The GDPR as a paradigm shift in corporate management
Dr. Dimitrios Karathanassis
In: ContraLegem 2021/1, S. 72ff.
- The GDPR as a new approach to data protection
- The GDPR requires major and far-reaching changes for companies. These changes go beyond data protection and affect the structures of companies and the way they operate.
After the new EU Data Protection Regulation (GDPR) came into force on 25 May 2018 , the first conclusions can now be drawn about the importance of this set of rules for (Swiss) companies two years later. Although an EU set of rules, the GDPR has undoubtedly caused additional costs for many Swiss companies, from clarifying individual issues to revising data protection declarations. However , it is already foreseeable after two years that the GDPR will increasingly lead to a paradigm shift in corporate management and corporate organization, and not only in terms of on data protection, but much more profoundly.
Data protection in the context of compliance
Today , data protection still falls primarily into the area of compliance, namely compliance understood as a collective term for all organizational measures and internal processes in a company for Prevention of legal violations and adequate response to them. In this sense, the focus of data protection for companies is on the task of maintaining the applicable data protection regulations and avoiding possible legal violations. In order to achieve this, various means are available, such as the collection of the legal basis, the appointment of a company data protection officer, the enactment of internal Instructions, the collection of data files including conformity assessment, the guarantee of data security and the training of employees. What all these measures have in common is that they represent preventive mechanisms that essentially seek to avoid violating data protection regulations. Ideally, they create a coherent internal set of rules that reflects the existing legal standards – often even exceeds them aggravating them – and thus for each individual Business conduct and transaction of the company concerned ensures that they comply with the law.
One could now be led by the assumption that the GDPR will only make additional efforts and burden the compliance departments of the companies concerned . That this is already the case and will continue to be the case is self-explanatory, because any additional legal requirement requires technical know-how and resources in order to be able to implement it in the end. . The GDPR is no exception.
However, although the GDPR enjoys a legal character, it mixes normative and regulatory elements. Normative elements, i.e. laws, – as postulated in the present case – classically provide a framework within which one acts in accordance with the law and outside which one no longer does. does. Regulation, on the other hand, goes further and requires certain behaviours and the implementation of concrete measures. The Federal Act on Data Protection (FADP) – prior to its current revision – must be understood primarily as a normative element which, since its entry into force in July 1993, has basically is a legally binding framework.
The GDPR, on the other hand, is a child of its time, in which the boundary between normative and regulatory elements is disappearing. In other words, it not only presents the companies concerned with a framework within which they can move in accordance with the law, but also explicitly provides instructions for certain types of behaviour and specific measures for undertakings. The GDPR can therefore be understood as a regulatory law. It can therefore be assumed that the GDPR will initiate the changes for data protection that the establishment of the Swiss Financial Market Supervisory Authority (FINMA) provided for financial institutions.
Impact of data protection on corporate structures
It goes without saying that general regulations – in addition to normative requirements – in the financial market sector already existed before 2009, but after the start of its activities, FINMA quickly developed into a comprehensive «Regulation factory». On the basis of its statutory mandate, it has issued and continues to issue supervisory notices, circulars, opinions and other publications, often without conclusive certainty for the Addressees, what normative significance these have, and thus exercises the regulation. The increasingly concrete instructions for certain behaviours and the measures to be taken slowly led to the fact that strategic corporate decisions were not only taken with regard to the normative Increasingly , and in some cases exclusively, they are viewed through the lens of regulatory requirements.
It makes a considerable difference whether financial intermediaries are required by the legislature, when entering into business relationships, to inform the contracting party on the basis of an evidentiary document [to ] (Art. 3 para. 1 Anti-Money Laundering Act, AMLA) or whether they are required by FINMA to develop criteria that indicate business relationships with increased risks (Art. 13 para. 1 Anti-Money Laundering Ordinance-FINMA, AMLO-FINMA) as well as criteria for identifying transactions with increased risks (Art. 14 para. 1 AMLO-FINMA) and not only the criteria (Art. 14 para. 2 AMLO-FINMA ) but also the means of clarification (Art . 16 AMLO-FINMA) and the timing of the clarification (Art. 17 AMLO-FINMA). In other words, it makes a difference whether it is forbidden to encourage money laundering or whether, in order to achieve this objective, financial intermediaries make a meticulous Catalogue of actions to be carried out.
In conjunction with the increasingly severe penalties that punish violations, compliance with regulatory requirements by companies‘ legal and compliance departments has become more and more important. Foreground in strategic fundamental decisions. There have been questions about the countries in which investments are made and the origin of funds that are accepted and forwarded, but the regulatory costs and the The impending penalties, which are now attached to these questions, gives them a very relevant, often even existential, significance for the business activities of financial intermediaries.
In this sense, regulation goes beyond the legal framework, because it does not simply qualify individual actions of companies as legally compliant or violating it, but rather indirectly ( and sometimes even indirectly) determines the structures and functioning of those undertakings, in which it requires concrete measures to be implemented. A compliance department of a bank from the year 2020 is likely to have caused incomprehension among many banks in 1990.
