We often hear that “Data is the new oil”. Over the past years, businesses and organizations worldwide have grown aware of the value of the data — including consumer data — they control, and they’ve found new ways to exploit and monetize it. This has sparked concerns about misuse of personal data: consumers have become more careful about sharing their data, and policymakers stepped in to implement specific regulation. The various pieces of data privacy legislation that are now enforced around the world are raising new challenges for businesses — but also new opportunities.
The impact of personal data protection laws for firms across all industries should at no cost be underestimated. Hiring a Data Privacy Officer is hardly enough to live up to the challenges. Business leaders actually need to review and possibly adjust a number of their strategies.
Overview of Data Privacy Legal Frameworks
Adopted in 2016, the European Union’s General Data Protection Regulation (GDPR) was the first major data protection and privacy regulation. The primary aim of GDPR was to improve individuals’ control and rights over their personal information. This includes the transfer of personal data outside the European Economic Area.
Designed to be the toughest privacy law worldwide, Europe’s GDPR is based on seven key principles:
- Lawfulness, fairness, and transparency: Processing must be lawful, fair, and transparent to the data subject.
- Purpose limitation: You must process data for the legitimate purposes specified explicitly to the data subject when you collected it.
- Data minimization: You should collect and process only as much data as absolutely necessary for the purposes specified.
- Accuracy: You must keep personal data accurate and up to date.
- Storage limitation: You may only store personally identifying data for as long as necessary for the specified purpose.
- Integrity and confidentiality: Processing must be done in such a way as to ensure appropriate security, integrity, and confidentiality (e.g. by using encryption).
- Accountability: The data controller is responsible for being able to demonstrate GDPR compliance with all of these principles.
Europe’s move inspired other jurisdictions to follow suit. Although the United States does not have a standardized federal privacy policy in place, some states recently passed their own data privacy legislation to expand resident rights and protection. This includes California, Virginia, and Colorado.
The impetus for data privacy and protection has even reached China. The country recently approved a Personal Information Protection Law (PIPL) that includes stringent control of cross-border data transfers.
These new legal frameworks are not to be taken lightly, as evidenced by the fines of hundreds of millions that were charged to such companies as Amazon or Facebook over their personal data processing and storage practices.
In a nutshell, virtually all business activities are feeling the impact of the likes of GDPR.
We cannot understate the influence of GDPR on supply chains. Businesses have to review and possibly adjust data sharing practices with their third-party supplier, subcontractor, and distributor ecosystems.
Innovation and new product development managers must consider completely new requirements—or risk shunning in some markets. After all, data privacy laws are the reason Google had to forgo the launch of a selfie app in some American states.
Advertising and marketing activities are obviously impacted by the new necessity to document customer information storage and usage and allow consumers to opt in or out of data collection and processing. The same challenges apply to any business that sells products, services or content online. This comes just as e-commerce and marketing activities are also preparing for the impending elimination of third-party cookies from Web browsers.
Employee education and training on best practices
In specific lines of business (for example healthcare services providers), employees must comply with industry-specific provisions that enforce even more stringent requirements.
Another significant impact of data privacy regulations for businesses across industries and geographies is increased aversion to technology risk. After all, data breaches or leaks now come with heftier legal and reputational consequences — on top of the financial and operational harm. Accordingly, technology vendors and consulting firms are under increased scrutiny to obtain information security management certifications.
However, data protection regulation doesn’t only raise challenges or issues. It can also be viewed as a new opportunity to re-establish data management and governance practices on sounder foundations. To improve assessment and mitigation of data risk and to optimize IT and data architecture — therefore, creating operational efficiencies and reducing costs.
Finally, compliance with the new legal frameworks has the potential to increase consumer trust.
- What Are the Main Problems in Project Portfolio Management?
- Everything You Need to Know About Project Portfolio Management Software
- The Key Features and Benefits of Project Portfolio Management Systems
Valerie Zeller
Valerie is Sciforma Chief Marketing Officer. Main interests: digital transformation, change management, strategy execution. Send your thoughts @valeriezeller