TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

Privacy Perspectives | Data transfers: Could a technical solution be the future? Related reading: State of the transfer: Global data flows in focus

rss_feed
GDPR-Ready_300x250-Ad

""

""

International data transfer regulation is rooted in heavy manual processes and paperwork. It impacts business decisions and leaves room for risk. Legal and regulatory teams have to jump through a host of complexities — requiring the assessment of specific circumstances of data transfers like relevant country laws and practices and any additional contractual, technical or organizational safeguards.

As tedious as international data transfers may be, they are an essential pillar for global economies and businesses operating in an increasingly digital world. It is estimated that data transfers will contribute $2.8 trillion to the global gross domestic product by 2025. In 2022 alone, 85% of EU-based companies used standard contractual clauses to transfer data outside Europe. 

Simply put, getting out of the "vicious circle" of manual paper solutions for international data transfers is critical.

What if entities could operate without moving data across borders or eliminate the need for data transfers? 

Looking into the crystal ball on the future of data transfers

How data transfers are executed will inevitably change — we know that much. The reality of an increasingly localized digital footprint is undeniable. Seventy-five percent of countries have already implemented data localization laws. Leaning on legal teams and paperwork to keep up with ever-changing regulations and laws will only cause more friction and complexity. 

But what if there was a technical solution that could scale and serve as a single point of ingestion for data within your cloud environment? Would life become more simplified if an organization could apply governance at ingestion, rather than after the fact, with a platform  supported cross-functionally and in real-time? This revolutionary approach could provide organizations with integrated analytics and external and internal privacy without transferring data.

New technology solutions are tangible and practical

Investing in privacy-by-design solutions doesn't require losing control of data by forcing companies to send it outside their cloud. Instead, it remains in the organization's private cloud, a capability that offers many benefits and opportunities — and streamlines data governance. With a technology-first approach to international data transfers, companies can reap benefits in a number of ways.

A technology-first approach won't disrupt current compliance mechanisms

If organizations have a solution inside their cloud, they eliminate the need to leverage third-party vendors and can keep data in-house. Data transfers will not be necessary, and all data functions — from compliance to analyses — will then be performed internally. The ability to keep data behind a company firewall lets them control the data without disrupting existing data analytics and compliance mechanisms, which minimizes the security risk. 

A privacy-by-design solution will check global privacy compliance needs and easily integrate a company’s existing infrastructure. And if an organization facilitates an international data transfer program, compliance requirements like assigning data permissions and setting retention policies can be done when ingesting data into the solution, minimizing lags in compliance during onboarding.

Reduce overhead, increase profits

Consider the ripple effect of legal solutions for compliant data transfers. Should one component fall out of place, the impact is felt across the board. The cost of data transfer analysis and compliance can be significant. Organizations rely on their technical and legal teams — ranging anywhere from a few to 100 or more people — to manage and document data transfers. Companies must maintain this steep cost each year. Regardless of how many engineers and compliance staff a company has, an automated technical solution could reduce and mitigate that cost.

Improper and time-consuming data transfers can result in decreased GDP and missed revenue for companies. Given that 60% of the global GDP is already digitized, disruptive data transfers across borders can reduce GDP gains and even harm local economies and digital ecosystems.

Local and national government data laws also disrupt cross-border data flows for companies. As data localization is prioritized by countries, companies will experience decreases in the efficiency and resiliency of data transfers — and rises in the cost of daily operations. Jumping through multiple complex legal restrictions and enforcements, while doable, is not an optimal method of handling data transfers — particularly between the EU and U.S., which have a data transfer relationship worth more than $7 trillion.

Supports international data governance measures

With complex and differing legal requirements across countries, companies have the difficult task of doing many things at once: understanding individual country laws, assessing risk based on the nature of data transferring, mitigating risk and maintaining proper documentation. In short, this is a massive manual case-by-case process. With a technical solution, companies could mitigate such a heavy overhaul while still fulfilling data governance requirements — and improving the transfer process.

Conclusion

Legal solutions are not sustainable as the only mechanism companies can use to ensure and execute data transfer compliance. As privacy laws and regulations continue to increase, adherence to customer privacy preferences and rights must also. Organizations will need to find nimble and creative ways to meet these obligations. 

There is an alternative to costly, legally time-consuming and operationally intense policies and procedures for data transfer and compliance. Legal teams, compliance and risk teams and data officers should consider embracing new technology approaches and envision future technical compliance solutions. A technical privacy-by-design solution's benefits are attractive and comprehensive: easy to use, nondisruptive, automated and cost-effective. The digital landscape changes constantly, so why shouldn't we find a digital compliance solution?

There is hope. New privacy-by-design data platforms can dramatically reduce risk and enable brands to keep control of their data, while expanding their business demand and protecting their customers.


Approved
CDPO, CDPO/BR, CDPO/FR, CIPM, CIPP/A, CIPP/C, CIPP/E, CIPP/G, CIPP/US, CIPT, LGPD
Credits: 1

Submit for CPEs

2 Comments

If you want to comment on this post, you need to login.

  • comment Adrian Higgins • Nov 17, 2022
    "If organizations have a solution inside their cloud, they eliminate the need to leverage third-party vendors and can keep data in-house." 
    There are many reasons why keeping data "in-house" is not a good idea. For one thing the resources and skills required to build, configure, secure and maintain an in-house cloud without leveraging third-party vendors far exceeds the 100s evoked in the article to manage and document data transfers.
    Secondly, any data generating and processing applications would need to be integrated with the ingestion point suggested above. This in itself would be no mean feat and, whilst 70 or 80% of them could probably be added, there would always be a need to control the remaining 20 or 30%. In other words, the current army managing and documenting data transfers would need to remain alongside the new army to many the privacy by design in house cloud.
    So whilst it is a nice idea, we are still a long way off being able to achieve it.
  • comment Tony Ayaz • Nov 23, 2022
    Thank you for reading the article and for your comments. The article proposes an approach which could be helpful to many organizations which have to address the increasing complexities of data localization. 
    
    Ideally, data standards would be sufficiently similar and universally recognized, which in turn would support data flows and use of third parties, but this is not the current direction of travel for data privacy policy and regulation in the context of international transfers. The article suggests a technical option which allows compliance with data localization, whether the user has their own environment or a third party cloud environment. 
    
    There is no “one size fits all approach” to addressing the challenges of data localization, but as we explore options on how to operate effectively in an increasingly fragmented approach to data processing and transfers, the article suggests a technical approach which could provide a workable solutions for organizations where appropriate.