When the General Data Protection Regulation (GDPR) goes into effect on May 25th, 2018, it will undoubtedly have a massive impact on businesses in Europe. But what many people don’t realize is, it will extend well beyond the borders of the EU, since the Regulation applies to any Business with Data on EU Citizens, no matter where the Company is Headquartered.
More than 77% of U.S.-based Multi-National Companies are planning to spend more than $1 Million on Compliance efforts, including 7% planning to spend $10 million or more. Where will these Resources be spent, and will they be sufficient to avoid the Punishments for non-compliance?
The GDPR will Revolutionize how Organizations Capture, Process, and Utilize the Data they hold on their Customers.
Although the New Laws will exclusively Cover EU Citizens, their Implications will be felt much further afield. Any Business that holds Data, including IP Addresses and Online Browsing History, on an EU Citizen must be able to show where this Information Resides and that it was Captured with the Explicit Consent of the Individual in question.
The Commercial Fines for Transgression will be Severe, but the Reputational impact could be greater still. Moreover, the EU contains a number of Lucrative Markets for Global Businesses including Germany, France, and the UK. For its part, the UK will Mirror the GDPR in a New Set of Post-Brexit Regulations, so it will remain firmly under the auspices of its Rules.
Data Protection Laws are nothing new, but the context of the GDPR makes its effects unprecedented. We live in an Age of Big Data and Complex Ad Exchanges, making the Disentanglement of these Networks all the more Challenging. As a result, there is no clear Set of Steps that a Business can take to ensure GDPR Compliance.
This challenge becomes steeper still when we assess the Role of U.S.-based Multi-National Corporations. That applies not only to their Position with at least one foot outside of the EU, but also to the rather different notion of an Individual’s Privacy that exists in the U.S. “In the EU, privacy is a right; in the US, it is a commodity,” says Peter Milla, Data Protection Officer at Cint. “That makes a significant difference when it comes to GDPR compliance efforts, as the central thrust of its requirements runs contrary to the American definition of privacy.”
CLICK HERE to view the difference between the U.S. and EU Privacy differences.
This tension has surfaced before, most notably in the Legal Cases of Maximillian Schrems vs. Data Protection Commissioner. Schrems, an Austrian Lawyer, made a Complaint in 2015 to the Irish Data Protection Commissioner that the Data Captured about him by Facebook, whose European HQ is in Dublin, was not Protected sufficiently when it was transferred to the U.S., where Facebook’s Servers process Data. Schrems’ contention was overt: U.S. Data Privacy Laws cannot provide the Security that an E.U. Citizen expects and requires.
The Schrems Case precipitated the end of the Safe Harbor Agreement, which permitted the Transfer of Personal Data from the EU to the U.S. for Commercial purposes. Safe Harbor has been replaced by the EU-U.S. Privacy Shield.
However this has also been on the receiving end of a significant amount of Criticism. Earlier this year, Policy Advisor Matt Allison referred to the ideological Battle that makes the effective Implementation of any such Legislation so challenging: The EU’s Citizen-driven, regulated Model will swiftly come into conflict with the Market forces of the U.S. and the UK, and Trans-Atlantic Companies may be forced into difficult choices about which Regime best Serves their interests. Post-GDPR, that difficult choice will no longer exist, but the contrasting Theories of the Role of Privacy will not disappear so readily.
PwC reports that 32% of U.S. Businesses plan to Reduce their EU Presence as a result of the GDPR. However, 64% of Top Executives plan to create a Centralized Data Center in Europe to tackle this head on and Commit to Investing in the EU. U.S. Businesses acknowledge that GDPR Compliance will be accompanied by some Expense, but most see this as a worthwhile Investment. GDPR Compliance Budgets are tied mainly to People Costs. The Majority of GDPR-focused Budget is spent on getting the Right People in place, both Internally and Externally. This includes the Hiring of Staff, with the Role of Data Protection Officer taking on a renewed sense of significance. External Consultants are also in high demand as Businesses seek guidance on where their Data resides, where it has come from, and whether they will be found culpable after May 25.
