Effective as of May 25, 2018, the European Union’s General Data Protection Regulation (“GDPR”) imposes strict regulations on the way companies collect, record, organize, store or disclose (collectively, “process”) certain personally identifiable information (“Personal Information”) that is received in the US from the European Economic Area (“EEA”). Any business that provides goods or services, regardless of whether there is a payment for such goods or services and regardless of where such business is geographically located, and that collects Personal Information of an EU resident who is physically located in the EU at the time of collection, must be GDPR compliant. Collection of information relating to an EU citizen who is outside of the EU when the Personal Information is collected does not subject a business to GDPR. Listed below are GDPR’s major initiatives that data processors—including American companies—should be particularly mindful of when adhering to the new legislation:
Informed Consent
In order to process Personal Information, the collector must obtain valid consent. In order to be valid under GDPR, consent must be freely given, specific, informed and unambiguous. Consent may not be a prior condition to using the website or services. If the user is to sign or assent to a written declaration, the terms must be in clear and plain language and easily accessible. Further, the user should have the right to withdraw their consent at any time.
Consent can be achieved by acceptance of a Privacy Policy or Terms of Service; however, these agreements require “active opt-ins”. The pre-selected opt-in boxes are invalid and there must also exist a clear separate consent for every use of data. For example, consent for the service provider’s cookies and consent for another third-party’s cookies must be displayed independently in a discernible manner.
Notification of Data Breach
Data processors must report data breaches to a supervisory authority within 72 hours of learning of the breach. The report must include what data was impacted, the likely consequences to follow and how the issue will be addressed moving forward.
Access and the Right to be Forgotten
EU residents may have the right to request a copy of their personal data held by a data processor. Additionally, EU residents can request their data be deleted without undue delay if they meet one of the requirements listed in Article 17. These requirements include, but are not limited to, personal data that is processed but is no longer necessary in relation to the purposes for which they were processed, consent was not initially provided to process the data, the personal data was unlawfully processed, or the data processor has no legitimate grounds for processing the data. Further, in some cases, companies may be obligated to take steps to get third parties or other processors to erase the data as well.
Third Parties and Parties
If a company transfers Personal Data to third-party agents or service providers, or if its website, mobile application or service uses plug-ins or connects to any third-party services, those third parties must be GDPR compliant. Under certain circumstances, companies may remain liable for the acts of its third-party agents or service providers for their handling of EEA Personal Data that the company transfers to them.
Data Protection Officer
Certain data processors will need to appoint a Data Protection Officer (“DPO”) if they are a public body or if they monitor certain data subjects on a large scale, which can include tracking user behavior. DPO’s must advise data processors and employees of their obligations with respect to GDPR and also understand the inherent risks associated with data processing operations. Further they must maintain an expertise with respect to the protection of personal data, be reachable by data users, fully cooperate with supervisory authority and have the necessary resources to carry out the job.
Parental Consent
The Children’s Online Privacy Protection Rule (“COPPA”), imposes requirements on websites that collect information on children that are under 13 years of age. COPPA specifically requires that parental consent be given for the collection or use of any personal information from children under the age of 13. Consent can be achieved through many methods such as a personal video conference, by postal mail or electronic signature via email. Similarly, GDPR has an expanded requirement whereby parental consent is necessary to collect personal information from children up to age 16. However, member states may provide by their state law for a lower age as long as the age is not lower than 13. The controller of the online service or site is also required to make viable efforts to receive parental consent.
Penalties
The consequences of GDPR non-compliance can be significant, with financial penalties of up to the greater of 20 million Euros or 4% of the company’s revenues.
Privacy Shield
Fortunately, the European Commission and the US Department of Commerce have reached an agreement on a framework for transfers of Personal Information to the United States from the European Union. The EU-US Privacy Shield does not guarantee GDPR compliance, but it does provide a framework to facilitate transfers that would otherwise not be permitted under applicable EU law. The EU-US Privacy Shield is voluntary and is not a requirement of GDRP compliance.
