Will GDPR Protect Privacy Or Just Lead To More Hacks?

The General Data Protection Regulation(GDPR), viewed from one perspective, is an attempt by the EU to place the citizen, the individual, at the heart of decision-making in respect of their own data. EU law places great emphasis on the rights and freedoms of the individual against the rights of businesses to make money from perceived infringement of those rights.

In regulatory terms, GDPR is in some ways a simplification of what has been done before, the regime around international transfers is broadly the same, while the filing of both contractual clauses and binding corporate rules is actually easier, as one “authority” will be responsible.

Previously companies would have to speak to the regulator in each EU jurisdiction, and file BCRs for inspection by three regulators, which built in significant delays.

The factor drawing considerable conversation is the size of the fines, 4% of global turnover, which is significant to any corporation. Where Data Protection was a matter of risk management that could be viewed by some less-scrupulous organisations as a cost of doing business, this is no longer possible.

The recent (non-privacy) case against Google resulted in a €2.3billion fine, and as the EU’s history with Microsoft indicates, where EU enforcement agencies or courts have teeth, they’re not afraid to use them.

Which brings up the question: Is it coincidence that the GDPR will have the greatest effect on non-EU companies that use data in the ways described above? The answer is no.

The EU would argue with some significant justification that the technologies being developed allow companies and governments to have a far more detailed picture of the individual than most citizens understand which could impact a whole host of areas of their lives. It is therefore correct, in their view, that they act to protect EU citizens at large.

From a different perspective, it may appear that data protection is actually data protectionism, a way of controlling the flow of a commodity in which the EU currently runs a huge trade deficit.

As we are currently seeing with Canada and Privacy Shield in the US, both of which are deemed adequate by the EU currently, the EU is starting to challenge jurisdictions based on the whole of the legislative environment.

This includes the government’s use of big data and surveillance technology, and the protections afforded to their own citizens. So, is this legitimate protection of the rights of EU nationals whose data is processed abroad, or a way of seeking to restrict or block the ability of non-EU countries to access the data market and address the data trade deficit?

This will come into sharp focus, particularly for UK firms over the next two years as the UK is a huge supplier of data services across Europe.

Post-Brexit, there is little certainty about the legal status of the UK under GDPR. While the UK is firmly committing to implementing GDPR, that not be enough to provide it with an instant Adequacy funding, which would be required to maintain data flows in an easy and uninterrupted way.

In terms of the impact on companies’ use of technology for their own protection, this may play out in the courts. The recent Article 29 Working Party on processing of employee data establishes some points of concern, for example commenting on the use of TLS encryption as an invasive technology.

There is always a balance that needs to be struck between protecting individuals’ privacy and the protection of the data that companies possess on individuals. The regulation permits processing of data where necessary to prevent and detect crime, but the Article 29 WP paper does not seem to take into account that the only way to do this effectively is to monitor system usage at a detailed level to prevent threats coming in and data illegally flowing out (the insider threat).

This issue needs to be discussed soon; otherwise protections to secure individuals’ privacy may undermine the ability for individuals (and companies) to help prevent their data from being stolen. It may also be that, in the case, the EU is driven to accept greater use of security technology in order to continue doing business in other markets. An interesting dilemma for sure.

In the long-run it may be that the EU decides that it is better to have automated surveillance by dispassionate machines to protect the ‘greater good’, than risk large-scale data breaches. The only question would then be who runs the machines?

CSO Online:

You Might Also Read:

Google Launches GDPR Compliance Site:

UK Deal With EU On Post-Brexit Data Sharing:

« Car Industry In Crisis Over AI and Hackers
Will Cyber Warfare Remove Kim From N. Korea? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

Wisegate

Wisegate

Wisegate is a community of IT experts providing advisory services on all areas of IT including security.

QASymphony

QASymphony

QASymphony software testing and QA tools help companies create better software by improving speed, efficiency and collaboration during the testing lifecycle.

HID Global

HID Global

HID Global is a trusted leader in products, services and solutions related to the creation, management, and use of secure identities.

SERMA Safety & Security (S3)

SERMA Safety & Security (S3)

SERMA Safety & Security provides a comprehensive cybersecurity offering incorporating Expertise, Evaluation, Consultancy and Training, covering hardware, software and information systems.

Equilibrium Security Services

Equilibrium Security Services

Equilibrium Security Services is a specialist cyber security company providing a full spectrum of IT security solutions from consultancy to design & implementation and managed security services.

Certis

Certis

Certis is a leading advanced integrated security organisation that develops and delivers multi-disciplinary security and integrated services.

HOBI International

HOBI International

HOBI International is a leading mobile, IT and data center asset management provider with solutions for device management, reverse logistics, data erasure, refurbishment and recycling.

Police Digital Security Centre (PDSC)

Police Digital Security Centre (PDSC)

PDSC is a not-for-profit organisation, owned by the police, that works across the UK in partnership with industry, government, academia and law enforcement.

Meterian

Meterian

The Meterian Platform is a fuss-free solution to protect you against vulnerabilities in your app’s software supply chain.

VLATACOM Institute

VLATACOM Institute

Vlatacom Institute is privately owned accredited research and development institute, system integrator and turn-key solution provider. Areas of expertise include encryption and authentication.

Nanitor

Nanitor

Nanitor is a powerful cybersecurity management platform focusing on hardening security fundamentals across your global IT infrastructure.

GetHacked.ca

GetHacked.ca

GetHackded.ca is a certified company offering penetration testing and specialized cybersecurity services.

CyberXposure

CyberXposure

CyberXposure has been built by a team comprising of Cyber Security Professionals and SAAS experts in data backup, disaster recovery and cyber-security.

Evervault

Evervault

Evervault provides engineers easy solutions to complex data security and compliance problems.

Clango

Clango

Clango employs an identity-centric approach to optimizing your cybersecurity investment while minimizing risk.

Jersey Cyber Security Centre (JCSC)

Jersey Cyber Security Centre (JCSC)

Jersey Cyber Security Centre is the jurisdiction's Cyber Emergency Response Team (CERT) and national technical authority for cyber security.