1. Home
  2. |Experience
  3. |Privacy and Cybersecurity
  4. |European General Data Protection Regulation (GDPR)

European General Data Protection Regulation (GDPR)

Overview

Our Services

Crowell & Moring’s U.S. and European-based team has a wealth of experience advising clients on the European Union’s General Data Protection Regulation (GDPR), along with many other U.S. and related EU Member State-specific regulations.

Our GDPR team’s core offerings include:

  • Reviewing organizations’ operations to determine GDPR applicability and impact.
  • Conducting internal analysis of current data flows and data protection policies and practices to identify potential gaps or compliance risks.
  • Identifying areas of concern and defining best practices via on-site training and GDPR tabletop exercises with key members of the organization.
  • Helping design risk-based compliance frameworks tailored to meet the needs of the business.
  • Drafting policies and procedures and a tailored GDPR action plan.
  • Reviewing existing agreements with third-party suppliers for compliance issues.
  • Enhancing awareness of GDPR via workshops and seminars.
  • Monitoring regulatory developments.
  • Continuing review of existing programs based on regulatory and operational changes.
  • Assisting with communications to stakeholders and potential online defamation related to GDPR violations.
  • Defending class action privacy lawsuits.

Background

GDPR is a comprehensive EU-wide law that gives individuals the ability to control the collection and use of their personal data. The GDPR is based on the fundamental right to data protection enshrined in the EU Treaties and in the EU Charter of Fundamental Rights. This fundamental right is akin to a constitutional right in the U.S. By empowering individuals to control how their data may be used, the GDPR presents companies doing business in Europe with significant compliance and operational challenges. With significant possible fines for noncompliance—up to the greater of €20 million or four percent of organizations' worldwide annual gross revenue—it is legislation that cannot be ignored.

GDPR’s strict requirements apply to organizations that collect or process the personal data of individuals in the EU. A company does not have to have a physical presence in the EU to be subject to GDPR; as long at the company collects data on EU EU residents, it must comply with the law’s requirements.
Additionally, the regulation requires that organizations:

  • Hire a Data Protection Officer to oversee GDPR compliance;
  • Report data breaches to the relevant EU regulator within 72 hours;
  • Enforce strict record keeping for data processing activities;
  • Conduct data protection impact assessments for higher risk processing;
  • Take into account data protection when designing new technologies, systems, or services; and
  • Roll out new compliance policies, procedures, and governance controls requirements.

GDPR compliance is not a mere check-the-box exercise or a problem that has a one-size-fits-all, off-the-shelf solution. Compliance needs to be consistent with the risk environment, business needs, and available resources.

For more information on our offerings, please see our GDPR overview [PDF].

 

Insights

Client Alert | 2 min read | 03.07.23

Key Takeaways from the Cookie Banner Taskforce Report

In the past few years, privacy activists, consumers and national and European data protection authorities have become increasingly aware of the impact of cookies and other tracking technologies. As a result, most administrators of websites and mobile apps know that they have to provide users with a clear and prominent cookie banner. They also know that they should explain what cookies are being used and obtain the user’s consent before storing any non-essential cookies on their device. 

Representative Matters

U.S. and EU Representative Data Protection and GDPR Matters

  • Advised several national and international companies on how to prepare in a practical, pragmatic, and legally compliant manner for GDPR. Clients include European and Asian car manufacturers, a major international player in the beverage industry, a U.S.-based trade association, as well as several leaders in the MedTech and retail industry.
  • Advised several international companies, including leaders in the travel and leisure industry, on international data transfer mechanisms such as Binding Corporate Rules and standard contractual clauses, which included the review, drafting, and submission of the corresponding legal documents.
  • Led a team that carried out Binding Corporate Rules on-site audits on a worldwide scale and advised on the different legal and operational aspects of such a program.
  • Addressed federal contract privacy and data security compliance for a variety of government contractors, including integrating federal, state, and international privacy and data security requirements into the private sector components of their activities.
  • Advised a U.S.-based international leader in the food industry on the implementation of a global privacy program.
  • Advised a global fashion company on the implementation of a global privacy program.
  • Advised several international players in the financial services industry on compliance with privacy and data protection matters.
  • Advised several start-ups on building their business case in a privacy and data protection-compliant manner.
  • Led several GDPR readiness assessment projects at companies of different sizes and industries, allowing organizations to take informed and risk-based decisions and guiding them through the change process towards practical and pragmatic compliance with the new GDPR requirements.
  • Addressed EU aspects of global HR data protection audit and compliance project for a U.S.-based telecommunications service provider and data networking equipment manufacturer.
  • Conducted a global HR data protection audit for a diversified industrial manufacturer based in the U.S. with headquarters in Belgium.
  • Advised several U.S. clients, including U.S. car manufacturers, entities active in the financial sector and large industrial companies on issues of international transfers of personal data, mainly in the HR sector.
  • Advice on direct marketing issues for several companies active in the telecommunications sector.
  • Global HR data protection audit and compliance project for Belgian multinational in the digital imaging and healthcare industry.
  • Data protection audit and compliance project, as well as direct marketing advice for major Belgian telecommunications service provider.
  • Ongoing GDPR compliance projects for a Belgian subsidiary of Asian car manufacturer, a major Belgian player in the fundraising industry, and a Belgian entity active in road safety and related consultancy.

Insights

Client Alert | 2 min read | 03.07.23

Key Takeaways from the Cookie Banner Taskforce Report

In the past few years, privacy activists, consumers and national and European data protection authorities have become increasingly aware of the impact of cookies and other tracking technologies. As a result, most administrators of websites and mobile apps know that they have to provide users with a clear and prominent cookie banner. They also know that they should explain what cookies are being used and obtain the user’s consent before storing any non-essential cookies on their device. 

|

Insights

Client Alert | 2 min read | 03.07.23

Key Takeaways from the Cookie Banner Taskforce Report

In the past few years, privacy activists, consumers and national and European data protection authorities have become increasingly aware of the impact of cookies and other tracking technologies. As a result, most administrators of websites and mobile apps know that they have to provide users with a clear and prominent cookie banner. They also know that they should explain what cookies are being used and obtain the user’s consent before storing any non-essential cookies on their device.