1. Ian De Freitas, Partner, Farrer & Co 6 September 2017
The Impact of the General Data Protection Regulation on Galleries and Auction Houses
Ian De Freitas, Partner, Farrer & Co
6 September 2017

2. What is GDPR?
new regulatory regime affecting how organisations manage personal data relating to living individuals
EU Regulation automatically taking effect on 25 May 2018
strengthens existing data protection laws
"Zero Day" approach – everything must be compliant by 25 May 2018
Brexit has no impact – UK will fully implement GDPR

3. Four Key Changes
Scope – now applies to organisations based outside the EU and directly to data processors (e.g. cloud service providers)
Rights
Enhances individual's rights
Requires greater transparency with individuals
Effectively requires opt-in consent from individuals
Accountability – requires organisations to be able to prove compliance
Sanctions – up to the greater of 4% of annual turnover or €20M

4. Three Main Impacts Increases risk
Requires culture change in organisations
Affects relationships with clients, contributors, employees and service providers

5. Compliance Programme
establish leadership and assign responsibility – team and budget
map personal data – how do you acquire, use and share it?
analyse processes for compliance – establish risks and approach to them
implement change – e.g. re-consent data, amend and re-issue privacy policies, revise service provider contracts
train staff
monitor and enforce compliance

6. Timing
remember Zero Day - everything to be compliant by 25 May 2018
two years to get ready - less than nine months left
running out of time to make necessary changes
Act Now!

7. To find out more
Tel: