The GDPR has been in effect for a few months now, and it’s safe to say most businesses are familiar with it by now. It’s also likely a safe bet that at least a few view it as an inconvenience. Truth is, it’s anything but. From a business perspective, privacy regulations are one of the best things that could possibly exist - here’s why.
Data Protection
Certain types of personal data are very valuable to criminals, and can be very damaging to an individual or business if it falls into the wrong hands. As the world becomes more digital and more connected, more of this sort of data is generated and passed between various sources on a regular basis.
Government regulations and supervisory authorities aren’t just about keeping irresponsible parties in line. They also provide vital security guidance to every type of organization that handles sensitive personal, business or government information.
Data protection regulations also ensure that the end user has a transparent view of and a say in the processing of personal data. These safeguards play a significant role in everything from the preservation of civil rights to ensuring that democratic institutions function properly.
Some types of personal data are clear candidates for regulation: medical records, banking information, national ID numbers and so on. But some of these regulations also cover items that might seem relatively innocuous at first glance: home addresses, email addresses, website profile information and so on. For example, the European Union General Data Protection Regulation (GDPR) has stipulations about anything that is unique to an individual to include phone numbers and social media accounts. People have varying levels of privacy preference with these items, but they are often protected by regulation because they can be used for targeted scams and attempts at identity theft.
Given that regulations often take the size and customer count of businesses into consideration in terms of penalties and the scope of protection of personal data, compliance is particularly important for enterprise-scale organizations. You do not necessarily have to have an active business presence in a country or region; simply storing data on or moving it through servers there may subject you to their data protection rules.
The General Data Protection Regulation (GDPR) implementation date has arrived. What are the behind-the-scenes work that political parties around the world have to undertake to ensure compliance?
Developing an effective privacy management infrastructure for GDPR compliance seems daunting. How do you prioritize to meet GDPR accountability obligations?
Employers must familiarise themselves with India's new Digital Personal Data Protection Act, and assess its implications for employee data. With compliance likely to require significant administrative and technical overhauls within organizations, it is prudent to begin readiness evaluations early.
This article is based on a presentation made during the Data Privacy Asia 2016 conference held on 9-11 November 2016. The new EU General Data Protection Regulation aims to implement uniform data protection rules within the EU, boost the Digital Single Market and increase cooperation across its member states. The current rules have been sharpened to provide more enforcement teeth with penalties up to 4% of annual global turnover or EUR 20 million for firms in breach with the GDPR. In this article Héloïse Bock, a Partner at Arendt & Medernach, a law firm located in Luxembourg, examines the core principles and applicability of the GDPR, and discusses what companies in Asia must do to avoid missteps.
Europe’s highest court will soon deliver a judgement on the 'Schrems II' case that could see the controversial Privacy Shield accord between the EU and the U.S. struck down.
Data subject rights are being expanded under the EU General Data Protection Regulation (GDPR), impacting the business processes of data controllers and processors. With the increased complexities that lie in within each distinct right, a variety of new issues will need to be considered.
Businesses dealing with the U.S. Department of Defense are required to achieve CMCC compliance. What are the challenges faced by the vendors in acquiring the accreditation?
The implementation of CPRA and introduction of civil penalties for theft of login information should encourage businesses to establish a strong data security posture management (DSPM) strategy. This is a key first step to protect and monitor personal information more effectively and allow consumers to control data sharing.
The advertising industry would like to see Australia’s privacy law kept loose enough to allow "legitimate" data collection, a "tech neutral" posture and rules that are no stronger than the ones at play in the EU and UK.