{"id":118247,"date":"2019-05-25T12:48:09","date_gmt":"2019-05-25T10:48:09","guid":{"rendered":"https:\/\/ceadigilaw.org\/georgia-governor-candidate-stacey-abrams-is-200000-in-debt-shes-not-alone\/"},"modified":"2026-07-17T21:34:07","modified_gmt":"2026-07-17T19:34:07","slug":"georgia-governor-candidate-stacey-abrams-is-200000-in-debt-shes-not-alone","status":"publish","type":"post","link":"https:\/\/ceadigilaw.org\/en\/blog\/georgia-governor-candidate-stacey-abrams-is-200000-in-debt-shes-not-alone\/","title":{"rendered":"GDPR: The First Anniversary"},"content":{"rendered":"\n
<\/i>\u00a0<\/span>Last Saturday, May 25, marked the first anniversary of Regulation (EU) 2016\/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data<\/a> (General Data Protection Regulation).<\/div>\n
\n\nWe have therefore considered this the ideal time to reflect on compliance with the Regulation over the past year. It is always advisable to analyze the results achieved through the application of new rules, especially rules as significant as the GDPR, so that we can face the future in the best possible way: correcting non-compliance and updating those aspects of the rules that have been applied correctly.\n\n<\/div>\n

Level of compliance<\/h3>\nAll companies and entities subject to the GDPR have had a year to adapt to the changes required by the Regulation. A large number of rules and procedures had to be incorporated progressively. However, it appears that the vast majority of companies have acted reactively\u2014in other words, they have taken action only in response to alerts such as security incidents or complaints.\n\nNow that a year has passed since the new rules became applicable, however, it is time to demand full compliance. It is time to require proactive accountability from everyone subject to the GDPR. People’s privacy is at stake and must take precedence, particularly in view of the attacks on personal data that occur every day.\n\nThe Catalan Data Protection Authority has conducted a preventive audit of transparency portals and identified the main problems. Its purpose is to provide companies and entities with guidelines and recommendations for proper compliance. The primary deficiencies concern the principle of lawfulness, with personal data being included when no legal basis existed for doing so. Problems were also found with the publication of unnecessary and excessive data and, finally, with the retention of personal data on transparency portals. The data were considered to have been kept beyond the period necessary to achieve their purpose.\n

Data Protection Officer<\/h3>\nThe new GDPR created a new role, the Data Protection Officer, whose main function is to ensure proper compliance with the rules and protect the data of the individuals concerned. The DPO’s tasks include informing and advising the controller or processor, as well as the employees who carry out processing, about their obligations under the Regulation and other Union or Member State data-protection provisions. They also include monitoring compliance with the Regulation, providing advice when requested regarding data-protection impact assessments and monitoring their implementation in accordance with Article 35, among many other duties.\n\nMany entities are required to appoint a DPO, but few have actually done so. The reasons may range from a lack of knowledge about the DPO’s functions to the need to contain costs, or even a mistaken view of the value of appointing a DPO.\n\nMunicipal councils are a clear example. These entities are required to appoint a DPO. At present, although municipal DPOs are registered with the supervisory authorities, no information is available on whether the DPO function is being performed properly.\n

Recorded results<\/h3>\nThe AEPD<\/a> has published an analysis in recent days of the degree of compliance with the requirements imposed by the new GDPR during its first year. It highlighted the following data in particular:\n