GDPR set a significant milestone in data regulation and now, just over one year on, it’s clear this historic set of regulations is just the tip of the iceberg. After a first year in which nearly €56bn in fines were levied against 91 companies, the European Commission has now signalled that it is preparing to step up enforcement.
Across the globe, countries like the US, Brazil and India are breaking new ground with privacy laws, and legislation is taking place at state level to protect the privacy of citizens. Proper data compliance regulations are not just a fad, and companies need to get serious about cooperating, or else pay the price in terms of fines and customer trust.
Go deeper with GlobalData
As we enter the next era of GDPR and forthcoming privacy legislation, here are four tips on what companies can do to avoid the harsh penalties that will become more and more commonplace.
Know where all personal data is stored
Knowing where personal data lives and how long it will be there is a core regulatory foundation of GDPR, yet legacy data management tools and techniques aren’t necessarily built to provide this.
When you get a right to access or erasure request, you must be able to show a data subject all of their personal data and describe how it’s being used. If you do not have a business reason to keep said data, you will need to ensure that all personal data on a given subject is deleted.
You should also have conversations with your secondary storage vendors, such as snapshot, backup, and archive products, to find out if and how they can support right to erasure requests.The best that most of them will be able to provide is the ability to erase files from a backup, and some will not even be able to do that.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataAt the time of writing, no secondary storage vendor is able to selectively delete a record from the backup of a database, which is what would be required to delete a user from the marketing database – and that is unlikely to change any time soon. Be aware of the capabilities of your vendors, as you must be upfront with right to erasure request subjects on how their request will be handled.
Encrypt, encrypt, encrypt
Backup archives should always be stored using strong encryption. That way, if a system is ever breached, all the cyber criminals would come away with is encrypted data.
This not only saves the consumer from a potential identity leak, but also saves the company from public embarrassment (not to mention from likely legal action). Encryption should be a no-brainer for all personal data.
Ensure data autonomy
The main tenet of GDPR is to give people privacy and control of their personal data in the digital age, so the subject of the data gets to decide which companies can store their personal data and what data they can store.
Before making a decision, the subject should know why the company needs it, what they’re going to do with it, and have assurances it will be stored properly. Among other things, “properly” storing personal data means ensuring only those who need to see it will be able to see it, and that they will only be able to see it when needed.
Always ensure transparency
Your company will make a lot of decisions about personal data. You will need to decide what personal data you will store, how you will store it, how you will comply with right to access and right to erasure requests, and more. Regardless of how you decide to do things, it’s incredibly important that you are very transparent with consumers regarding those decisions.
Not being transparent enough is what cost Google €50bn. In addition to being transparent about what data you are storing and how you are using it, you must also be transparent about your right to access and right to erasure processes. If your process takes 30 days, communicate that. If you are able to delete the requested data from your primary storage but not backups, communicate that – and explain why.
You should also explain whatever process you have for ensuring that deleted data doesn’t come back after a restore, and how those backups will not be used in a way that accesses their personal data. (The latter is going to become more challenging as backup systems are learning to leverage backup data for other purposes.)
The overriding idea should be transparency. You may run afoul of the commission if they don’t like your erasure process, but that process can be explained and refined as you work with the commission. But you will definitely run afoul of the commission if they find that you are not being upfront about your process. Based on penalties so far, that’s a sure-fire way to get a huge fine. So, transparency is key.
An agile approach to a new age of data regulation
It seems that every day there is another report about data being used incorrectly, without permission, or stolen by bad actors. With this constant commentary, consumers are becoming increasingly wary about how companies are using their data, and the right to be forgotten provides personal autonomy when it comes to one’s own data.
The ground-breaking regulations and enforcement of the past year are just the beginning. In 2019 and beyond, we will see the EU continuing to double down on enforcement, as the world’s leading economies follow suite with increasingly stringent laws.
With legacy data management systems, compliance can truly be impossible. With the right tools that support constant knowledge of where data is stored, robust encryption, data autonomy and transparency, companies can be prepared for the robust regulatory environment of the next decade.
Read more: Move over GDPR: How a new ePrivacy regulation could affect businesses
