The security of personal data under the GDPR: a harmonized duty or a shared responsibility?

• Published in: International data privacy law 2017-08, Vol.7 (3), p.165-178
• Main Author: Wolters, P. T. J.
• Format: Article
• Language: English
• Subjects: Computer privacy; Cooperation; Councils; Data security; Evaluation; General Data Protection Regulation; Harmonization of laws; International aspects; Laws, regulations and rules; Personal information; Technological change
• ISSN: 2044-3994; 2044-4001
• DOI: 10.1093/idpl/ipx008

‘Personal data’1 play a central role in today’s society. Technological advancements have created new ways to collect, use and disseminate these data. The ‘processing’ of the data frequently crosses borders.2 The important role of personal data and the international dimension of the processing necessitate an adequate protection.3 To strengthen this protection, the European Parliament and the Council have adopted Regulation 2016/679/EU of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data [2016] OJ L119/1 (General Data Protection Regulation, ‘GDPR’).4 Pursuant to Article 99, the Regulation will apply from 25 May 2018. It creates several obligations for the ‘controller’ and the ‘processor’ and rights for the ‘data subject’. This article proceeds as follows. Section ‘The case of the international energy company’ sketches a fictional case that shows that the security of personal data depends on many different actors. Sections ‘The international energy company’ through ‘The developer of the firewall’ give an overview of the obligations of these parties. This overview shows that the duty to secure personal data can be based on a patchwork of different European and national rules. In Section ‘Synthesis’, I analyse several factors that influence the harmonization of the duty. The last section will present a conclusion.