May 25, 2023: GDPR 5th Anniversary

As our world becomes increasingly digitized, the importance of protecting personal data has become more critical than ever. May 25th marks the five-year anniversary of the General Data Protection Regulation (GDPR) which has since changed the way organizations within the European Union (EU) and the rest of the world handle personal data.

In this blog post, we’ll take a closer look at GDPR, how it has changed over time, and why it’s important when it comes to End-of-Life (EOL) data destruction protocol.

What is GDPR?

The Evolution of GDPR

The Impact of GDPR on EOL Data Destruction Protocol

Develop a Data Destruction Policy
Conduct Regular Data Audits
Implement a Secure Data Destruction Process
Document Data Destruction Processes
Conclusion

What is GDPR?

The General Data Protection Regulation was introduced by the European Union in 2018 to strengthen
data protection and privacy for EU citizens. The GDPR replaced the previous data protection directive and aimed to modernize data protection laws to keep up with technological advancements.

The regulation applies to any organization that processes or controls personal data of EU residents, regardless of where that organization is based. Personal data is any information that relates to an identifiable individual, including but not limited to names, addresses, and email addresses.

The goal of GDPR is to give individuals more control over their personal data and to ensure that organizations handling personal data are held accountable for protecting it. To achieve this, the regulation introduces several requirements that organizations must comply with, including:

Obtaining explicit consent from individuals for the collection and use of their personal data
Implementing appropriate security measures to protect personal data
Providing individuals with the right to access, correct, and delete their personal data
Reporting data breaches to the relevant authorities within 72 hours of discovery
Appointing a Data Protection Officer (DPO) to oversee data protection practices.

The Evolution of GDPR

Since its introduction in 2018, GDPR has evolved in several ways. One of the most notable changes has been the increased focus on enforcement. In the years since GDPR was introduced, there have been several high-profile cases of companies being fined for GDPR violations.

Google – In January 2019, France’s data protection regulator CNIL fined Google €50 million for “lack of transparency, inadequate information and lack of valid consent” in relation to how it collected and used personal data for personalized advertising.

British Airways – In October 2020, the Information Commissioner’s Office (ICO) fined British Airways £20 million for a data breach that exposed the personal information of over 400,000 customers.

Amazon – Also in 2020, the Luxembourg National Commission for Data Protection fined Amazon €746 million for violating GDPR regulations related to the processing of personal data, the biggest GDPR fine at the time it was issued.

Meta – In November 2022, Ireland’s Data Protection Commission fined Facebook’s owner Meta €265 million for breaching GDPR data protection rules.

As recently as May 2023, Meta was once again slapped with a record-breaking $1.3 billion fine by the European Union over GDPR data privacy violations, the biggest penalty to date.

This has led to increased awareness and scrutiny around data privacy practices, and companies are now more motivated than ever to comply with the regulation.

Another notable change has been the emergence of similar regulations outside of the EU. In California, for example, the California Consumer Privacy Act (CCPA) was introduced in 2018, which aims to give California residents more control over their personal data. Other countries, including Brazil and South Korea, have also introduced similar regulations.

The Impact of GDPR on EOL Data Destruction Protocol

When it comes to EOL data destruction, GDPR is an important consideration. The regulation requires organizations to take appropriate measures to protect personal data. Best practices dictate that data must be securely destroyed when it is no longer needed. This means that organizations should have clear policies and procedures in place for data destruction and must ensure that these policies are followed consistently.

Failure to comply with GDPR can result in significant fines and reputational damage. In fact, fines for GDPR violations can be up to €20 million or 4% of global annual turnover, whichever is greater. This means that it’s essential for organizations to take data destruction compliance seriously.

There are several steps that organizations can take to ensure GDPR compliance when it comes to EOL data destruction.

Develop a Data Destruction Policy

The first step is to develop a data destruction policy that outlines the duration for which different types of data should be retained and the procedures for securely destroying the data at EOL. This policy should be developed in collaboration with relevant stakeholders, including IT, legal, and compliance teams, and should be reviewed and updated regularly.

Conduct Regular Data Audits

Regular data audits can help organizations identify data that is no longer needed and can be securely destroyed. This can include data that is no longer relevant to the business, as well as data that is subject to GDPR’s “right to be forgotten” requirement.

Implement a Secure Data Destruction Process

When it comes to the crucial task of data destruction, it is imperative to collaborate with certified data destruction vendors who possess the necessary expertise. To ensure the highest level of security and maintain an unbroken chain of custody, conduct the data destruction process in-house using reliable commercial hard drive degaussers and physical destroyers.

It is essential to select the appropriate destruction method based on the type of storage media. Solid-state drives (SSDs) require physical destruction as they store data electronically on flash memory chips, making data recovery nearly impossible. With hard disk drives (HDDs), a two-step process is paramount: degaussing followed by physical destruction. Degaussing is pivotal as it destroys the magnetic patterns that store the data, rendering the data forensically unrecoverable. Subsequent physical destruction of HDDs provides an additional layer of security and provides visual confirmation that the media has properly gone through its destruction protocol. This meticulous approach will ensure 100% HDD data destruction.

Garner Product’s data security compliance and regulations chart provides an overview of products meeting the most common government and industry regulations including GDPR, CCPA, HIPAA, and NSA/CSS.

Document Data Destruction Processes

Lastly, it’s important to document all data destruction processes to demonstrate compliance with GDPR requirements. This includes maintaining records of when and how data was destroyed, as well as any certifications or audits conducted. This can be done effortlessly through Garner’s exclusive IRONCLAD verification system for verifiable data destruction.

Conclusion

GDPR has had a significant impact on data protection and privacy, underscoring the importance of securely destroying data as part of EOL data destruction. Failure to comply with GDPR can lead to severe penalties and reputational damage, making it imperative for organizations to reevaluate EOL data destruction as an integral part of their overall data protection strategy.

By incorporating degaussing and physical destruction into a comprehensive data destruction policy, conducting regular data audits, and maintaining thorough documentation of all data destruction processes, organizations can ensure GDPR compliance and protection for EOL data. Ultimately, this will instill confidence in their customers and stakeholders with a demonstrated commitment to preserving data privacy and security.

If you’d like to dig deeper into permanent and verifiable data destruction methodologies, our Masters of Destruction are here to help.

May 25, 2023: GDPR 5th Anniversary

Contents

What is GDPR?

The Evolution of GDPR