Talk:General Data Protection Regulation

From Wikipedia, the free encyclopedia
Jump to: navigation, search


This is a good start but the text is a little casual in tone and lacking in sources. I added links to docs but dont currently have time to carry out the major edits it really requires.

FabulousPhil (talk) 22:58, 30 December 2015 (UTC)

"Came into force" is wrong[edit]

It says in the infobox "25 May 2018", but actually, it came into force on 24 May 2016! - it is only to be applied beginning 25 May 2018, as it says itself in its last article (and it must be in force to be able to say so!). This "legalese" distinction between "in force" and "to be applied" is certainly confusing ... Does the infobox for EU regulations have a field where it can be stated from when on the regulation is to be applied? --User:Haraldmmueller 12:10, 16 January 2017 (UTC)

Data Protection Officer[edit]

I have removed this sentence: "Monitoring of DPOs will be the responsibility of the Regulator rather than the Board of Directors of the organisation that employs the DPO."

There is no mention of 'the Regulator' in the article, the DPO Guidance document cited for this section nor in the Regulations themselves so I cannot understand the basis on which this statement has been made.

If someone can provide a citation for this specific statement then happy for it to be reintroduced, but in which case 'the Regulator' needs to somehow be both introduced and defined. Tedmarynicz (talk) 18:31, 19 March 2017 (UTC)

Data breach notification[edit]

I'm do not have a legal background. However, I think i detected a small mistake:

"The reporting of a data breach is not subject to any de minimis standard and must be reported to the Supervisory Authority within 72 hours of the data breach (Article 33). "

=> Notification should happen 72 hours after having become aware of it

Summary needs work[edit]

The current summary (shown below) does not seem appropriate.

"The proposed new EU data protection regime extends the scope of the EU data protection law to all foreign companies processing data of EU residents. It provides for a harmonization of the data protection regulations throughout the EU, thereby making it easier for non-European companies to comply with these regulations; however, this comes at the cost of a strict data protection compliance regime with severe penalties of up to 4% of worldwide turnover."

While it may seem like a general description of the regulation it is in fact a description from 2012 which was referenced in this article. Please update the summary to reflect the regulation as it was passed. — Preceding unsigned comment added by (talk) 16:21, 23 October 2017 (UTC)

UK Legislation mentioned in summary[edit]

I am removing the following text, which is not appropriate to the summary section of an article on the EU GDPR (Even if it might make sense in a section on effects of Brexit on the GDPR, or in an article on English, Scottish or Northern Irish Data Protection law, it's not particularly relevant to the GDPR itself).

The UK Data Protection Bill will update data protection laws for the digital age and was introduced to the House of Lords on 13 September 2017. Until then the UK will be subject to the GDPR. The Data Protection Bill is primarily based on the GDPR.

Also, it's not true - at least not as currently written (I believe intermediate edits have mangled the sense somewhat). The UK will presumably be subject to the GDPR, along with the rest of EU law, until 2 years after the UK's Article 50 notice to leave the EU (possibly longer depending on the nature of any regulatory equivalence which may be negotiated). - Paul (talk) 17:10, 8 December 2017 (UTC)

general viewpoint : transitional?[edit]

In many places the article seems to be not describing the Regulation per se, but how it evolved from and is different to its predecessor. However, it's not explicit when it does this. For example the sentence. “The notice requirements remain and are expanded. ” Without re-reading the introduction and making a guess, this sentence doesn't help the general reader. I suggest drafting to say what the Regulation does, and only then draw comparisons. --Matt Whyndham (talk) 10:43, 21 November 2017 (UTC)

No longer a proposal[edit]

The section "Content" starts with "The proposal for the European Data Protection ..." But for 18 months, this has not been a proposal, but a regulation (or "law", if you want). So this should be changed, shouldn't it? --User:Haraldmmueller 13:38, 25 November 2017 (UTC)

 Done This is indeed the case[1], therefore I will change it. Droogstoppel (talk) 20:55, 12 December 2017 (UTC)


Summary section: Direct quotation is unsupported by citation of source[edit]

Extended quotation in Summary section is unsupported by citation of source in a footnote. — Preceding unsigned comment added by 2601:154:4000:742E:DDDB:F1E2:4530:B40B (talk) 12:31, 4 January 2018 (UTC)

Wrong quoting of quoted source[edit]

The key definition for this article, of personal information, may appear as if erronously copied from its source. This quote, is simply not a copy of its original verbatim form from its mentioned source:

"personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a home address, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address."[7]

I'm new here, but I find this somewhat disturbing for the reliability of this Wikipedia page and similar ones. Maybe there have been multiple versions of the quoted source? anyway, a bit concerning.

Data is plural[edit]

The word data is the plural of datum. Throughout this article data has been used as a singular noun. However the English version of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL, i.e. the General Data Protection Regulation, to which the article refers, correctly differentiates singular from plural. FussyBSM (talk) 03:24, 31 January 2018 (UTC)

Umm, no. See Data (word) - data in this sense is an uncountable mass noun. It is perfectly proper to write "data is available" and not the awkward-sounding "data are available". Wikipedia does not duplicate the writing style of EU regulations, but writes encyclopedia articles. Mauls (talk) 19:25, 25 February 2018 (UTC)
One of the signs of a word being fully assimilated - people argue over whether it should comply with source language usage, formal English or colloquial English. Jackiespeel (talk) 15:52, 16 May 2018 (UTC)

You can unscramble the hashes of humanity's 5 billion email addresses in ten milliseconds for $0.0069[edit]

Given that many companies are using hashed emails as a way to comply with GDPR, this seems important to point out


John Cummings (talk) 07:43, 10 April 2018 (UTC)

Could companies not salt the hashes? Jasperwillem (talk) 06:34, 13 April 2018 (UTC)

Outside influence[edit]

Dear all,

Hereby I wanted to point your editors to the following piece;, where the reach of GDPR is wider as just European consumers. Other topics on the internet already suggested that this framework could be a referral piece of legislation for other law making entities. Since I am no expert in this topic I wanted to point this out for people known with the subject who could place it justly in the articles scope.


Jasperwillem (talk) 06:32, 13 April 2018 (UTC)

"B2B Marketing" original research?[edit]

Someone added that section - with only links to GDPR articles, but no secondary source. This alone is not really ok. However, "B2B" implies that both (or all) involved parties are not persons, but "businesses" - so prima facie, the GDPR should not at all be relevant for B2B. So why would one claim this, and support it with paragraphs from the GDPR, which only refer to "natural persons"? I argue that this section should be removed, unless some proff can be given that GDPR professionals (lawyers) regards B2B in the context of the GDPR. --User:Haraldmmueller 10:00, 18 May 2018 (UTC)


I am surprised there is no chapter on critisim - after all, there are plenty... — Preceding unsigned comment added by (talk) 20:03, 23 May 2018 (UTC)

Just research and add it ... BTW, in the German WP, we had the opposite problem: The whole article contained essentially only critical information, but nothing whatsoever about the GDPR's contents; so I rewrote it ... --User:Haraldmmueller 20:24, 23 May 2018 (UTC)