The EU/UK GDPR (universally accepted throughout the world as the gold standard for data protection and privacy) demands a lot more than many US companies realize
It may sound like an exaggeration but itÕs a fact: no company can handle GDPR compliance without specialist assistance. The biggest legislation ever introduced by the EU leaves no room for error. YouÕre either compliant. Or youÕre not. And noncompliance can be a business-ending event.
In this third installment of our series on global payroll management, the turn has come to the gold standard for data protection and privacy. Any company that processes the personal information or ÒdataÓ of EU residents must adhere to the General Data Protection Regulation (GDPR) whether the company maintains a physical presence in the EU or not.
(Note: In the UK, the GDPR is retained in domestic law as the UK GDPR, but the UK has the independence to keep the framework under review. It is, however, very likely that the UK GDPR will always be maintained as virtually identical to the EU GDPR. The comments in this blog about the EU GDPR have equal application to the UK GDPR and are collectively referred to here as the ÒGDPRÓ. ).
GDPR payroll compliance Ñ what does it take?
Payroll management, by design, requires the collection of personal data. In other words, if the employee, or data subject, resides in the EU or UK, GDPR applies. This, of course, is hardly news to global organizations. But US companies are often still taken by surprise by the extent and complexity of the regulatory framework and the amount of work required to comply. Unfortunately, all too often companies think they are compliant when they are really not.
A new focus on data protection
When the EU passed GDPR into law effective May 25, 2018, it set a new standard for data protection that is now being emulated across the world. Although most EU members gave companies an informal grace period (Germany being the notable exception and indeed a German regulator imposed the first EU-wide penalty for noncompliance with the GDPR within weeks of its introduction!) as they worked to achieve compliance, the new legislation ushered in a new era of strict enforcement. No excuse is good enough to escape the reach of the law. Nor can companies blame faraway headquarters; EU/UK regulatory authorities have the power to pursue any organization anywhere in the world for breaches of the GDPR.
For US companies expanding into Europe, GDPR compliance is an undeniable challenge. Aside from the California Consumer Privacy Protection Act, as now amended by the California Privacy Rights Act effective 2023 (CCPA/CPRA), data privacy protections in the United States have historically been less stringent. American companies, therefore, tend to lack both the background knowledge and organization to effectively untangle GDPR requirements. They need outside expertise to ensure they get every detail right. Going it alone is a risk no company should take. (Read more: Global Expansion Strategy: The Risks of Going it Alone)
GDPR compliance basics
The GDPR was created to ensure that organizations have sufficient technology, processes, and organization in place (often referred to as ÒTOMSÓ) to protect the personal data and privacy of EU/UK residents. The framework, spelled out in detail across 88 pages, requires organizations to prepare, implement, and comply with a litany of written external and internal data privacy policies and other requirements.
To take just a few examples of documents that cannot be ignored:
- External Privacy Statement: Drafted in full conformity with the requirements of the GDPR, this policy must be accessible to customers, suppliers, and the public at large on your company website.
- Internal Data Privacy Policy: Also known as a Data Protection Policy and available at any time to an organisationÕs employees and other staff, it must identify how your organization protects personal data. The detailed requirements of an internal privacy policy need to be Òproportionate to your processing activities.Ó But how would you know when your company crosses that threshold? The vague language demands careful assessment of the scope, context, and purpose of the data processing that is taking place.
- Data Retention Policy: This important but highly complex policy sets out the principles for how personal data will be retained and how it will be disposed when no longer of use. Recital 39 of GDPR establishes that data should not be retained for longer than is strictly necessary. But what does this actually mean? In practice, there will be a plethora of other relevant laws and regulations that apply. For example, it will be necessary to retain data relating to salary and tax payments for many years whereas other data may have a more limited storage life. This is a complex area.
- Fair Processing Notice (FPN): Each employee must be served a Fair Processing Notice, a lengthy document that details the types of personal information that the employer needs and for what purpose the data will be collected. The employer also needs to demonstrate the data is protected from both a technological and organizational standpoint. If the data will be sent out of the EU/UK, the employee must be informed where the processing will take place (this requirement alone is extremely involved).
Mistakes are easy to make
An email that is accidentally sent to the wrong address. An email chain with attachments that shouldnÕt be there. Another email chain with a growing list of recipients that suddenly have access to sensitive data further down the thread. A missing policy document. An overlooked clause. (Read more: Using Email to Manage Global Payroll? DonÕt.)
There are an infinite number of ways to be noncompliant. Considering the volumes of personal data involved in payroll processing, the risks cannot be overstated. Although many incidents tend to be honest mistakes, the regulatory authorities will not see it that way. Violators of GDPR may be fined up to 4 percent of annual global revenue or up to 20 million euros, whichever is greater.
In 2022, Facebook owner Meta Platforms paid 80% of the total fines Ñ Û830 million ($881 million) Ñ levied for GDPR breaches. But itÕs not only corporate giants that have to pay up. Each month, European authorities issue 25 to 60 fines, according to an enforcement tracker. Since the GDPR was passed, companies have, to date, been fined nearly Û2.8 billion ($3 billion). Among them are smaller companies like a tax company that had to pay $245,000 for sending unsolicited marketing text messages and an interior design firm that received a $196,000 fine for making unsolicited calls to people registered on the UKÕs Do Not Call list.
The risk of the disgruntled employee
Research shows employee mistakes are, by far, the leading cause of data breaches. But employees, especially disgruntled ones, also pose a risk to companies that unknowingly have GDPR compliance gaps. The fact is employees initiate a majority of all complaints to data regulatory authorities in the EU/UK. Every complaint can automatically trigger an investigation. Whether the issue is major or seemingly insignificant, you can assume investigators will quickly discover whether youÕre in violation or not.
In one of the first cases in Germany, a well-known company that had devoted over a year to prepare thoroughly for the GDPR was fined for non-compliance. Authorities applauded the companyÕs effort, yet it wasnÕt enough. Again, it serves as a reminder thereÕs no such thing as partial compliance.
Although becoming GDPR compliant requires substantial work and resourcesÑ you simply cannot leave anything to chance Ñ the good news is you will not need to repeat the most grueling part of the process for many years to come. GDPR is here to stay! Once you have the fundamentals in place, the upkeep requires far less investment.
HSP Group Can Help
HSP Group specializes in helping companies just like yours expand with ease. Whether you need a GDPR checkup or our full suite of people and entity services, we tailor our engagement to your needs. We combine an unparalleled focus on the client experience with GateWay, our pioneering global expansion management platform which comes with GDPR compliance and secure communication built in.
About the author: Paul Sutton is an HSP General Counsel and one of the most experienced data privacy lawyers in the UK. He has advised on data protection requirements and compliance in around 140 countries. Contact Paul at psutton@hsp.com.
Read more:
The global payroll challenge no company should have to face
Why data privacy compliance is so crucial to international success?
Watch: Why every business should care about data privacy laws
