The chapter provides an overview of the EU General Data Protection Regulation (GDPR), a comprehensive privacy law designed to unify EU privacy laws, empower data subjects, and ensure broader privacy protection beyond the EU. Key points include: 1. **Motivations**: - Unify EU privacy laws. - Ensure privacy protection globally. - Empower data subjects with rights such as access, rectification, and erasure. 2. **Broad Points**: - shifted from a "legal unless specifically illegal" paradigm to a "illegal unless specifically legal" paradigm. - The burden of compliance falls on controllers and processors, not data subjects. - Focus on informing and empowering data subjects. - Vague and broad to address competing goals. 3. **Lawful Processing Types**: - Consent is a key type of lawful processing. 4. **Special Categories of Data**: - Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex or sexual orientation, and criminal convictions. 5. **User Rights**: - Transparency, right to be informed, right to access, right to rectify, right to restrict processing, rights regarding automated decision-making, right to erasure, and right to data portability. 6. **Notice and Security Requirements**: - Controllers must implement appropriate technical and organizational measures to protect personal data. 7. **Representative in the EU**: - Required for non-EU controllers/processors under certain conditions. 8. **Data Protection Officer**: - Required for large-scale monitoring, processing of special data, or public bodies. 9. **Penalties**: - Up to 2% of global annual turnover or €10,000,000 for specific obligations. - Up to 4% of global annual turnover or €20,000,000 for other violations. - Joint and several liability in joint ventures. 10. **Scope of Application**: - Data controllers/processors in the EU who process personal data. - Non-EU data controllers who process personal data of EU subjects or offer goods/services to EU subjects. - Public international law subjects. 11. **Strategies**: - Full compliance, total disregard, token acceptance, international partnerships, or deletion of EU data. The chapter emphasizes the importance of understanding the law's scope and implications, and consulting legal counsel for specific situations.The chapter provides an overview of the EU General Data Protection Regulation (GDPR), a comprehensive privacy law designed to unify EU privacy laws, empower data subjects, and ensure broader privacy protection beyond the EU. Key points include: 1. **Motivations**: - Unify EU privacy laws. - Ensure privacy protection globally. - Empower data subjects with rights such as access, rectification, and erasure. 2. **Broad Points**: - shifted from a "legal unless specifically illegal" paradigm to a "illegal unless specifically legal" paradigm. - The burden of compliance falls on controllers and processors, not data subjects. - Focus on informing and empowering data subjects. - Vague and broad to address competing goals. 3. **Lawful Processing Types**: - Consent is a key type of lawful processing. 4. **Special Categories of Data**: - Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex or sexual orientation, and criminal convictions. 5. **User Rights**: - Transparency, right to be informed, right to access, right to rectify, right to restrict processing, rights regarding automated decision-making, right to erasure, and right to data portability. 6. **Notice and Security Requirements**: - Controllers must implement appropriate technical and organizational measures to protect personal data. 7. **Representative in the EU**: - Required for non-EU controllers/processors under certain conditions. 8. **Data Protection Officer**: - Required for large-scale monitoring, processing of special data, or public bodies. 9. **Penalties**: - Up to 2% of global annual turnover or €10,000,000 for specific obligations. - Up to 4% of global annual turnover or €20,000,000 for other violations. - Joint and several liability in joint ventures. 10. **Scope of Application**: - Data controllers/processors in the EU who process personal data. - Non-EU data controllers who process personal data of EU subjects or offer goods/services to EU subjects. - Public international law subjects. 11. **Strategies**: - Full compliance, total disregard, token acceptance, international partnerships, or deletion of EU data. The chapter emphasizes the importance of understanding the law's scope and implications, and consulting legal counsel for specific situations.