Sample Solution

The European Union’s General Data Protection Regulation (GDPR), effective May 25, 2018, is the most recent piece of legislation that aims to regulate the massive influx of personal data being processed by entities around the world. According to the European Parliament, the protection of persons in the processing of their data is a fundamental right. The GDPR, through its 173 recitals which cover forty-five specific regulations on data processing, forty-three conditions of applicability, thirty-five bureaucratic obligations for EU member states, and seventeen enumerated rights, aims to protect this fundamental right to data protection. The European Commission states that the purpose of the legislation is to give consumers more control of their data and to make business “benefit from a level playing field.”

In the U.S., many popular media outlets have praised the GDPR, and Senators Edward Markey, Dick Durbin, Richard Blumenthal, and Bernie Sanders have called on U.S. companies to voluntarily adopt its provisions. In fact, a growing number of senators want to require some of the provisions. However, a closer look at the GDPR evidences various pitfalls that create serious consequences for consumers all around the world. This note provides a detailed look into the elements of the GDPR, reviews its effects considering U.S laws and policy, urges restraint about adopting GDPR-style measures, and highlights the need for careful attention in formulating any new data protection legislation.