An in-depth seminar on the new economic and trade measures recently introduced by the CETA Agreement, the advantages and the opportunities for the growth for the internationalization of Italian companies.
Info: info@centrostudi-italiacanada.it or infocna@firenze.cna.it
For accreditations click here
Here’s what you need to know about GDPR if you are doing business in Italy or in Europe.
The GDPR takes a wide view of what personal identification information constitutes of. To comply with GDPR, you will need the same level of protection for things like an individual’s IP address or cookie data as you do for name, address and Social Security number of your clients.
GDPR carries provisions that require businesses to protect the personal data and privacy of EU citizens for transactions that occur within EU member states. The GDPR also regulates the exportation of personal data outside the EU. This privacy legislation imposes stricter requirements than its predecessor, the Data Privacy Directive, and is not open to interpretation by national governments. The GDPR will affect Canadian organizations that offer goods or services to EU residents, even if they are based in Canada.
Even if you do not have a business presence within the EU, if your company stores or processes personal information about EU citizens who live within the EU states you must comply with the GDPR.
You must comply with GDPR if :
In other words, almost all companies that do business with/in the EU are affected by GDPR regulation.
Companies that collect data on citizens in European Union (EU) countries will need to comply with strict new rules around protecting customer data by May 25. This deadline is moved to August 21st for Italy.
GDPR comes with severe penalties for violations. Breaches could result in a fine of up to 20 million Euros or four percent of your company’s worldwide revenue, whichever is higher. Frequent breaches of the regulations and failure to address the issue can even result in higher fines of up to €40 million.
GDPR enforcement will be up to the national data protection authorities in each jurisdiction. Be mindful of the fact that your company can be sued privately as well, which means that non-compliance can be costly, even if your company doesn’t get fined by their Relevant Data Protection Authority.
The GDPR defines several roles that are responsible for ensuring compliance:
It’s possible, then, that both your company and processing partner such as a cloud provider will be liable for penalties even if the fault is entirely on the processing partner.
Companies are required to have a DPO if they process or store large amounts of EU citizen data, process or store special personal data, regularly monitor data subjects, or are a public authority. Some public entities such as law enforcement may be exempt from the DPO requirement.
Your company must inform customers of their rights under GDPR.
As for third parties, if a third-party processor does not comply with GDPR, you will be held liable. It has strict rules for reporting breaches that everyone in the chain must be able to comply with.
It means all existing contracts with processors (including cloud providers) and customers need to spell out responsibilities, define consistent processes for how data is managed and protected, and how breaches are reported.
You need to ensure that the whole grouping of vendors that have access to personal data of your clients are adhering to GDPR and processing the data accordingly.
Client contracts whether they are online click-throughs or formal agreements ,also need to reflect the regulatory changes on how you view, access, and process data.
If one of your vendors says, ‘You were hacked last night,’ you need to know who to call and how to respond as part of meeting the regulatory requirements with the 72-hour reporting window that the GDPR requires. You want a clearly defined path in the contract for the information to get to the person in your organization responsible for reporting the breach.
