While the General Data Protection Regulation was designed to harmonize data protection law across the European Union, the GDPR still provides a lot of opportunity for local flavor at the member state level. There are a number of legislative actions that the GDPR requires member states to take, and there are a number of optional powers and authority available to member states to carve out exceptions for or to clarify the GDPR’s rules. In this new white paper developed by the IAPP Westin Research Center's Müge Fazlioglu, CIPP/US, we provide a handy guide to the division between what the member states “shall” and “may” do within the articles of the GDPR. These cover such areas as the processing of sensitive data; data processing in the context of employment; conducting DPIAs; appropriate safeguards for data protection for archiving purposes in the public interest, scientific or historical research, or statistical purposes; access rights; automated decision-making and profiling; and data protection officers.
Full Story