GDPR's Impact In The US And Globally

GDPR enforcement began in May of 2018, but if you are doing business in the US or elsewhere, you may think that it doesn’t apply to your organisation, but that would be mistaken. GDPR affects organisations and businesses worldwide.
 
GDPR stands for the General Data Protection Regulation and over a year after it came into effect still almost 30% of EU businesses are not compliantWhat GDPR means is that citizens of the EU and EEA now have greater control over their personal data. And GDPR gives assurances that their information is being securely protected across Europe and the law explains that non-compliant businesses will be taken to court and heavily fined.
 
According to the GDPR directive, all personal data, that is any information related to a person such as a name, a photo, an email address, bank details, updates on social networking websites, location details, medical information, or a computer IP address must be secure and used legally.
 
There is no distinction between personal data about individuals in their private, public or work roles, the person is the person. Also in a B2B setting, everything is about individuals interacting and sharing information with and about each other. 
The GDPR is a relatively new data privacy law that has been added to a number of other compliance requirements.  These  other Laws include GDPR joins Sarbanes-Oxley (SOX), the Payment Card Industry (PCI) compliance, the Health Insurance Portability and Accountability Act (HIPAA), and the Family Educational Rights and Privacy Act (FERPA) as one more piece of the data and compliance puzzle that we have to solve. 
 
The GDPR itself was written and made law by the EU. This immediately raises the question, what does the GDPR have to do with the United States of America? 
 
There are short, medium, and long answers to this question, and you need all three. Since the application of the EU law is to people within the EU, it probably seems that it doesn’t have immediate application within the US. However, there are a couple of “buts” associated with that short answer. These “buts” constitute the medium and long answers.
 
What If Your Business Collects EU Data?
The law is clear and written in easy to understand language (unlike a lot of other laws). The application of the law is written in the first line of the first Article of the first Chapter: This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.
 
What they’ve done is to define the law as applying only to “natural persons.” Why this particular term of art? Because they are intentionally creating a law that applies to human beings and not the legal construct of a person. In short, it eliminates the inclusion of corporations.
 
The next thing to define is, what data is included under the law. This is a little less clear.Look at Chapter 1, Article 3, we get the answer: This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
 
Processing and collection are different. If the data is collected within the EU, as opposed to say, when someone from the EU is visiting the US, and they submit information to a non-EU based org, then it’s applicable. However, processing the data after it has been collected, applies regardless of where the processing occurs.
They clarify and expand this further in the second part of Article 3:
 
This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:  
  •  the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
  • the monitoring of their behaviour as far as their behaviour takes place within the Union.
When we take these together, we can say that the law applies to the collection of personal information from people currently residing within the EU. This makes it applicable to US entities. If your organization is collecting information from any people within the EU, then that information falls under all the regulations and laws of the GDPR.
 
Not only do we already have a GDPR-influenced law in effect, but not yet in enforcement  acroos the United States, but there are  several that are being actively brought forward. 
 
The California Privacy and Protection law (CPP)
 
The CPP was passed last year and took effect on January 1, 2020. Since the law was closely modeled on the GDPR, it mirrors a lot of the language. In California however , legislators have gone even further. They have passed the standard definitions within the GDPR of such things as the right to be forgotten, a requirement to opt-in for communication and data collection, the requirement that you publish how the data is being processed and have a mechanism for accessing the data you collect on an individual. They’ve also expanded what constitutes personal information and added things to the definitions that many of us who follow the GDPR expect to become standard: IP address, geolocation, browsing history, search history and more. You also have to provide a straight-up “opt-out” option to the data you collect and to any data you share with third parties. 
 
There is another piece of legislation being brought forward in California that will make the CPP even stronger, including allowing individuals to bring suit against companies that violate the CPP in addition to anything the state itself does.
 
There are at least 10 other states that are currently working on some version of a new privacy compliance law; all of them are modeled on the GDPR. The ones I’ve read about so far include: New York, Hawaii, New Jersey, Maryland, Massachusetts, New Mexico, Rhode Island, Mississippi, and North Dakota.
 
Other countries are now passing GDPR-style laws. If you deal with data from the following countries, you will need to understand how their GDPR-style compliance regime applies: Argentina, Brazil, China, Iceland, Malaysia, Switzerland and Uruguay.
 
The Benefits of GDPR
 
  • Consent Is Paramount: The good thing about GDPR is that it provides maximum importance to consumer consent. Companies cannot use long contracts to sneak in clauses which customers do not read. The companies are expected to get explicit consent about the type of data that they will collect as well as how they will process it. It does not matter whether the data processing happens within the European Union or not. As long as the data belongs to an EU citizen, the General Data Protection Regulation (GDPR) is applicable.
  •  Right to Be Forgotten: Another big achievement of the General Data Protection Regulation (GDPR) is that it provides consumers with the right to be forgotten. This means that even if we agree to share certain data today, we can change our minds later. For instance, if we agreed to share our credit card information with a company today, we can later ask them to delete our credit card information or our entire account. For the first time in the history of data protection laws, the right to be forgotten has been provided to consumers. Digital companies can no longer show backdated contracts signed by customers and hold them hostage.  If the customers want the data to be deleted now, this instruction supersedes the previous ones, and the digital companies are legally bound to delete all data that has been requested by the customer. 
 
