Introduction

‍Since its inception in 2018, the General Data Protection Regulation (GDPR) has not only reshaped data privacy in the European Union but has also had a profound impact on global privacy laws. As an information security and privacy enthusiast, I will delve into the pre-GDPR privacy landscape, what became obsolete with the GDPR, and how it has i

‍Before the GDPR, data privacy laws varied significantly across countries. Some notable pre-GDPR laws include:

• The EU Data Protection Directive (1995, EU): This was the GDPR's precursor in the EU, focusing on data protection but lacking the enforceability of the GDPR.

• The Privacy Act (1988, Australia): Focused on data protection but less comprehensive in scope compared to GDPR.

• The Personal Information Protection and Electronic Documents Act (PIPEDA, 2000, Canada): Set the groundwork for data protection, emphasizing consent and reasonable purpose.

• U.S. federal laws based on industry sector: HIPAA (healthcare), GLBA (financial services), CAN-SPAM (marketing), FCRA (credit reporting), COPPA (children), The U.S. Privacy Act of 1974 (applies to federal government systems)

• U.S. State privacy laws, like CalOPPA (CA law that required online privacy notices), Illinois BIPA (biometric privacy), and many others

‍What Became Obsolete with GDPR

‍The introduction of GDPR rendered several aspects of previous data protection frameworks outdated:

• Limited Territorial Scope: Unlike GDPR, earlier laws often had limited territorial reach.

• Less Stringent Enforcement Mechanisms: GDPR’s heavy fines and strict enforcement mechanisms were a significant upgrade.

• Narrower Definitions of Personal Data: GDPR broadened the definition of personal data to be anything linked or linkable to a person including online identifiers like IP addresses.