J. Trevor Hughes
More posts from J. Trevor Hughes
The conventional wisdom is that the recently agreed-upon General Data Protection Regulation (GDPR) is the most-lobbied piece of legislation in the history of the European Union.
I’m not quite sure how you quantify that, but it’s not surprising. This law will likely go down as a milestone of the Digital Age, similar to industry-changing laws like the Clean Water Act or the Clean Air Act here in the United States.
For, just as new laws and regulations were needed to address the consequences of the Industrial Revolution, the European Union has responded to the privacy concerns presented by the Digital Revolution with a law that attempts to apply new order to the complexity of data in society.
Like most laws born of intense compromise, everyone will likely find fault with it. Privacy advocates will say it doesn’t go far enough in its risk-based approach to protect human rights. Industry voices will say it stands to cripple innovation and will consign Europe to a digital island.
Despite these differing opinions, the message to the global information economy is clear: It is time to get to work on the tough tasks of understanding and, eventually, complying with the GDPR.
Virtually every company doing business in the European Union has some challenging months ahead. Companies will need to figure out how to create a data breach response plan that both evaluates the risk of harm to consumers and still allows for regulators to be notified within 72 hours of discovery if that risk is deemed to be great.
Social media and other companies serving teen audiences will need to decide on a good way to acquire parental permission to gather the data of children. Every company will need to create systems for the demonstration of compliance with the law upon demand by regulators.
Much of this work will fall to the privacy profession. The GDPR mandates the appointment of a “data protection officer” (a DPO), a term that might be foreign to U.S. ears. These DPOs are privacy professionals, and they’ve been proliferating around the world lately.
The new regulation requires DPOs for many companies, particularly those that handle sensitive data like biometrics or health information, but also those that make building profiles of their customers integral to their business plans. The good news is that you’ll have three years from this spring to put one in place — but the work of compliance will likely require a privacy professional in your organization far ahead of that deadline.
The potentially more challenging news is that privacy professionals are already in high demand, and will likely be even harder to find in the coming years. Training from within may be the most viable solution as companies struggle to find staff for these functions.
Without question, we will continue to see a public policy debate over many of the provisions of the GDPR. European regulators will create reams of analysis and guidance on the new regulation. Businesses will define best practices within industries and negotiate the new, risk-filled terrain of compliance. Customers will continue to demand innovative technologies that improve their lives, while at the same time expecting even greater respect for their privacy.
In this manner, the GDPR represents not a destination, but an important milestone — a marker that indicates how far we have come and how far we still have to go. Or perhaps the GDPR is more like another type of road sign: “Caution, Work Ahead.”
Comment