<\/a> that However, she also pointed out that \u201csignificant sanctions take time to While in the UK, Information Commissioner Elizabeth Denham stated<\/a> that the UK ICO Although the introduction of GDPR has laid the foundations<\/a> of information security and privacy-related practices, 2019 is a Following on from and aligning with the GDPR, the ePrivacy Regulation<\/a> (ePR) is set to arrive in 2019. Repealing the 2002 ePrivacy Directive, it aims to reach the same standard of protection provided by the GDPR for EU citizens and will concern all electronic communications. The new regulation will apply to businesses that provide any form of online communication service, use online tracking technologies, or engage in electronic direct marketing.<\/p>\n The regulation is aimed at protecting users\u2019 communication data, specifically metadata. With new services such as WhatsApp, Facebook Messenger, and Skype all currently holding this type of user information, the new ePR<\/a> will give users far more control over what type of metadata is being stored. If people don\u2019t give consent, companies will have to delete that information and would no longer be able to collect it by default.<\/p>\n It will also simplify and streamline rules on cookies with the new rule being more user-friendly. Browser settings will give users a simple way to accept or refuse tracking cookies and other identifiers. It will also clarify that no consent is needed for:<\/p>\n Another major proposal in the ePR is for protection against spam (including phone calls), banning unsolicited electronic communications by emails, SMS, and automated calling machines. Depending on national law, people will either be protected by default or be able to use a do-not-call list to avoid receiving marketing phone calls. Marketing callers will need to display their phone number or use a special pre-fix that indicates a marketing call.<\/p>\n Although The 2019 will be decisive It is set to address The Much New AT Internet\u2019s Analytics Suite<\/em> is 100% compliant with As an Our The GDPR has just turned one and to herald this landmark for EU data privacy, AT Internet has created a guide to staying one step ahead of the regulation and making sure that your data processing is fully compliant. To accompany the guide, we are running blog series and GDPR quiz to get you up […]<\/p>\n","protected":false},"author":1,"featured_media":81510,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12033],"tags":[23851],"dealstore":[],"offerexpiration":[],"class_list":["post-81509","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analytics","tag-gdpr"],"yoast_head":"\nMany companies are still not fully compliant\u2026<\/strong><\/h3>\n
\nalso far from conforming to the 2018 European regulation. The recent wave of complaints<\/a> against real-time bidding (RTB) filed in Belgium, Luxembourg, the
\nNetherlands and Spain has highlighted the fact that RTB entails \u201cwide-scale and
\nsystemic\u201d breaches of Europe\u2019s data protection regime. Google\u2019s practice of
\nharvesting personal data to profile Internet users for ad-targeting (and
\nbroadcast to a wide spectrum of bidders across the adtech chain) has been
\nreferred to by Johnny
\nRyan, chief policy officer at Brave as a \u201cmassive and
\nongoing data breach\u201d<\/a>.<\/p>\nFines are coming<\/strong><\/h3>\n
\nat the start of July that it could be handing out a \u00a3183m fine to British Airways<\/a> for a
\ncyberattack that saw the harvesting of the details of around 500,000 customers last
\nyear after they were diverted to a fraudulent site. This was shortly followed
\nby a \u00a399m fine on the Marriott hotel group<\/a> after hackers stole the records of 339 million guests. The CNIL has
\nalready handed out a second fine of \u20ac400,000 fine to the French real estate
\ncompany Sergic<\/a> since the end
\nof May for failing to adequately protect the data of users of its website and
\nfor implementing procedures for storing inappropriate data.<\/p>\n
\nsubstantial fines were on the way in the \u201ccoming months\u201d. There are currently 18 investigations<\/a> underway by the Irish DPA which has become the lead GDPR regulator for
\nthe majority of the major tech companies who are based there.<\/p>\n
\nbuild, conduct, and conclude\u201d and that there were a range of procedural steps
\nfor establishing the basis of an investigation such as permitting participation
\nof affected parties, and interacting with other Supervisory Authorities in the
\ncontext of cross-border processing. Since it came into force, she has opened inquiries<\/a> into Facebook and its WhatsApp and
\nInstagram units, three inquiries into Twitter, two at Apple, one at LinkedIn,
\nand the latest against Google\u2019s ad exchange. <\/p>\n
\nhave \u201ca couple of very large cases that are in the pipeline\u201d. However, she also
\nstressed it was vital that Supervisory Authorities \u201cset a strong precedent in
\nterms of the enforcement action they take\u201d, with the ICO particularly focusing
\non ad tech and the processing of children\u2019s data.<\/p>\n
\ncritical year to see if the regulation carries out stronger enforcement
\nmeasures.<\/p>\nThe ePR<\/strong><\/h3>\n
\n
\nexperience (e.g. by remembering shopping cart history)<\/li>\n
\nvisitors.<\/li>\n<\/ul>\nCertain GDPR fines will cover ePrivacy violations <\/strong><\/h3>\n
\nthe ePR will be implemented through national legislation and the fine can vary
\nfrom nation to nation, they are almost always less than the maximum allowed
\nGDPR fine. However, according to the EDPB<\/a>,
\ncertain data processing activities, like using cookies for behavioural
\nadvertising, fall under the scope of both the GDPR and the ePrivacy regulation.<\/p>\n
\nePrivacy regulation will also be aligned with the GDPR in terms of user consent.
