Film-Tech Forum ARCHIVE: GDPR and theatres

This is topic GDPR and theatres in forum Ground Level at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=5;t=003106

Posted by Frank Cox (Member # 6258) on 05-19-2018, 01:57 AM:

I was just reading some articles about the impact of the EU's GDPR (alphabet soup anyone?) on small businesses and it occurs to me to ask what steps, if any, you folks who have theatres in the EU are taking to insure that you comply with that regulation.

I operate a weekly email mailing list for my customers but since it's of local interest only and I'm not in the EU I don't see any way that it would have any impact on me.

What about the rest of you fine folks?

Posted by Carsten Kurz (Member # 5396) on 05-19-2018, 05:48 AM:

Hah, very funny it comes up here as well...everyone is a bit overnervous here currently.

- Carsten

Posted by Stephan Shelley (Member # 8587) on 05-19-2018, 12:00 PM:

Call me clueless but what is GDPR?

Posted by Randy Stankey (Member # 64) on 05-19-2018, 01:19 PM:

“General Data Protection Regulation”

https://en.m.wikipedia.org/wiki/General_Data_Protection_Regulation

It governs how the personal information of citizens of the European Union may be used and/or exported from Europe.

Posted by James Biggins (Member # 8574) on 05-19-2018, 06:10 PM:

The implementation has caused more than a few headaches, but the principle, of giving people more control over how their personal data is used, can only be a good thing.

Posted by Marcel Birgelen (Member # 6801) on 05-20-2018, 01:51 AM:

It's a pretty far reaching law. For the average movie theater, the impact will be somewhat limited, although if you want to do it "right", then you'll have a lot of homework to do.

Also, 8 of the 28 EU member countries haven't even finalized their own implementation of the law yet, so they're officially behind schedule and won't make the deadline. The EU also only formulates regulations, the member states have to implement their own laws based on those. The result is often interesting, as the differences between the implementations allow different interpretations on some key aspects...

The law doesn't only apply to EU organizations, but also to international organizations dealing with EU organizations or citizens.

The whole law/regulation in a nutshell: All organizations operating within the EU are required to:

- Keep track of all the personal data they collect and maintain from all their customers.
- Keep track of all the external entities with which they share this personal data and maintain a binding agreement with those entities that explicitly states the purpose and under which conditions this data can be used.
- Install a "Data Protection Officer" who is responsible for the ongoing task of "Data Protection" inside the organization.
- Ensure that all personal data will be either destroyed or "anonymized" when there is no longer any applicable use for the personal data being stored. There is also a requirement to ensure that all entities sharing the data do the same.
- Formally report all leaks of personal data to the responsible reporting entity in the responsible member state, once such a leak has been detected.
- Actively and unambiguously inform customers or individuals dealing with said organization about how they treat their personal information, where their personal information will be stored, with whom it will be shared and under what conditions it will be destroyed or anonymized.
- Provide customers or individuals dealing with said organization with a complete extract of all the information stored about them, if he/she demands as such.

I'm pretty sure that no company or organization of any measurable size will be entirely "GDPR compliant" on the 25th of May, when the legislation is going to be enforced (at least, if the member state you're operating in has installed their final version of the law yet).

Posted by David Buckley (Member # 2600) on 05-20-2018, 10:39 PM:

That is interesting Marcel; the GDPR is a regulation, and an EU regulation as I understand does not need to be translated into local law in the same was that a directive does.

Posted by Marcel Birgelen (Member # 6801) on 05-21-2018, 01:03 AM:

There is indeed a difference between a EU directive and regulation.

A regulation is effective and enforceable across all member states, even if the member states didn't implement local laws. It's still expected for the member states to implement relevant local laws though.

The Dutch implementation of the GDPR is known as "AVG", which is a shorthand for "Algemene Verordening Gegevensbescherming" and for example, the German implementation is called "DSGVO", which stands for Datenschutz-Grundverordnung (which indeed sounds very German [Wink]

).

The GDPR is a somewhat different beast though, while itself is a regulation, it has been agreed upon that all member countries will implement local laws and accompanying procedures, before the deadline of 25th this very month. This also includes something like a "Governmental body" per member that actively monitors the compliance of the organizations active within the member's jurisdiction and also serves as forefront for privacy issues. So, data leaks need to be reported to this body and organizations and citizens can also file complaints regarding privacy issues to this same body.

So, enforcement of the GDPR will be done on a member level, not on an EU level. Some members, like Belgium, haven't finished their implementation yet. Now, it would be interesting if they actively start to enforce Belgian companies, while their own government hasn't even sanctioned the local laws yet...