On May 25, 2018, the General Data Protection Regulation (GDPR) will go into effect. GDPR is a set of new data privacy laws across Europe that are designed to protect EU citizens’ data privacy and reshape the way organizations approach data privacy.
We have been receiving an increasing number of questions on this, so wanted to provide an update on the steps Lithium is taking to ensure we are compliant. Here goes...
Lithium began working on GDPR compliance months ago. Fortunately, we had a good head start, having already implemented compliance with EC Standard Contractual Clauses – a much more demanding standard than either the old “Safe Harbor” or the new “Privacy Shield” - so we have already implemented much of what is needed for GDPR compliance. We’ve also worked with outside EU counsel to ensure we correctly interpret how GDPR will affect Lithium specifically, and to ensure we are handling EU personal data correctly. For example, we confirmed our interpretations of consent requirements and other legal bases for processing personal data and exporting personal data from the EEA with our EU counsel. As we near the May 2018 effective date for GDPR, Lithium will complete its GDPR compliance measures. Lithium is continually examining and documenting our internal processes and any aspects of our product portfolio that relate to personal data handling, not just to ensure regulatory compliance, but more importantly to achieve best practices and satisfy our customers’ needs.
If you’re looking for more information, I’ve included links below to our privacy policies, details on our subprocessors, and the official sites for GDPR and EC Standard Contractual Clauses. And I know this is complicated, so if you have specific questions, leave them in the comments and I’ll make sure they get addressed.