On Friday, the EU's Article 29 Working Party posted a document many have awaited with much interest: the final guidelines on the application and setting of administrative fines under the General Data Protection Regulation. Just what does an organization have to do in order to incur that oft-quoted fine of 4 percent of global turnover? Well, the WP29 doesn't go so far as to outline specific scenarios that would trigger the largest-possible fines, but they do lay out assessment criteria with which you can create your own. And, IAPP Content Director Sam Pfeifle writes for The Privacy Advisor, they also let you know, clearly, that failing to listen to your data protection officer is a bad idea.
Full Story