New restrictions in the area of collection and processing of personal data – an important change of EU law

New General Data Protection Regulation 2016/679 of 27th April 2016 provides restrictions regarding collection and processing of personal data. The main purpose of this act is to ensure high level of UE citizens’ privacy protection.
Among the most important changes the following shall be pointed out: the right to “be forgotten”, controllers’ obligation to maintain a record of processing activities under its responsibility and, in some circumstances – also necessity of designation of the data protection officer.

Moreover, new regulation introduces an obligation to notify personal data breach by the controller to Inspector General for Personal Data Protection, not later than 72 hours after having become aware of the breach.
Administrative fines provided for infringements of the provisions of the act amount up to 20.000.000 EUR, or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher.

Regulation shall apply from 25 May 2018.
Full content of the regulation is available under the link: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=PL