In particular, Companies are asking these Consultants to perform Data Protection Impact Assessments (DPIAs) to test their level of preparedness. DPIAs are applied to a range of Scenarios and Technologies, from Low-Risk to High-Risk, to verify whether their Customer Data could be Breached. Coupled with the Centralization of Data Centers in the EU, this will help to mitigate many of the most common Threats to Data Security.
These Assessments should be familiar under the guise of Privacy Impact Assessments (PIAs), which have been common practice in the U.S. for some time now. While these can be an Effective and Proactive form of Defense, they need to be Embedded into the Organization if they are to be successful. It is essential to make sure that these DPIAs are accessible to a wide range of Departments within a Business, and not just the Data Privacy Specialists. Many Companies are engaging with the Marketing, IT, and Sales Departments to complete these Tests on a regular basis, with some even developing their own DPIA Software.
Technology plays a Key Role in Compliance efforts, but many larger Businesses have resolved to Build their Own Solutions rather than rely on Third-Party Vendors. This comes with the Benefit of being tailored to the Organization’s unique situation, in contrast with an Off-the-Shelf Product. Companies are, quite understandably, anxious to ensure that they do not fall foul of the New Data Privacy Laws. That eagerness can be exploited by Vendors offering a catch-all solution. However, Businesses should Resist the temptation to Invest in these Platforms unless they can provide a tangible Benefit.
The reality of the situation is that very few People are in a position to make a reliable call on whether an Organization is GDPR-ready or not, if such a concept even exists at this stage. A lot of Money will be wasted over the next Six months as increasingly worried, if well-intentioned, Business Leaders spend Money on Technology to try and guarantee that they will not be hit with a Fine.
Until further Guidance is provided, it would be more judicious to spend these Resources within the confines of what we know for sure at the moment. Compliance will come as the Result of an ongoing Process, rather than a one-off Panacea.
That applies equally to first- and third-party Data. It is for this reason that many U.S. Businesses are investing in trying to identify the Steps in the convoluted Data Supply Chains that underpin so much of the Digital Economy. The GDPR references ‘Data Processors’ and ‘Data Controllers’, with both Roles bringing their own set of Responsibilities. U.S.-based Multi-Nationals are keen to Identify not only where their Organization qualifies as a Data Controller, but also which Individuals within the Business will take on this Role.
The Third Parties that process this Data are not exempt from the GDPR. As a result, large Businesses are at pains to understand the extent to which their Vendors are also Compliant with GDPR stipulations. That takes a significant amount of Time and Internal Resource, which comes at a Price.
Another reason Companies have set aside sizable sums that run into Seven or Eight figures is that securing these Resources at the last minute would be nigh-on impossible. Bearing in mind that there is no Blueprint for GDPR Compliance and the Deadline is closing in, allowing some room for error is a prudent approach.
The potential Fines of $22 Million Dollars or 4% of Annual Global Turnover, whichever is Greater, have made the headlines, but they are not the Real Story.
Ultimately, the GDPR aims to protect EU citizens from data breaches. The Equifax data breach is just one recent example of how damaging these lapses of security can be, with customers the only real victims.
It is worth remembering that the first Fine doled out as a result of the 1995 Data Protection Directive did not arrive for more than a Decade. That is not to play down the threat of a Fine. EU Citizens will be entitled to Ask to See and Delete their Data, a right that many will exercise. The EU will likely appoint a Specific Ombudsperson to manage GDPR-related Complaints and they will investigate any Claims they receive. It is very conceivable that the EU would make an example of a High-Profile Company by doling out a large Fine, if they have blatantly Transgressed the GDPR for Commercial Gain.
However, U.S. Businesses should focus less on these Threats and more on the opportunities that the GDPR brings. Given its inevitability, this seems a Healthy Mentality to adopt. The GDPR will usher in a New Era of Privacy awareness and will open the door for Organizations to Implement much-needed Reforms. For those that have long wanted to see a more responsible approach to Capturing and Storing Sensitive Data, now is the perfect time to make that case.
NYC Wins When Everyone Can Vote! Michael H. Drucker