As a result, (extensive) regulation goes beyond behavioral control and must therefore be understood as structural design. This means that now not only 74 the individual company actions, but also the structure of the company – beyond the company law provisions – as such must comply with and comply with regulatory requirements . The companies concerned thus implement regulatory requirements not only in the individual business activities or transactions, but also through a (sometimes fundamental) redesign of their structures. . Regulation and compliance with it are therefore not only “ a binding component of a good corporate organization“, but to a large extent specify the corporate organization itself.
A similar development is likely to occur now after the entry into force of the GDPR . The manifold obligations that the GDPR imposes on companies elevate data protection from the compliance department to the highest decision-making bodies of companies. The processing of personal data and the requirements of the GDPR are now linked to strategic questions, such as where a company invests or which lines of business it pursues Wants. As G. V. Müller already correctly noted in 2018 („Data protection means protection of privacy“, NZZ of 25. January 2018), data protection , similar to compliance with FINMA’s regulatory requirements or compliance with environmental standards, will become an essential component of risk management by Company. The processing of personal data will therefore play an increasingly central role when it comes to business decisions. The data protection impact assessment provided for in Art. 35 GDPR makes e.g . It is clear that future issues and the delegation of responsibility must be taken into account in business decisions. The data protection by design and data protection by default required in Art. 25 GDPR in turn require measures that massively affect internal corporate structures and programs used. and give them a form that complies with the provisions of the GDPR. The appointment of a processor is not only shaped by Art. 28 para. 3 GDPR, in which the relevant contract contents are determined, not only characterize the contract design affected by it, but also for the most part. What an initial and probably rudimentary action plan for companies can look like is described by the Conference of Independent Data Protection Authorities of the Federal Government and the Länder in Germany in its Short Paper No. 8 Action Plan “ GDPR“ for companies. It proposes measures such as the adaptation of the affected processes and structures, the determination of the legal basis and the purpose of data processing as well as the documentation of balancing of interests, which Implementation of information obligations, data subject rights and deletion concepts, adaptation of the data protection organization, appointment of a data protection officer, reaction mechanisms to data breaches , organization of Reporting obligations, the adaptation of service relationships, the development of documentation, the adaptation of IT security and the adaptation of works agreements.
75This list gives a first indication of the challenges that the companies concerned will face. The extent of the innovations cannot be conclusively estimated at present, but the scope of the GDPR, in its German version at least 78 pages long, can serve as a first indicator. These are not only costly, but also indirectly interfere with the primary business interests of those affected. If one also includes the reversal of the burden of proof, which is anchored in Art. 5 para. 2 GDPR and according to which there is now an accountability of the person responsible, „according to which he ensures compliance with the general principles (cf. Art. 5 para. 2 GDPR) „, it becomes clear that an adaptation of corporate structures will be unavoidable in order to meet these requirements. are sufficient.
As G. V. Müller rightly points out, the pharmaceutical and financial sectors, in which this change has already been introduced, are most likely to be prepared for this development. The main reason for this is the fact that the processing of personal data is increasingly being incorporated into the business processes of companies in these industries. Pharmaceutical companies, as well as banks, base a large part of their business on personal data and the possible handling of this is more a question of strategic orientation. of these companies as the mere compliance with data protection regulations. However , precisely because data, and especially personal data, is the „raw material of the future“, more and more companies from various industries are becoming more and more affected by the GDPR and others. Data protection legislation may be affected. Dealing with this will shape companies in a similar way to dealing with the original raw materials of market-based activity, labour and capital. If personal data is understood as valuable resources, compliance with its legal protection regulations is essential and has a direct effect on the handling and ultimately on the value of these resources. The GDPR, which is deeply intervening in regulatory terms, specifies the first structures that the companies concerned must incorporate in order to facilitate the entrepreneurial handling of to successfully manage these resources. The fact that the GDPR is not territorially limited and is mandatory for every participant in the European internal market also gives it a high degree of economic significance. .
The GDPR, that is undisputed, strengthens the protection of personal data. At the same time, however, it poses enormous challenges for the companies affected. The victims of the adjustments in business processes and corporate structures caused by the GDPR are then also the SMEs, which find it difficult to cope with the costs of these implementations. And that is what we are talking The advantages of a single European market with free access to it are clouded for SMEs by the GDPR. While the large corporations are more likely to cope with these adjustments and rely on the help of lawyers and consulting firms, SMEs are faced with the question of economic viability. Not infrequently, the European sales market is now likely to lose its attractiveness. The field, it must be said so clearly, is left to the big ones. The parallels to anti-money laundering legislation, which, through its regulatory requirements, have created many markets for small and medium-sized banks based purely on regulatory requirements . It is obvious that this has made economic reasons unattractive. Originally noble intentions, namely transparency and data protection, unintentionally alter into a competitive advantage for market- and financially strong companies.
Finally, it can be stated that data protection, as before also the money laundering regulations , as originally designed behavioral controls creep up to the core of the 76 economy and thus indirectly also endanger a liberal and non-competitive economy because they affect the multitude of corporate law structures. The differences in corporate law between a corporation and a partnership are becoming less important in view of the regulatory requirements that apply equally to all . Whether all this is in the sense of the inventor, of course, remains to be seen. No one doubts that the fight against money laundering and compliance with data protection are essential, but in the way in which these issues are addressed, the individual side effects cannot be ignored . Consumers are not served if their data can be kept secure, but only by a few companies with market power. In any case, the disadvantages of the then shrinking liberal competition cannot be corrected by data protection legislation designed in this way.
