TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

Privacy Perspectives | The GDPR: Your best friend (but you know that) Related reading: Notes from the IAPP Editorial Director, April 19, 2019


For those on the margins of the privacy community, there is a narrative that repeats about the EU General Data Protection Regulation that goes something like this: The GDPR is a tremendous burden. It's going to change the way the internet works forever. Tech companies are desperate to fight it. 

A recent New York Times article flogged a lot of these. "Tech Giants Brace for Europe's New Data Privacy Rules." Oh noes! First, the Amero-centrism of the piece isn't surprising, I guess, as the NYT is fundamentally a U.S. paper, but there are tech giants that are NOT in Silicon Valley, ya know. Spotify is pretty big. King makes a few games you play. Deliveroo. Trivago. They're all, like, in the EU already. 

But the funniest part for me was this two-paragraph juxtaposition:

European officials said the coming rules are forcing American tech giants to take a step back.

“There has not been any pushback from American companies,” said Věra Jourová, the European Commissioner for Justice, Consumers and Gender Equality. “If anything, they seem very eager to understand how exactly they can comply with the regulation.”

Does that quote really support the sentence that precedes it? 

I've been getting this question a lot from various journalists and others I've met with here in Europe recently: "How much of a burden will the GDPR represent? Which products won't be offered because of it?"

I think those are the wrong questions. Sure, there might be a service or two that has to be rethought or rejiggered. We heard about Facebook's suicide prevention service not being rolled out in the EU because of GDPR concerns. But I think, in many ways, privacy professionals and IT professionals think the GDPR is the best thing since sliced bread and the tech companies that actually have their acts together are really embracing the GDPR. Finally, the tough IT and privacy questions that should have been getting asked and answered all along are being addressed. 

All of a sudden, the whole organization is actually listening! Yes, we do in fact need to get some order and structure around our data processes. Yes, privacy is in fact vital to our business interests. Yes, it would be nice if we had confidence in what we can do with each piece of personal data, rather than having some vague idea that what we're doing might be illegal. Yes, knowing exactly what consent is attached to what piece of personal data is pretty handy, actually. 

You mean we should have contracts with our vendors outlining exactly what they can do with the data that we share with them? GREAT IDEA. 

Oh, you think we should encrypt data at rest and in transit. WHY DIDN'T I THINK OF THAT?

You think our customers might like us more if the value exchange of data for services was more transparent and they didn't have a vague idea that we were sort of abusing them? YOU DON'T SAY. 

For privacy pros, the GDPR isn't a burden or a headache, it's a big older brother who just showed up at the playground who agrees with you that, yes, we are going to play kickball and you're going to go first and get to be the pitcher and everyone is going to like it and have fun. 

Which isn't to say that the rest of the organization now resents the privacy and IT teams, although I do think there's some of that here and there. No one likes to change the way they do things. But the business leaders, the C-suite, understands that this is the future of the internet. The halcyon Wild West days of data as the new oil are ending in much the same way we don't make cars that get 12 miles to the gallon anymore.

A sense of responsibility has set in. That was happening regardless of the GDPR, of course. Consumers were becoming more savvy and there's good evidence that opaque apps that hoover up your data and don't deliver value aren't getting very far anymore anyway. But the GDPR has ramped up that realization and leveled the playing field in many ways. 

Won't it be better to compete on product and delivery, rather than on who has the sneakiest data mining team? Wouldn't you rather work on your value exchange instead of your duplicity (to be particularly cynical)? 

I think most people who truly love and value the opportunity the internet provides are perfectly happy with the GDPR — even if a few bits of it are a pain in the butt. 

But, you know what? Big brothers can sometimes be a pain in the butt, too. 

photo credit: oiZox Amistad via photopin (license)


If you want to comment on this post, you need to login.

