Will GDPR Protect Privacy Or Just Lead To More Hacks?

The General Data Protection Regulation(GDPR), viewed from one perspective, is an attempt by the EU to place the citizen, the individual, at the heart of decision-making in respect of their own data. EU law places great emphasis on the rights and freedoms of the individual against the rights of businesses to make money from perceived infringement of those rights.

In regulatory terms, GDPR is in some ways a simplification of what has been done before, the regime around international transfers is broadly the same, while the filing of both contractual clauses and binding corporate rules is actually easier, as one “authority” will be responsible.

Previously companies would have to speak to the regulator in each EU jurisdiction, and file BCRs for inspection by three regulators, which built in significant delays.

The factor drawing considerable conversation is the size of the fines, 4% of global turnover, which is significant to any corporation. Where Data Protection was a matter of risk management that could be viewed by some less-scrupulous organisations as a cost of doing business, this is no longer possible.

The recent (non-privacy) case against Google resulted in a €2.3billion fine, and as the EU’s history with Microsoft indicates, where EU enforcement agencies or courts have teeth, they’re not afraid to use them.

Which brings up the question: Is it coincidence that the GDPR will have the greatest effect on non-EU companies that use data in the ways described above? The answer is no.

The EU would argue with some significant justification that the technologies being developed allow companies and governments to have a far more detailed picture of the individual than most citizens understand which could impact a whole host of areas of their lives. It is therefore correct, in their view, that they act to protect EU citizens at large.

From a different perspective, it may appear that data protection is actually data protectionism, a way of controlling the flow of a commodity in which the EU currently runs a huge trade deficit.

As we are currently seeing with Canada and Privacy Shield in the US, both of which are deemed adequate by the EU currently, the EU is starting to challenge jurisdictions based on the whole of the legislative environment.

This includes the government’s use of big data and surveillance technology, and the protections afforded to their own citizens. So, is this legitimate protection of the rights of EU nationals whose data is processed abroad, or a way of seeking to restrict or block the ability of non-EU countries to access the data market and address the data trade deficit?

This will come into sharp focus, particularly for UK firms over the next two years as the UK is a huge supplier of data services across Europe.

Post-Brexit, there is little certainty about the legal status of the UK under GDPR. While the UK is firmly committing to implementing GDPR, that not be enough to provide it with an instant Adequacy funding, which would be required to maintain data flows in an easy and uninterrupted way.

In terms of the impact on companies’ use of technology for their own protection, this may play out in the courts. The recent Article 29 Working Party on processing of employee data establishes some points of concern, for example commenting on the use of TLS encryption as an invasive technology.

There is always a balance that needs to be struck between protecting individuals’ privacy and the protection of the data that companies possess on individuals. The regulation permits processing of data where necessary to prevent and detect crime, but the Article 29 WP paper does not seem to take into account that the only way to do this effectively is to monitor system usage at a detailed level to prevent threats coming in and data illegally flowing out (the insider threat).

This issue needs to be discussed soon; otherwise protections to secure individuals’ privacy may undermine the ability for individuals (and companies) to help prevent their data from being stolen. It may also be that, in the case, the EU is driven to accept greater use of security technology in order to continue doing business in other markets. An interesting dilemma for sure.

In the long-run it may be that the EU decides that it is better to have automated surveillance by dispassionate machines to protect the ‘greater good’, than risk large-scale data breaches. The only question would then be who runs the machines?

CSO Online:

You Might Also Read:

Google Launches GDPR Compliance Site:

UK Deal With EU On Post-Brexit Data Sharing:

« Car Industry In Crisis Over AI and Hackers
Will Cyber Warfare Remove Kim From N. Korea? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

F-Response

F-Response

F-Response is a software utility that enables an investigator to conduct live Forensics, Data Recovery, and eDiscovery over an IP network using their tools of choice.

Asigra

Asigra

Asigra provides an industry leading cloud backup and recovery software platform called Asigra Cloud Backup.

Security Research Labs (SRLabs)

Security Research Labs (SRLabs)

Security Research Labs is a Berlin-based hacking research collective and consulting think tank.

AML Solutions

AML Solutions

AML Solutions offer a full range of Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) services.

Momentum

Momentum

The Cyber Security team at Momentum offers a professional and specialist recruitment service across Cyber & IT Security.

Subgraph

Subgraph

Subgraph is an open source security company, committed to making secure and usable open source computing available to everyone.

Ubiq Security

Ubiq Security

Ubiq has developed a software solution that secures any type of data, on any device, anywhere, with nearly no impact to system performance or user experience.

AKS IT Services

AKS IT Services

AKS IT Services (an ISO 9001:2015 and ISO 27001:2013 certified company) is a leading IT Security Services and Solutions provider.

Quadible

Quadible

Quadible BehavAuth is an AI-platform that continuously authenticates the users, without the need of any input, by learning their behavioural patterns.

Secure Code Warrior

Secure Code Warrior

Secure your code from the start with gamified, scalable online secure coding training for software developers.

Axonius

Axonius

Axonius is the only solution that offers a unified view of all assets and their coverage, empowering customers to take action to enforce their organization’s security policies.

Sigma IT

Sigma IT

SIGMA IT is one of the largest IT services organizations in EMEA region providing a full range of solutions and services including cybersecurity, data protection and business continuity.

Blackbird.AI

Blackbird.AI

Blackbird.AI provides an intelligence and early-warning system to help users detect disinformation and take action against threats.

Infinidat

Infinidat

Infinidat delivers enterprise-proven solutions for data storage, data protection, business continuity, and sovereign cloud storage.

DataSixth Security Consulting

DataSixth Security Consulting

DataSixth delivers Cybersecurity Intelligence. With our unique capabilities, we’re able to deliver value, deliver answers, and deliver actionable security intelligence.

SNC-Lavalin

SNC-Lavalin

SNC-Lavalin is a fully integrated professional services and project management company with offices around the world.