The much discussed and long-awaited General Data Protection Regulation (“GDPR”) applies from today, May 25, 2018.  It will update and harmonize data protection laws across the EU, and sets out comprehensive rules in relation to personal data handling, as well as the rights of individuals over their personal data.

It is unclear how aggressively the data protection authorities (“DPAs”) will seek to be in the near future when it comes to using their new powers under the GDPR, and how quickly investigations will get underway, and fines imposed.  Many DPAs have suggested they are simply not ready to carry out the extra responsibilities given to them, which may lead to an ‘informal grace period’ for many companies who themselves have struggled to ensure they are fully GDPR-compliant by today.

Information Commissioner for the UK, Elizabeth Denham, stressed two days ago that becoming compliant is “an evolutionary process for organisations” and that “organisations must continue to identify and address emerging privacy and security risks in the weeks, months and years beyond 2018.”  These echo sentiments from a blog post she wrote in December 2017, in which she also set out that if companies can demonstrate that they “have the appropriate systems and thinking in place” then they will “find the ICO to be a proactive and pragmatic regulator aware of business needs and the real world.”

As ever, we will continue to monitor key developments in relation to the GDPR, and will provide further updates.

Photo of Dan Cooper Dan Cooper

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing…

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing clients in regulatory proceedings before privacy authorities in Europe and counseling them on their global compliance and government affairs strategies. Dan regularly lectures on the topic, and was instrumental in drafting the privacy standards applied in professional sport.

According to Chambers UK, his “level of expertise is second to none, but it’s also equally paired with a keen understanding of our business and direction.” It was noted that “he is very good at calibrating and helping to gauge risk.”

Dan is qualified to practice law in the United States, the United Kingdom, Ireland and Belgium. He has also been appointed to the advisory and expert boards of privacy NGOs and agencies, such as Privacy International and the European security agency, ENISA.