ZDC17: Bryan McCarthy - Data Protection and the Law: The First Line of Defence... or the Last?

### Overview In this talk at Zero Day Con 2017, Bryan McCarthy, a data protection legal expert from Ronan Daly Jermyn, addresses the upcoming implementation of the European Union General Data Protection Regulation (GDPR), which was roughly 14 months away from taking effect in May 2018. The presentation provides a practical legal analysis of the regulation's implications for organizations of all sizes, from tech startups to household consumer brands, focusing on shifting obligations, potential enforcement penalties, and the operational changes required to demonstrate compliance.

### Key Topics - **Regulatory Fines and Scope**: Under GDPR's higher tier, administrative fines can reach up to €20 million or 4% of an organization's global annual turnover from the preceding financial year (whichever is greater), far exceeding the prior €100,000 maximum penalty under Irish data protection legislation. McCarthy illustrates this impact using Yahoo's 2013 breach (disclosed in 2016): with Yahoo's 2016 revenue north of $5.1 billion, equivalent penalties could have reached $240 million. - **Extraterritorial Applicability**: GDPR applies regardless of where processing occurs if an organization sells goods or services to EU individuals or monitors the behavior of EU data subjects. Examples cited include an Australian firm marketing to Ireland, a phone accessories manufacturer in Shenzhen selling online to Irish consumers, or a San Francisco data analytics company monitoring Irish employees for performance evaluations. - **Accountability and Privacy by Design**: Organizations must not only comply but actively demonstrate compliance. Mechanisms include adhering to guidance from the Data Protection Commissioner and European Data Protection Board, adopting accredited codes of conduct, certifications, and seals (valid up to three years), and implementing Privacy by Design—ensuring data privacy considerations are embedded at the initial conception of any business or operational change rather than treated as an afterthought at execution.

### Technical Details & Legal Mechanics - **Consent Requirements**: Valid consent must be freely given, specific, informed, and unambiguous via clear affirmative action; pre-ticked boxes, silence, and inaction are prohibited. Subjects must have the right to withdraw consent as easily as it was given. For children, the default age threshold for valid consent is 16 (member states may lower it to no less than 13). Where consent is absent or invalid, controllers must identify another lawful basis, commonly legitimate interests, which requires balancing controller needs against data subject fundamental rights (applicable in areas like fraud prevention, intra-group transfers, and network or information security protection). - **Data Protection Officers (DPOs)**: Mandatory for public authorities, entities conducting large-scale regular and systematic monitoring of individuals, or those processing sensitive personal data on a large scale. DPOs must have professional qualifications, report directly to top management, operate with genuine independence without receiving instructions, and cannot be dismissed for performing their duties. - **Data Subject Rights & Access Requests**: Enhances rights such as erasure (right to be forgotten) and introduces data portability, allowing users to mandate the transfer of their data directly between providers. For standard Subject Access Requests (SARs), the response window is shortened from 40 days to 30 days (extendable by up to two additional months under specific conditions), and the former €6.35 statutory fee is abolished. - **Breach Notification & Security Controls**: Controllers must implement appropriate technical and organizational measures evaluated against the state-of-the-art technological developments, cost of implementation, and nature of the processed data. In the event of a breach, supervisory authorities must be notified within 72 hours, and affected individuals must be informed without delay if the breach poses a high risk to their rights.

### Takeaways McCarthy emphasizes that organizations have a strict 14-month countdown to evaluate existing data processing, review legacy consent mechanisms, evaluate international data transfer mechanisms (such as standard contractual clauses amid evolving case law), and align security practices with GDPR requirements before May 2018.