Privacy professionals have been exceptionally busy over the last two years. In the weeks leading up to May 25, 2018, General Data Protection Regulation activity reached a crescendo as officials, businesses and their adv isers prepared to go live.

Many champagne corks were popped on that momentous day, but how did things look on May 26? As the Privacy Advisor reported in a GDPR day podcast, some privacy pros opted to take a well-earned vacation, while others considered what might happen over the next 12 months.

One thing is certain: Privacy compliance remains a pressing topic across the globe. New privacy laws are emerging in Brazil, India, Thailand and California. In Europe, attention will soon shift to post-GDPR enforcement, the development of the ePrivacy Regulation, and the potential impact of Brexit on cross-border data transfers.

Now is not the time for organizations to become complacent about privacy risk management. With the 2019 budget cycle fast approaching, privacy pros should review their priorities, develop a robust business plan and budget, and gain support from senior stakeholders to continue their important work into next year.

GDPR: Is there anything left to do?

Absolutely, yes. Organizations should start by assessing whether they have effectively achieved full, global GDPR implementation. Certain activities may have been deprioritized, perhaps due to their complexity or the nature of remediation, as organizations focused on high-risk or big-ticket issues prior to GDPR go-live.

For example, data controllers may still be establishing necessary controls and agreements with their data processors, a process that can involve reviewing and renegotiating hundreds of contracts. Organizations should also complete outstanding privacy-impact assessments of their core data-processing activities to demonstrate accountability and better manage data-privacy risks.

In addition, as awareness of the GDPR increases, more individuals may seek to exercise their data-subject rights (particularly though subject-access requests) or raise complaints directly with the business or regulators. Businesses should be prepared to handle these requests, particularly if data-related incidents generate additional publicity about privacy rights.

Furthermore, tight GDPR implementation timelines pushed some organizations to opt for manual workarounds to meet certain obligations; these organizations should assess whether more sophisticated technological solutions will help them better manage future requirements.

Transition to business as usual

Many businesses will continue to manage the transition from GDPR readiness to business as usual, steps that could involve embedding a target operating model for privacy, appointing a data protection officer, establishing a privacy network and providing staff training and support.

The GDPR has changed governance and accountability within the privacy office, which should prompt organizations to crystalize their approaches to the structure, reporting lines and roles and responsibilities of the privacy function. They should consider the following questions: How many of the day-to-day responsibilities should we split between strategic, advisory and operational roles? Have we allocated resources to fulfill relevant business-as-usual roles? How much of the group privacy function’s time will be required to support the local escalation of privacy issues?

Enhancing the privacy-accountability framework should also be a priority. Embedding data protection by design and default may require more thought and effort than simple check-the-box compliance. For example, should organizations rework design principles to take a "privacy-first" approach when developing new products and services?

More practical activities include refining the records of processing activities and implementing data retention policies. For multinational businesses, efforts to implement binding corporate rules may help preserve the free flow of data across the organization, which could be challenged by uncertainties related to, for example, Brexit or the future of the EU-U.S. privacy shield.

Organizations should also develop a practical reporting and monitoring framework to test the ongoing effectiveness of GDPR controls. Insightful management information and clear metrics can ensure senior stakeholders remain aware of privacy-risk management.  

Regulatory change management

Another trend to monitor is regulators’ increasing focus on technology. Businesses should continue to monitor the proposed ePrivacy Regulation, particularly where the rules seek to regulate machine-to-machine communications and the processing of electronic-communications content and metadata.

Outside Europe, businesses should assess the privacy frameworks emerging in the jurisdictions in which they operate. Many new regimes have been inspired by the GDPR, but contain unique idiosyncrasies that require closer examination. In particular, many businesses should pay attention to the California Consumer Privacy Act of 2018.

Expect the unexpected

In a world where any future incident, court decision or political development could end up becoming a game-changer, privacy pros have learned to expect the unexpected. They know their organizations will be more prepared to react to any such developments by better understanding how they process and protect data and by developing internal privacy specialisms. They also know that building these capabilities will require investments in people and technology.

So why invest in privacy in 2019? In a nutshell, because privacy is not going away. The GDPR has prompted many businesses to elevate their games, but they can always do more to develop their privacy frameworks, prepare for emerging laws, respond to events and monitor policy developments.

When bidding for funding during budget discussions, privacy pros should present practical proposals and use sound reasoning to keep privacy at the top of the agenda. Their reasons for doing so are compelling and numerous. Now they must ensure decision-makers understand the same. 

photo credit: wuestenigel via photopin