Will GDPR Protect Privacy Or Just Lead To More Hacks?

The General Data Protection Regulation(GDPR), viewed from one perspective, is an attempt by the EU to place the citizen, the individual, at the heart of decision-making in respect of their own data. EU law places great emphasis on the rights and freedoms of the individual against the rights of businesses to make money from perceived infringement of those rights.

In regulatory terms, GDPR is in some ways a simplification of what has been done before, the regime around international transfers is broadly the same, while the filing of both contractual clauses and binding corporate rules is actually easier, as one “authority” will be responsible.

Previously companies would have to speak to the regulator in each EU jurisdiction, and file BCRs for inspection by three regulators, which built in significant delays.

The factor drawing considerable conversation is the size of the fines, 4% of global turnover, which is significant to any corporation. Where Data Protection was a matter of risk management that could be viewed by some less-scrupulous organisations as a cost of doing business, this is no longer possible.

The recent (non-privacy) case against Google resulted in a €2.3billion fine, and as the EU’s history with Microsoft indicates, where EU enforcement agencies or courts have teeth, they’re not afraid to use them.

Which brings up the question: Is it coincidence that the GDPR will have the greatest effect on non-EU companies that use data in the ways described above? The answer is no.

The EU would argue with some significant justification that the technologies being developed allow companies and governments to have a far more detailed picture of the individual than most citizens understand which could impact a whole host of areas of their lives. It is therefore correct, in their view, that they act to protect EU citizens at large.

From a different perspective, it may appear that data protection is actually data protectionism, a way of controlling the flow of a commodity in which the EU currently runs a huge trade deficit.

As we are currently seeing with Canada and Privacy Shield in the US, both of which are deemed adequate by the EU currently, the EU is starting to challenge jurisdictions based on the whole of the legislative environment.

This includes the government’s use of big data and surveillance technology, and the protections afforded to their own citizens. So, is this legitimate protection of the rights of EU nationals whose data is processed abroad, or a way of seeking to restrict or block the ability of non-EU countries to access the data market and address the data trade deficit?

This will come into sharp focus, particularly for UK firms over the next two years as the UK is a huge supplier of data services across Europe.

Post-Brexit, there is little certainty about the legal status of the UK under GDPR. While the UK is firmly committing to implementing GDPR, that not be enough to provide it with an instant Adequacy funding, which would be required to maintain data flows in an easy and uninterrupted way.

In terms of the impact on companies’ use of technology for their own protection, this may play out in the courts. The recent Article 29 Working Party on processing of employee data establishes some points of concern, for example commenting on the use of TLS encryption as an invasive technology.

There is always a balance that needs to be struck between protecting individuals’ privacy and the protection of the data that companies possess on individuals. The regulation permits processing of data where necessary to prevent and detect crime, but the Article 29 WP paper does not seem to take into account that the only way to do this effectively is to monitor system usage at a detailed level to prevent threats coming in and data illegally flowing out (the insider threat).

This issue needs to be discussed soon; otherwise protections to secure individuals’ privacy may undermine the ability for individuals (and companies) to help prevent their data from being stolen. It may also be that, in the case, the EU is driven to accept greater use of security technology in order to continue doing business in other markets. An interesting dilemma for sure.

In the long-run it may be that the EU decides that it is better to have automated surveillance by dispassionate machines to protect the ‘greater good’, than risk large-scale data breaches. The only question would then be who runs the machines?

CSO Online:

You Might Also Read:

Google Launches GDPR Compliance Site:

UK Deal With EU On Post-Brexit Data Sharing:

« Car Industry In Crisis Over AI and Hackers
Will Cyber Warfare Remove Kim From N. Korea? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Baker McKenzie

Baker McKenzie

Baker & McKenzie is an international law firm. Practice areas include Data & Technology.

Cyber Akademie (CAk)

Cyber Akademie (CAk)

Cyber Akademie is a training and education center providing high-quality training and information events on information security and data protection.

Alan Boswell Group

Alan Boswell Group

We are a Group of Companies providing specialist Insurance Broking and Risk Management advice and services including Cyber Risk cover.

Pentagon Group

Pentagon Group

Pentagon Group is a provider of security services in high-risk environments, remote areas and emerging markets in support of land-based, aviation, maritime and cyber operations.

Fiserv

Fiserv

Fiserv offers a wide array of Risk & Compliance solutions to help you prevent losses from fraud and ensure adherence to regulatory and compliance mandates.

DarkOwl

DarkOwl

DarkOwl provides the world’s largest index of darknet content and the tools to efficiently find leaked or otherwise compromised sensitive data.

Noventiq

Noventiq

Noventiq (the brandname of Softline Holding plc) is a leading global solutions and services provider in digital transformation and cybersecurity.

BlueHalo

BlueHalo

BlueHalo is purpose-built to provide industry capabilities in the domains of Space Superiority and Directed Energy, Missile Defense and C4ISR, and Cyber and Intelligence.

MyCena

MyCena

MyCena has developed a complete system of security, control and management for decentralised credentials.

SolidRun

SolidRun

SolidRun is a leading provider of computing and network technology designed to streamline the deployment of edge computing infrastructure and support embedded and IoT markets.

OryxLabs

OryxLabs

OryxLabs provide advanced enterprise digital risk protection solutions. Learn more about how 24x7 continuous assessment, monitoring, and improvement can secure your network.

IDVerse

IDVerse

IDVerse is focused on making user verification effortless through technology. We build intelligent tools that protect users from identity fraud while enabling a seamless user experience.

CyberTest

CyberTest

CyberTest offers cybersecurity consulting and penetration testing services that helps organizations and businesses securing their assets.

Sensity

Sensity

Sensity is a company that offers an AI-driven solution to detect and verify deepfakes and other forms of identity fraud.

Texaport

Texaport

Texaport's vision is to be the trusted partner of choice for organisations seeking comprehensive IT management and cutting-edge security solutions.

Btech

Btech

Btech is the market leader in providing affordable managed IT security services for credit unions.