Technology & Innovation

The global implications of the EU General Data Protection Regulation

December 12, 2016

Europe

December 12, 2016

Europe
Philip Marshall

Director

As Cryptzone’s director of product marketing, Phil Marshall brings over 14 years of experience in both product and services marketing as well as more than 10 years experience in the high-tech publishing space, with publications including Dr. Dobb’s Journal and Byte magazine. Prior to joining Cryptzone, Phil worked at security firms Rapid7, Positive Technologies and RSA. He also was a senior product marketing manager at Black Duck, the leading open source governance and management firm.

A speaker at recent (ISC)2 conferences and ISACA, he’s participated in numerous webinars, in panel discussions and presented on topics including Identity Security, Application Security and Open Source Governance and Management.

Marshall earned a BA at Bates College and an MBA, cum laude, at the F.W. Olin Graduate School of Business at Babson College.

 

 

Are businesses prepared for EU General Data Protection Regulation?

Implications of the new EU General Data Protection Regulation (GDPR) are a concern for almost every organisation doing business in the EU that possesses “any information relating to an identified or identifiable natural person (‘data subject’).” Despite Brexit, GDPR affects UK business working with any EU-based business, regardless of whether the business stores or processes that data on EU soil. While it becomes enforceable on May 28th 2018, the time to prepare for it is now.

For the 44% of IT professionals who in a recent poll indicated that they were , understanding what this means for business is crucial. The GDPR replaces the 21-year-old Data Protection Directive (95/46/EC) as the EU’s omnibus data protection law. It also replaces 28 national laws, something that is being perceived as a benefit for businesses, as they will only have to deal with one supervisory authority going forward.

The law’s objectives are to protect the “digital citizen” and ensure a single digital market. This means that all data relating to an EU citizen is considered ‘personal’ under the GDPR, regardless of where a EU citizen is located, or if they have been identified directly. Essentially, there will be one set of rules and a uniform interpretation mechanism to provide legal certainty and create trust across the whole of the EU.

The GDPR also teaches some new vocabulary. For instance, the regulation promotes techniques such as anonymization (removing personally identifiable information where it is not needed), and pseudonymization (replacing personally identifiable material with artificial identifiers). The regulation also promotes the use of encryption to protect personal data.

Key Takeaways

It is already obvious that the EU GDPR has teeth. The new legislation will set regulatory fines at 4% of global turnover, far exceeding the current maximum of £500,000. If data security breaches remain at 2015 levels, the fines paid to the European regulator could see a near 90-fold increase, from £1.4bn last year, to £122bn when it is enforced.

It is clear that the regulation has very broad reach and will affect companies worldwide. If a company offers goods or services within the EU and The European Economic Area (EEA), irrespective of whether they are established in the EU/EEA, they will be affected whether or not a payment by the data subject is required.

The European Commission (EC) wants to ensure that large organisations processing a lot of data have someone who takes responsibility for that information, and having a data protection officer role is part of the new law. Larger companies will need to start recruiting as it has been decided that firms with over 250 staff must employ a data protection officer.

A part of the data protection officer’s job will likely be reporting breaches when they occur. The GDPR will require firms to notify data protection authorities, such as the UK’s Information Commissioner’s Office (ICO), within 72 hours of discovering a breach (although the EC does state this should be within 24 hours ‘when feasible’). This disclosure must include detail on what data has been lost and how this will impact the citizens affected by the data breach.

Answering the important questions

The EU GDPR train has left the station.  Now is a good time for companies to assess how they can prevent attackers from gaining access to any information relating to an identified or identifiable person.  

In order to successfully prepare for the pending EU GDPR security requirements, a comprehensive and centralised approach to secure access control will be crucial for businesses.

Questions such as how IT teams can provide unified, granular access control to applications, services and infrastructure, regardless of location, whether on-premises or in the cloud and how the same level of access control scrutiny can be applied to third-parties, contractors, or even your own employees will be essential in this process.

Furthermore, determining how to make the network ‘invisible’ by cloaking the full network and only granting visibility and access to the applications and services that users need to do their job and   how to log data to help meet reporting requirements including those associated with the EU GDPR are other key areas that will need to be addressed.

Once the business has answered the questions outlined above, having real-time access to this information will be the next step to improving security and maintaining productivity.

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week