Disadvantages of GDPR.
 
  • Has Caused Spam: The biggest problem with the GDPR is that it has caused spam on a massive scale. This is strange given the fact that the purpose of GDPR is to stop spam. Millions of e-mails have been triggered asking users whether they offer their consent for the use of data. Since several companies are sending these e-mails simultaneously, consumers are not able to differentiate the details. Many of them are just blindly clicking on “I agree.” This ends up defeating the whole purpose of the GDPR exercise.
  • Helps Bigger Companies: The GDPR increases a huge amount of complexity in online business. Every business needs to be compliant regardless of their turnover. Compliance is expensive for the small businesses. Larger businesses find it easier and cheaper to comply with these norms. This is the reason why Google and Facebook, which were supposed to be the most affected by the General Data Protection Regulation (GDPR) are actually the biggest beneficiaries. This regulation makes it difficult for smaller companies to compete with the larger ones.
  • Marketing Efforts Redesigned: E-mail marketing has become a lot more expensive and time-consuming. Data lists now have to be General Data Protection Regulation (GDPR) compliant. Also, the information collected on social media websites has to be stored, shared and used carefully. The entire process of digital marketing is likely to take a huge hit.
In summary, the GDPR has some pros and cons. However, the benefits largely accrue to the consumers and the big businesses. The small businesses are the ones who have to bear the cost of this increased regulation.
 
Conclusion
 
There’s no longer any valid reason left to argue that you don’t have to worry about the GDPR. One way or another, it is going to affect how you manage your data. It’s no longer an optional, “we’ll get around to it” issue either. With over 59,000 instances of breaches reported since May of 2018, a large number of those under investigation, and an equally large number of warnings and fines already levied, this is an immediate issue. 
 
The next step within your organisation is  to ensure that you are going through a risk assessment. The general outline of this is defined within the GDPR in Article 35.  If a data protection impact assessment has not yet been done within your organisation, start that now.  
 
Contact Cyber Security Intelligence for more  information about opportunities and security assessmnets  relating to your organisation.
 
Red-Gate:       SuperOffice:     TechRepublic:       Management Study Guide:      Consultancy.uk
 
You Might Also Read: 
 
On Trend: Business Data Protection Laws:
 
GDPR For Dummies
 
 
« The Human Effect On AI Security
Some Expert Predictions For Industrial Cyber Security »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

The Networking People (TNP)

The Networking People (TNP)

TNP supplies independent advice allowing large organisations to design, build and operate their own networks independently of the established telecoms companies.

Via Resource

Via Resource

Via Resource specialise in Information and Cyber Security recruitment in the UK, Europe and USA.

DoD Cyber Crime Center (DC3)

DoD Cyber Crime Center (DC3)

DC3 is a US Department of Defense (DoD) center of excellence for Digital and Multimedia forensics.

QNAP Systems

QNAP Systems

QNAP Systems, Inc. delivers world class network attached storage (NAS) and network video recorder (NVR) solutions.

Infrascale

Infrascale

Infrascale specialise in providing cloud backup and disaster recovery services.

FIDO Alliance

FIDO Alliance

FIDO Alliance is a non-profit organization formed to address the lack of interoperability among strong authentication devices.

Guidewire

Guidewire

Guidewire Cyence™ Risk Analytics is a cloud-native economic cyber risk modeling solution built to help the insurance industry quantify cyber risk exposures.

inBay Technologies

inBay Technologies

inBay Technologies' idQ Trust as a Service (TaaS) is a unique and innovative SaaS that eliminates the need for user names and passwords.

Cybersprint

Cybersprint

Cybersprint's Digital Risk Protection platform continuously monitors your digital footprint so you can make informed decisions on exposure to online threats, identify vulnerabilities and take action.

Cybersecurity Collaboration Forum

Cybersecurity Collaboration Forum

The mission of the Cybersecurity Collaboration Forum is to foster information security communication and idea sharing across the C-Suite, enabling leaders to better protect their enterprises.

Cypress Data Defense

Cypress Data Defense

Cypress Data Defense helps clients build secure applications by providing training, best practices, and evaluating security during every stage of the Secure Application Development Lifecycle.

TekSek Cyber Security

TekSek Cyber Security

Preparing you for tomorrow's security threats.

Mosyle

Mosyle

Businesses and educational institutions rely on Mosyle to manage and secure their Apple devices and networks.

Veriti

Veriti

Veriti is a unified security posture management platform that integrates with your security solutions and proactively identifies and remediates potential risks and misconfigurations.

Conosco

Conosco

Conosco are industry-leading experts throughout the UK in strategic consulting, project delivery, business communications, support, and security.

Phylum

Phylum

Phylum provides powerful, automated software supply chain risk analysis that protects organizations, defends developers and enables secure innovation.

Ethnos Cyber

Ethnos Cyber

Ethnos Cyber is Africa’s leading cybersecurity and compliance management company. We provide Information Security, Risk Management, Cybersecurity and Compliance Management solutions to clients.