\nThe user will be required to give consent by providing an \u2018unambiguous
\naffirmative action\u2019 \u2013 as with the GDPR, pre-ticked boxes will be banned. The GDPR\u2019s
\napproach to consent was reaffirmed in March 2019 in the Planet49<\/a> case, where the Assembly General\u2019s office
\nruled that pre-ticked boxes do not qualify as a user\u2019s express consent for
\ncookies.<\/p>\nThe Digital Single Market Strategy<\/strong><\/h2>\n
\nto give credibility to the GDPR\u2019s legal framework and prove that this ambitious
\nEuropean challenge can actually work in practice. The GDPR and ePR are part of
\nthe EU Digital Single Market Strategy<\/a> \u2013 an initiative that aims to open up digital
\nopportunities for people and business and enhance Europe\u2019s position as a world
\nleader in the digital economy. Part of the
\nEU\u2019s Digital Agenda for Europe 2020, and an initiative of Europe 2020<\/a>, the strategy aims to improve access to online products and services,
\nconditions for digital networks and services to grow and thrive and stimulate
\ngrowth of the European digital economy.<\/p>\n
\nissues such as: <\/p>\n\n
The arrival of the CCPA<\/strong><\/h3>\n
\nCalifornia Consumer Privacy Act is set to come into effect on the first day of
\n2020. Although part of the global data privacy movement, it differs from the GDPR in several ways<\/a>. Firstly, CCPA requires companies to set
\nup specific communication channels, i.e. phone numbers and websites so
\nCalifornia residents can request information about their data. It expands the
\ndefinition of personal data in California to include household information and
\ndata from devices connected to the Internet of Things (IoT). The CCPA
\nestablishes a different set of data deletion requirements and establishes new
\nones around selling data for commercial purposes.<\/p>\n
\nof the new law is still being defined, including changes to the definition of
\npersonal information. Nevertheless, it\u2019s set to have a major impact<\/a> as it will force US company to take on
\nboard the notion of data privacy for the first time. As the toughest US privacy
\nregulation to date it looks like it\u2019ll have its work cut out \u2013 only 14%<\/a>
\nof Californian companies report being CCPA compliant so far.<\/p>\n
\nYork state is also following suit with its own proposed privacy act<\/a>. Planned measures could go even further
\nthan the CCPA by introducing a \u201cprivate
\nright of action\u201d giving New Yorkers the right to sue companies directly,
\nmeaning the tech giants could face \u201ctens of thousands of lawsuits\u201d. It would also
\nremove the minimum size for companies subject to the new legislation and
\nintroduce far stricter rules for the handling of private data. Watch this space
\nin the coming months\u2026<\/p>\n
\nMake sure your digital analytics is GDPR-proof!<\/strong><\/h2>\n
\nthe GDPR. Protecting user data and respecting user privacy has been central to
\nour analytics approach for over 20 years.<\/p>\n
\nindependent European provider since day one, we\u2019ve always been strongly aligned
\nwith strict European policies on data protection and privacy. Our solution has
\nbeen developed with privacy-by-design since the very beginning. <\/p>\n
\nlong-standing relationships with the CNIL, France\u2019s data protection authority,
\nand Germany\u2019s T\u00dcV, speak volumes. These trusted authorities recognise the
\nconformity and surety of the Analytics Suite and have awarded us their
\ncertificate of compliance year after year.<\/p>\nData practice hygiene is growing! Read our latest FREE guide<\/a>: Digital Analytics and the GDPR \u2013 one year on \u2013 making sure you\u2019re compliant<\/em>, to find out more!<\/h3>\n
![\"Digital](\"https:\/\/blog.atinternet.com\/wp-content\/uploads\/2019\/07\/Digital-Analytics-and-GDPR-updated-guide.jpg\")
<\/a><\/figure>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"