Compliance
It is vital for every US business that is or may be collecting data in European markets to understand and address GDPR compliance—and ensure all of its employees are engaged participants in the compliance strategy. Only time will tell how strict regulators will be, but knowledge of your data, where it is going, and what is required will equip companies to navigate the new and significant EU regulations.
Alia Delpassand is an associate of the Firm. Alia’s practice focuses on corporate transactions, including mergers and acquisitions, securities law compliance, private equity transactions and general corporate matters for both public and private clients, focusing on middle-market and emerging growth companies. Prior to joining the firm, Alia interned at the U.S. Securities and Exchange Commission in Washington, D.C. where she worked on insider trading liability and misappropriation cases. She also previously served as an extern for two federal judges, the Honorable Catherine E. Bauer in the U.S. Bankruptcy Court, Central District of California, and the Honorable Frances H. Stacy in the U.S. District Court of the Southern District of Texas.
Nick C. Feldman is an associate of the firm. Nick’s practice focuses on venture capital financing transactions, mergers and acquisitions, and general corporate representation of emerging growth and middle-market companies, including corporate governance, securities laws compliance, and commercial agreements. He also represents venture capital and private equity funds and strategic investors who finance and acquire these companies. In addition, Nick advises clients in connection with complex technology and intellectual property transactions, licensing, and privacy matters. Nick has been named a Southern California Super Lawyers Rising Star in 2017 and 2018. Nick also serves as an Adjunct Professor at Loyola Marymount University, where he lectures on media law topics.
For more information about our Corporate & Business Matters Practice contact Alia Delpassand at adelpassand@stubbsalderton.con or Nick Feldman at nfeldman@stubbsalderton.com
Stubbs Alderton & Markiles client BillGO, a B2B payment engine, has announced its acquisition of Prism, an award-winning app that has already paid $1B in bills on behalf of its customers. This will yield a considerable boost to BillGO’s real-time payments (RTP) biller network. BillGO will leverage Prism’s existing network of over 11,000 billers for its customers, widening their already significant lead in the bill payments industry – providing the most advanced eBills (statements) and bill presentment platform.
Stubbs Alderton & Markiles, LLP client Quintron Solutions, a central California-based A/V integrator, and communication systems manufacturer, was acquired by Solutionz, Inc., a Fernandez Holdings (“FHI”) portfolio company. Quintron’s manufacturing division, government contracts, and resources will help expand both companies’ ability to design, build, and manage technology deployments for existing and future customers.
Stubbs Alderton & Markiles, LLP client 
Stubbs Alderton & Markiles’ client INTAC Actuarial Services, which provides administration of employer-sponsored retirement plans for about 3,000 small and mid-sized companies, their owners, key executives and employees, has announced that it has been acquired by 
Stubbs Alderton & Markiles client Influential, an AI social data and activation technology company, announced Thursday that it has raised $12 million in a Series B financing round. With the fresh capital, the company plans to take their A.I. platform, designed to match brands with influencers who have relevant followings, to market. The funding came from existing investors Capital Zed, ECA Ventures, Paradigm Talent Agency, ROAR and Tech Coast Angels, as well as from Hollywood agency 
Stubbs Alderton & Markiles’ represented Dedicated Benefit Services (“Dedicated DB”) in its sale to Ascensus, a technology-enabled service provider. With the acquisition, Ascensus will be able to offer clients access to even more retirement plan experience and expertise while adding another location to its geographic footprint.
Stubbs Alderton & Markiles represented lead investor 
(Los Angeles, CA – June 19, 2017) Stubbs Alderton & Markiles, LLP announced that its clients, Kravitz and Kravitz Back Office Solutions, have been acquired by Ascensus. Kravitz is a retirement administration firm and Cash Balance specialist focused on bringing its clients the latest in the design, administration, and management of corporate retirement plans. Kravitz Back Office Solutions delivers private-label actuarial services to third-party administrators across the country to help them grow and succeed with Cash Balance plans.