EU Data Protection Regulation and How It Affects Arbitration and ADR-ODR

Résumé

On May 2018 a European Regulation, with direct force to all European Members, was in action. The General Data Protection Regulation, EU2016/679. A severe Regulation that was published in 2016 and set a 2-year period of time for all the Member States to be adjusted. This text, that implies huge fines for noncompliance, also affects the ADR mechanisms, like Arbitration, Mediation, etc. There is a paramount importance Principle of accountability, that GDPR implies, which requires data controllers to take personal responsibility for data protection compliance and record the measures they take to comply with their data protection obligations. Even almost 3 years have passed, the issues still remain: How is the interaction between ADR and GDPR? Which are the roles of the actors of alternative dispute resolution methods, and due to these roles which are the responsibilities? What is considered a lawful process, in accordance with GDPR, during the procedure of an ADR mechanism?
It is also paramount to take into consideration, that the scope of that European Regulation affects directly even actors of non-EU territory, according to article 3.2 & 3 GDPR: 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: - the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the
Union; or – the monitoring of their behavior as far as their behavior takes place within the Union. 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.