GDPR

Key Points of GDPR

The following are some of the key elements of GDPR (source https://gdpr.eu/):

Territorial Scope

GDPR applies to all companies collecting and processing the personal data of EU citizens (also referred to as data subjects) in the EU regardless of where the companies are located and where the data is stored and processed. In other words, it applies to the data of EU citizens collected in the EU by companies either inside and outside the EU and data stored and processed on servers located either inside or outside the EU. See Article 3.

Penalties

Organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20 million (whichever is greater). This is the maximum fine that can be imposed for the most serious infringements, such as not having sufficient customer consent to process data or violating the core Privacy by Design concepts. There is a tiered approach to fines. For example, a company can be fined 2% for not having their records in order (article 28), not notifying the supervising authority and data subject about a breach, or not conducting impact assessment. See Article 83.

Consent

Requests for consent must be given in an intelligible and easily accessible form, with the purpose for data processing attached to that consent. Consent must be clear and distinguishable from other matters and provided in an intelligible and easily accessible form, using clear and plain language. It must be as easy to withdraw consent as it is to give it. See Article 7.

Breach Notification

Breach notification must be done within 72 hours of first having become aware of the breach. Data processors are required to notify their customers, the data controllers, “without undue delay” after first becoming aware of a data breach. See Article 33.

Right to Access

EU data subjects have the right to obtain from the data controller confirmation as to whether or not their personal data is being processed, where, and for what purpose. Further, the controller shall provide a copy of the personal data, free of charge, in an electronic format. See Article 15.

Right to Be Forgotten

Also known as data erasure, the right to be forgotten entitles EU data subjects to have the data controller erase their personal data, cease further dissemination of the data, and potentially have third parties stop processing the data. The conditions for erasure include the data no longer being relevant to original purposes for processing, or data subjects withdrawing their consent. Note that when considering such requests, this right requires controllers to compare subjects' rights to "the public interest in the availability of the data". See Article 17.

Data Portability

Data portability is the right for EU data subjects to receive their personal data, which they have previously provided, in a "structured, commonly used and machine-readable format". Data subjects have the right to transmit that data to other controllers. See Article 20.

Privacy by Design and by Default

Controllers should hold and process only the data absolutely necessary for the completion of their duties (data minimization). It also calls for controllers to limit access to personal data only to those needing to carry out its processing. See Article 25.

Extreme Support of GDPR Compliance

To help you comply with GDPR requirements, Extreme Networks incorporated several new capabilities into ExtremeCloud IQ and will introduce more in forthcoming releases. The following are GDPR-related tasks and links to relevant Help topics:

• Search, download, and delete user data by client MAC address – Client Details
• Search, download, and delete user data by user name – Users and Users List
• Search, download, and delete admin data by admin name – Audit Logs
• Track and report that user or admin data was downloaded or deleted, when, and by whom – GDPR Audit Logs
• Obtain explicit consent for data collection on captive web portals – Captive Web Portal
• Do not collect data from passerby wireless clients – Radio Profile Settings

Note

Because the current network use policy in the default captive web portal does not include statements about data collection, it fails to satisfy GDPR requirements as is and must be customized. Extreme Networks intends to provide revised text in another release before GDPR enforcement goes into effect on May 25, 2018.

For more information, see the following websites: