GDPR takes effect across the European Union

European data protection had been governed since 1995 by a directive, which each member state wrote into its own law in its own way. Companies dealt with 28 versions of the same idea. The General Data Protection Regulation, adopted by the European Parliament and Council on 14 April 2016, replaced that patchwork with a single text applying directly in every member state. Governments and companies were given two years to prepare; the text became applicable on 25 May 2018.

The regulation works by requiring a reason. Personal data may be processed only on a lawful basis, of which consent is one and legitimate interest another, and the basis has to be identified before the processing starts. People gained rights to see what is held about them, to correct it, and to have it erased. Serious breaches have to be reported to a supervisory authority, generally within 72 hours. Fines run to 4% of a company’s worldwide annual revenue or 20 million euros, whichever is greater, which is what made the rest of it worth reading.

For a record of artificial intelligence the consequence is upstream of any model. Systems are trained on collected data, and the regulation governs the collecting: what may be gathered, on what basis, for how long, and for which stated purpose. Reusing a dataset assembled for one purpose to train a system for another became a legal question in Europe rather than an engineering one. The date also mattered for its neighbors. The text was written long before the Cambridge Analytica reporting of that March, but it arrived ten weeks after it, and was read in that light in Brussels and Washington alike. Other jurisdictions, from Brazil to California, drafted their own versions in the years that followed, and companies outside Europe generally found it cheaper to apply one standard everywhere.