raptorcomp

Answer to point 5: On first glance I would agree with this view, however, there is the factor of market competition you must take into account. If a company only receives a small fine for non-compliance (or is not prosecuted) then its competitor can make the argument that this is anti-competitive conduct as the non-compliant company has saved money through its non-compliance and the fine does not stand in relation to the money saved. Through this argument the fines could increase significantly over a very short timeframe placing great pressure on companies to observe the GDPR. As the money goes to the data protection authorities their ability to prosecute will grow steadily.

THe answer varies depending on the size of the company. However, I have seen many IT related professionals taking over the GDPR issues. In larger companies it is a more legal role. As to your career question: We are currently involved in many different and exciting project that push the boundaries of law and technology with respect to data protection. Currently, everyone is a GDPR consultant but quality and nature of the work differ substantially. For most part it is an exercise in producing documents and procedures to prove compliance. However, when it comes to implementing technical solutions you can really stand out. So if this is an area that you are interested in you should move fast. There is also a growing number of international opportunities as even non-EU companies require GDPR experts.

Some comments on the legal aspect to deletion under the GDPR: 1. deletion can generally only be requested if the personal data is being processed under the individual´s consent. Thus, other personal data such as under legitimate interest or execution of a contract does not fall under it. 2. The rule on deleting the data is not absolute as data retention laws prevail over this rule. Thus, only if no data rentention law mandates the storing of the data (which is often the case for business communication) then you are obliged to delete the data or anonymize it. Hope this clarifies the non-technical aspect. Dominic Staiger https://www.raptorcompliance.com/en