  • comment Jan Slanina • Feb 12, 2018
    The article correctly describes the tip of the iceberg. However, there is a tremendous burden caused by the GDPR that is hidden from the view. The 9/10 of the iceberg perhaps.
    GDPR impact the activities mentioned in the article. And yes, perhaps we are not happy about sneaky data-mining teams and opaque apps. However, GDPR does also impact everyday life of companies and institutions that never even dreamed of abusing data. My daughter goes to a public kindergarden. It is composed of about 80 kids, 6 teachers, 2 cooks, 3 cleaning ladies, a part-time accountant and a principal. Now the kindergarden will have to implement GDPR and even appoint a DPO according to art. 37/1 a. To put things into perspective: an experienced full time DPO costs about as much as all the 6 teachers combined. True, the kindergarden does not need a full-time DPO, but even a part-time DPO will be a significant burden on its resources.
    A friend of mine has a beauty salon with pedicure, manicure etc. That means she is processing special cathegories of personal data. In fact, half of the invoices and receipts she issues contain special cathegories of personal data (and, under local law, she is required to issue invoices or receipts). Every single company that has written contracts now has a headache: how long after the contract is fulfilled may I keep the hardcopies of the contracts?
  • comment Alexander Rockel • Feb 12, 2018
    To Jan Slanina:
  • comment Jan Slanina • Feb 13, 2018
    To Alexander Rockel: if you believe that my comment is not based on proper understanding of the law, perhaps you could explain in more detail.
    For starters: in our national law the kindergarten is en entity entrusted with administrative decision making. The decisions may seem trivial (the decision on admission or, very rarely, expulsion, of a child), but they are within the code of administrative procedure nonetheless. Would you care to explain why you think it is not required to implement GDPR or appoint a DPO?
    Similarly, while it may be considered a "mere beauty salon", they often take care of medical conditions. Again, seemingly trivial, medical conditions nonetheless.
    Finally, the archiving of hardcopy contracts is important to many companies.
  • comment James Naish • Feb 13, 2018
    To Jan Slanina: I think your hyperbolising slightly here. Obviously no regulators are expecting a small nursery to appoint a fully trained DPO, they can simply select a staff member and make them their DPO - with some minimal training if need be. As for the beauty salon, as long as they have thought about how long they are retaining their contracts and have some simple justification for keeping them for this long then they'll be fine - GDPR gives you the leeway to decide for yourself (as long as you can justify it). So really the burden is minimal and is beneficial in the long term as it means you don't have unnecessary files and contracts in storage for years.
  • comment Jan Slanina • Feb 13, 2018
    To James Naish: I may be guilty of pointing out the most striking examples.
    At the same time our national regulator made it rather clear that appointing a DPO that does not fulfill the GDPR requirements is worse than not appointing one. See also art. 37 par. 5. So appointing an employee with minimal training is hardly an option. We are investigating the option of appointing a DPO on the municipal level for all schools and kindergartens in the municipality (art. 37 par. 3), but the cost, even if shared, is still not irrelevant, and, given the ambiguous wording of art. 37 par. 3, the legal uncertainty as to how many entities may be covered by a single DPO, is unsettling.
    As for the contracts: I do not see any leeway in the GDPR. There is no article saying "data may be processed as long as reasonably justified" or anything similar. You are only allowed to process what is necessary. And the word "necessary" is usually interpreted as "indispensable". Once the regulator decides you kept the contracts beyond when they were necessary, you are out in the cold. 
    Not to mention the fact that simple legitimate interest does not qualify as a legal title to process medical data at all. There the regulation is significantly stricter.
  • comment James Naish • Feb 14, 2018
    To Jan Slanina: It is ultimately the data controller that decides how long is necessary to serve the needs of their business, not the regulator - as the GDPR makes no exact references to how long is necessary - you will know your own business needs best. Furthermore, it's not as if you're keeping these records for insidious purposes, it's all ultimately for the benefit of the customer - so I very much doubt a regulator will come and slap a 4% turnover fine on you for keeping records for slightly too long.