General Data Protection Regulation: Comparison of the legal grounds for the processing of personal data, with a focus on eCommerce

By 2018 it is certain that all businesses will be expected to implement the new rules on personal data protection; this includes online retailers. The EU Commission spoke in its most recent press release about a general SME exemption from the obligation to implement some of the rules, but this, of course, is unlikely to be the case for eCommerce or online marketing due to the broad definitions used for “data subject” and the extent of data processing in such companies, which risks triggering many, sometimes new, obligations (i. e. collecting consent, impact assessment, data protection officer).