By Adam Cohen and Howard Schiffman (June 29, 2018, 2:17 PM EDT) -- On May 25, the European Union General Data Protection Regulation enforcement date passed, leaving many U.S. businesses breathless from frantic sprints to complete compliance measures in time. The GDPR, intended to harmonize data privacy laws in the EU, mandates strict requirements on anyone "collecting" or "processing" "personal data" on "data subjects" residing in the EU. Replacing the 1995 directive that was unclear as to its extraterritorial reach, the GDPR proclaims dominion over the aforementioned collecting and processing activities regardless of whether conducted or directed from inside or outside the EU. Among its key provisions, the EU generally requires informed, affirmative and specific consent by data subjects to collection and processing of their personal data, consistent with an underlying push for greater transparency in the use of personal data. Under the GDPR, data subjects have a "fundamental right" not only to know when their personal data is used and for what purpose, but to have such data erased (the so-called "right to be forgotten"), modified or transferred upon request. Furthermore, the GDPR requires that data be protected by systems designed with privacy as a key priority, with information security controls for data protection and retention policies minimizing the retention of personal data to what is reasonably necessary....