GDPR

Patent Monetize > GDPR

What is GDPR?

GDPR is a privacy and data protection law that regulates how European Union residents’ data is protected by companies and enhances the control EU residents have over data they share on any platform. GDPR applies to any globally operating company that may be accessible to European businesses or citizens of the European Union, directly or indirectly. Client data shared on our platform is important regardless of where the Client is based, which is why, as a responsible platform, we have implemented GDPR controls as our baseline standard across all our operations globally. GDPR took effect on May 25, 2018.

Does the GDPR apply to me?

GDPR is the current data protection legislation governing the European Union, having replaced the 1995 EU Data Protection Directive when it took effect in 2018. Its territorial scope is broad: it applies not only to entities within the EU, but also to non-EU businesses that a) market their products to people in the EU, or b) monitor the behaviour of people in the EU. In other words, even if you’re based outside the EU, if you control or process the data of EU citizens, GDPR applies to you. In keeping with our ongoing commitment to privacy and security, Patent Monetize is committed to making it easier for you to comply with the GDPR.

What are the main responsibilities under GDPR?

GDPR requires that personal data be:

  • Processed lawfully, fairly, and in a transparent manner
  • Collected for specified, explicit, and legitimate purposes, and not further processed in a manner incompatible with those purposes
  • Adequate, relevant, and limited to what is necessary for achieving those purposes
  • Accurate and kept up to date
  • Stored no longer than necessary to achieve the purposes for which it was collected
  • Properly secured against accidental loss, destruction, or damage

GDPR also places additional obligations on companies to document their processing activities and demonstrate compliance with the above principles. It codifies the requirement that companies apply data protection by design and by default when developing processes, products, and systems. If a company uses solution providers to process personal data on its behalf, it must ensure an appropriate contract is in place obligating those providers to apply GDPR’s data processing standards. Similarly, if a company transfers EU personal data outside the EU, it may only do so to a country the European Commission deems to have adequate data protection standards. For transfers to countries not deemed adequate, appropriate alternative safeguards must be in place. Currently, approved transfer mechanisms include the EU-U.S. Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs).

What is the definition of “personal data” under the GDPR?

Personal data means data that relates to an identified or identifiable natural person (a “data subject”). An identifiable data subject is someone who can be identified, directly or indirectly, by reference to an identifier such as a name, email address, phone number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person. This is a broad definition and can encompass data such as a user’s IP address, device ID, or phone number. It doesn’t matter that an identifier could change (for example, a user changing their phone number or device ID) — what matters is that the information can be used to “pick that user out of the crowd,” even without knowing exactly who they are. The definition of personal data is also not tied to identity-theft risk the way personally identifiable information (PII) is defined under many US data breach laws — so even if there seems to be little privacy harm in someone obtaining a user’s IP address, that doesn’t mean the IP address isn’t personal data.

Who is the Controller and who is the Processor in Patent Monetize’s relationship with a Client?

Unless explicitly clarified in an agreement, Patent Monetize acts as the Processor and the Client/User acts as the Controller for the specific data processed on the Client’s behalf and instructions.

What are the key changes from the previous regulations?

GDPR introduced new and enhanced rights for data subjects, giving individuals greater authority over their personal data. Key rights include:

  • Explicit consent — Data subjects must be informed about how their personal data will be processed. Organizations must make it as easy for data subjects to withdraw consent as it was to give it.
  • Right to access — At any time, a data subject can ask the Processor what personal data is being stored or retained about them.
  • Right to be forgotten — A data subject can request that the Processor remove their personal information from its systems.
  • Obligations of processors — GDPR raised the bar for the responsibilities and liabilities of data processors. Processors must be able to demonstrate compliance with GDPR and must follow the data controller’s instructions.
  • Data Protection Officer — Organizations may need to appoint a staff member or external provider responsible for overseeing GDPR compliance, general privacy management, and data protection practices.
  • Privacy Impact Assessments (PIA) — Organizations must conduct privacy impact assessments for large-scale data processing, to minimize risk and identify mitigating measures.
  • Breach notification — Controllers must notify the relevant supervisory authority, and where applicable, affected data subjects, within 72 hours of becoming aware of a breach.
  • Data portability — The Processor must be able to provide data subjects with a copy of their personal data in a machine-readable format, and, where possible, transfer that data to another controller.

What steps has the Company taken to become GDPR-compliant?

We have covered significant ground in understanding and analyzing how GDPR affects our Clients, and in making corresponding changes to our products and processes:

  • We have raised awareness across the organization through internal discussions and trained employees to handle data appropriately, so they understand the importance of information security and GDPR’s standards.
  • We have individually assessed all our products against GDPR’s requirements and implemented features that give you more control over your data and ease GDPR compliance.
  • We have appointed a designated Data Protection Officer to oversee data protection and privacy matters.
  • Our application teams have embraced privacy by design, giving you greater control over the data stored in our systems, with further enhancements planned in phases.
  • We have conducted internal audits of our products, processes, operations, and management, and worked with our teams to resolve identified issues.
  • Based on our privacy impact assessments and internal audits, we have improved our data security methods and processes, including encrypting data at rest based on its sensitivity and risk level.
  • We have cleaned up our databases to retain only the latest and most accurate information, including removing terminated and dormant accounts in accordance with our Terms and Conditions.
  • Clients will be notified of a breach without undue delay, and within the timeframe required under applicable data protection law, via their designated dashboard.
  • Clients will be notified of a breach within 72 hours of the Company becoming aware of it. For general incidents, we will notify users via our website or the Client dashboard; for incidents specific to an individual user or organization, we will notify the affected party by email (to their primary email address).
  • We have revised our Privacy Policy to incorporate the requirements of applicable privacy laws, based on our data inventory, data flows, and data handling practices.

GDPR Rights

  • Access to personal data: Under GDPR, data subjects have the right to access their personal data. You can submit a request and we will provide the data we hold about you.
  • Correct data: If you believe your personal data is incorrect, you can submit a request specifying the data to be corrected. We will process the necessary changes, or notify the relevant data controller if you are not yet our Client.
  • Restrict processing: You can request restriction of the processing of your personal data by emailing support@patentmonetize.com.
  • Delete or object to processing: We respect requests to delete personal data or to object to its processing. Deletion requests are handled by removing your personal data from our platform within 30 days; objection requests are handled by ceasing the specific processing activity you’ve objected to, in accordance with GDPR.
  • Transfer data: Under GDPR, if you need to transfer your data to another processor or controller, we can provide you with a copy of the personal data we hold.
  • International data transfers: If you have questions about the transfer of data between the EU, Switzerland, and the US  including under the EU-U.S. Data Privacy Framework or Swiss-U.S. Data Privacy Framework, please email us and we will respond in a timely manner.

Contact Us

Please feel free to ask questions or share concerns with us at support@patentmonetize.com.