Businesses and Institutions Prepare for the New Data Protection Regulation

On Monday, Facebook released its privacy principles and launched an educational campaign to explain to users how the social network uses their data. The measures come in response to the new EU regulation that enters into force on May 25, this year, in all EU member states. A large conference in the National Palace of Culture in Bulgaria’s capital of Sofia, was dedicated to the new regulation.

The new regulation has been defined as a major reform for personal data protection in the two decades. Its purpose is to protect consumers from potential abuse and give them more rights to decide how companies use their personal data.

Mariya Gabriel, European Commissioner for Digital Economy and Society says that higher consumer confidence means new opportunities for business innovation. Enterprises will also have easier access to the Union market as the current 28 national laws will be replaced by a clear legal framework.

The rules will apply to all data administrators of personal data of European citizens, even if those administrators are registered outside the European Union. Fines for violations will reach 20 million euros or 4% of the company's global turnover. There are over 450,000 organizations in Bulgaria that have to comply with the regulation, and over 45,000 of them have to appoint a special employee. However, very few of the commercial enterprises are ready for the change, the State Supervisory Authority says.

Ventsislav Karadzhov, Chair of Bulgaria’s Commission for Personal Data Protection says that the business either did not make the necessary efforts to become acquainted with the new rules or does not understand them.

The regulation opens new doors for consumers. For example, they will be able to request a free copy of the information organisations collected about them, and not to use this information to create personalised ads. Because of the so-called "Right to be Forgotten" citizens will be able to oblige organisations to erase their data under certain conditions.

When requirинг informed consent of the consumer, companies will need to provideю the terms of use in easy to understand and plain language. Moreover, the consumer should be able to withdraw his consent as easily as he has given it.

In the event of a breach, companies will be required to notify the supervisory authority within 72 hours. Consumers should also receive a notification immediately.