Scope and main features

The new General Data Protection  Regulation - as opposed to its predecessor, the Data Protection Directive (Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data), which is actually in force till the 24th May 2018, has to be applied not only by companies and other organisation in the European Union but also by a controller or a processor not established in the Union processing of personal data of data subjects who are in the Union. Recital 23 explains a little more: The mere accessibility of a website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. The GDPS is a "text with EEA relevance", i.e. it is also applicable to controllers processing personal data of persons residing in countries who are members of the European Economic Area but not members of the EU (Norway, Iceland, Liechtenstein). Switzerland has its own data protection law and is recognised as providing equivalent protection of personal data (in the part about transfer of data to third countries I will talk about this in more detail).
The GDPR does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity, to the processing of personal data in the framework of the so-called "second and third pillars" (the pillars were abolished in the Lisbon treaty), i.e. the foreign and security policy and the area of police cooperation, prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, public security. Personal data in the framework of the latter activities is subject to the Directive (EU) 2016/680 of the European Parliament and of the Council - a directive which has to be transposed into national law by national legislation where the legislators have more manoeuvring space than in the case of a regulation. The GDPR also defines some areas where member states can legislate, mainly in the area of public authorities and they have the right to lower the age limit (actually 16 years) under which a child has special rights, but not lower than 13 years.
The definition of personal data and the main principles and conditions of lawfulness of data processing did not change. The different actors did not change either (except the status of the former "Article 29 working party" which becomes the European Data Protection Board - which has a special role in cross-boarder cases). The controller is still the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data while the processor processes personal data on behalf of the controller and shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law. This clause is actually taken over from the directive but is preceded in the new regulation by a series of specific rules about what the controller has to define for the processor. A not so small change is that the processor can be instructed directly be the data protection authority.
The lawfulness of processing is so impertant that it is worth quoting here directly the relevant paragraph of the GDPR:

(a)

the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b)	processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c)	processing is necessary for compliance with a legal obligation to which the controller is subject;

(d)	processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e)	processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f)

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

As it can be seen, consent of the data subject (which is actually one of the subjects where specific rules apply for children) is one but not the only basis of processing, there may be other grounds which do not require the consent of the data subject.

Still it is important that the GDPR clarified the conditions of consent (which had to be freely given specific and informed in the directive also). It has to be freely given, specific, informed and unambiguous.  A specific article (Article 7) specifies the conditions:

• the controller has to be able to demonstrate that the data subject has given consent
• if it is given in the context of a written declaration which also concerns other matters, it has to be clearly distinguishable from them and should be in an intelligible and easily accessible form, using clear and plain language
• the conditions should be taken into account when deciding whether consent was freely given.

Consent can be withdrawn at any time - with effect to the time of withdrawal, i.e. processing of data till then remains legitimate.