Welcome back to the podcast, bribe, swindle, or steel.

I'm Alexandra Rogge, and today we're talking about the European Union's general data

protection regulation, or GDPR as it relates to conducting meaningful, consistent due diligence

on third parties in the European Union.

A lot has been said about the GDPR more generally, so we're going to focus on this fairly narrow

but incredibly important aspect of the new regulation.

My guest today is a colleague at Trace.

Ilya Antonenko is Privacy Council at Trace, and prior to joining us here, he had substantial compliance

experience both in-house and with a law firm, but he's been focused pretty single-mindedly on

this issue since he joined Trace. I know you've barely had time to catch your breath from the

Luge ride that led up to May 25th, so thank you for joining me today. You're welcome. It's my pleasure.

Can you start by describing the nature of the conflict between GDPR and due diligence?

I think everybody has heard a great deal about GDPR more generally.

But what is the conflict that we're addressing here?

First, there's a general tension between these two worthy causes.

One is trying to bring transparency to expose nefarious conduct. The other is generally trying to

give control to individuals over their personal data, minimize the processing. So there's a general tension. When we looked at GDPR in detail,

we found that it's not just the tension, that there's actual conflict. And specifically in Article 10

of the GDPR, it says that the controllers cannot process personal criminal convictions data or data related to

criminal offenses unless they are doing so under the control of official authority or when

the processing is authorized by union or member state law. And when we started this process, we looked around and we found that there's no such EU-wide law that would authorize, trace, or any other controller, to look into individuals' criminal background information for purposes of anti-bribery due diligence.

There's a lot to unpack there. Let's start with the big point that you opened with, which I think is

...