Before the GDPR came into effect, I had to deal with both the German Bundesdatenschutzgesetz and the Italian Codice in materia di dati personali, and recall them having very similar provisions (though I am not a lawyer). When the GDPR arrived, I found it equally similar to these two.

As far as I can tell, the major changes of the GDPR are maximum fines for violations, as well as some refinements (e.g. what data falls under “special categories”, the processing of which is subject to further restrictions).

Now, with the GDPR in force, I frequently hear statements (from people who are also not lawyers, all of them in a German context) to the effect that the GDPR changes everything, and every practice based on national data protection law becomes obsolete. My reading of the GDPR is a different one—IMHO the measures required for compliance with national data protection law are not very different from those required for GDPR compliance, save for a handful of exceptions or refinements.

Have I overlooked something here?

  • 4
    GDPR harmonized existing data protection laws. Previously, companies generally ignored these local laws. An EU-wide regulation is much harder to ignore, especially if there's the potential for fines that are more than a slap on the wrist. The flood of "we're updating our privacy policy" emails made more lay people aware of data protection laws. – amon Jan 17 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.