American Club Circular No. 09 /18 1 FEBRUARY 23, 2018 CIRCULAR NO. 09/18 TO MEMBERS OF THE ASSOCIATION Dear Member: IMPLEMENTATION OF THE EU GENERAL DATA PROTECTION REGULATION 2016/679 – GENERAL GUIDANCE TO MEMBERS Introduction Regulation (EU) 2016/679 containing the General Data Protection Regulation (the GDPR or Regulation) will come into force on 25 May 2018 when it will have direct effect in the EU/EEA 1 . The Regulation, which is some 88 pages long, may be found at: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=en This general guidance intends only to provide a brief introduction to the GDPR, as relevant to the American Club and its Members. The impact of the Regulation will most often be felt in claims relating to personal injury and illness or other cases involving data originating from natural persons, or individuals. Data originating from a legal entity that does not contain personal information, or information otherwise not related to natural persons, is unaffected. The broad intention of the Regulation is to replace Directive 95/46/EC and strengthen and harmonize EU/EEA procedures concerning the collection, storage, processing, access, use, transfer and erasure of personal data. By establishing responsibilities for "controllers" and "processors" of personal data, the Regulation aims to provide natural persons with the same level of legally enforceable rights throughout the EU/EEA, and a supervisory and enforcement framework to ensure compliance. The aim of the GDPR is to protect natural persons in relation to the processing of data. The Regulation applies to those within the EU/EEA which may hold such data, but also to those outside the EU/EEA which may offer goods or services to natural persons within that area, or send personal data to organizations within the EU/EEA, or send personal data to recipients within the EU/EEA. Because the American Club operates within the EU/EEA, the GDPR will apply to it. Similarly, the Regulation will apply to Members, and third-party service providers operating within the EU/EEA, or offering goods or services to natural persons within that area. Penalties for infringement The level of administrative fines under the new regime is substantially higher than under the old legislation. The amount of a fine will depend on a number of factors in each individual case, including, but not limited to, the nature and duration of the infringement, and any actions taken to mitigate damage suffered by the data subject (see definition below). It is, however, worth noting that 1 The EU/EEA means in this context The European Economic Area (EEA) which unites the EU Member States and the three EFTA States (Iceland, Liechtenstein, and Norway). American Club Circular No. 09 /1 8 2 the penalties for infringements of the GDPR, in relation to certain provisions, can be up to €20 million or, in the case of an undertaking, up to 4% of the worldwide annual turnover of the preceding financial year, whichever is higher. Relevant definitions 2  "Personal Data" means any information relating to a Data Subject;  "Data Subject" means an identified or identifiable living natural person or individual. This is someone who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of tha