GDPR

The GDPR is the rule everyone claims to know and almost nobody reads past consent. I’m interested in the rest: recital 71, the DPIA that is written rather than filled in, the legal basis decided before the column exists in the database. Eight years on it is still the backbone of the entire European package, and the Digital Omnibus that retouches it is not an amnesty. I write from the side of those who have to design, with public administration and healthcare clients who cannot afford to get it wrong.