Cloud
7/12/2016
11:30 AM
Kaushik Narayan
Kaushik Narayan
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

EUs General Data Protection Regulation Is Law: Now What?

Organizations have two years to prepare to act as borrowers, not owners, of customer data. Here are seven provisions of the new GPDR you ignore at your peril.

It’s time for companies to face the music on data privacy. EU legislators signed data privacy regulations into law in April, and the clock is ticking for implementation in 2018. Before we entertain objections that the law places unreasonable demands on companies with EU citizens’ personal data, let’s remember that security and privacy are joined at the hip. You can’t ensure data privacy without adequate information security.

Moving forward without proper security only slows the progress companies push for. Consumers have lost faith in cybersecurity in digital commerce and online activity, according to a recent National Telecommunications and Information Administration (NTIA) survey. The General Data Protection Regulation (GDPR) will hold companies accountable for security controls they should already have in place. New regulations are not only necessary, they’re overdue.

Getting Acquainted with the GDPR
Organizations essentially have two years to prepare to act as data borrowers, not owners. When a company collects customer data, it is on loan. The customer can monitor its use, decide who accesses it, and demand its return. A company must have the ability to audit and control each of these processes in order to comply with the new law. One can imagine how difficult this will be for global enterprises with thousands of vendors and partners. The sooner organizations can start, the better. The new law comes into effect on May 25, 2018.

IT, security, and compliance practitioners must familiarize themselves with the requirements. Ambitious readers can find the 200-page law available online, or an in-depth guide. To get started, here are seven key provisions you should not ignore:

  1. Fines With Teeth: In the past, regulators claim companies brushed fines off as mere "pocket money." Individual countries defined their own fines, further exacerbating the challenge to the regulation’s impact. The new law will raise the maximum fine to four percent of global revenue or €20M, whichever is higher.
  2. Ringing the Data Breach Alarm: We’ve grown accustomed to data breach notifications coming months after the fact – or even years. Under the new law, companies will have 72 hours to report data loss to their regional authority. Reducing the timeline from months to hours will force companies to put in place defined policies on responding to data breaches. If you thought having a breach response plan in place was a given, think again: only 44.5% of companies have a complete plan, according to a Cloud Security Alliance survey.
  3. Regulations Beyond Borders: This provision should grab the attention of any global companies who were exempt from the previous regulation because they were not headquartered in the EU. Now any organization with data on EU individuals must comply with the regulation, wherever they are based. Experts have already predicted the law will encompass "pretty much every website and app in the world."
  4. Know Your Partners: Hackers have realized that the easiest path to a company’s sensitive data can be third-party contractors, from an HVAC vendor to a press release wire service. Under the new law, any company who touches regulated data must comply with the law, even if they are not the data collector. For companies who do not have a full list of vendors and business partners, taking inventory and evaluating risk will be an essential undertaking.
  5. No Running from the Law: Companies can transfer data outside the EU, including to cloud providers with servers based in other countries. The company does not hand off responsibility and still remains liable for any lost data.
  6. One Law for One Continent: Up until now, enforcement on data privacy infractions has been inconsistent even among European countries, with certain countries taking tougher stances than others. The GDPR will standardize all countries under the same strict law, so there will be no surprises for companies based on the region of enforcement. 
  7. Encryption as a Saving Grace: Encryption is a powerful tool for reducing risk in the event of data loss, and the GDPR recognizes this capability. Encrypting data exempts a company from its breach notification responsibility. Rather than encrypt all customer data, companies should encrypt fields containing regulated data. Doing so before data leaves the company network can also provide a method of reducing third-party risk, especially from cloud providers.

Companies collect more information on customers than ever as business moves online and data collection happens so seamlessly that companies can lose sight of the responsibility that comes with storing sensitive information. The GDPR codifies the belief that "the protection of natural persons in relation to the processing of personal data is a fundamental right…" Rather than fight the regulation, companies should embrace the new requirements as a means of establishing trust with customers and ultimately accelerating digital commerce.

Related content:

Kaushik Narayan is a co-founder and CTO at Skyhigh Networks, where he is responsible for Skyhigh's technology vision and software architecture. He brings over 18 years of experience driving technology and architecture strategy for enterprise-class products. He has been ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Pablo Valerio
50%
50%
Pablo Valerio,
User Rank: Strategist
7/13/2016 | 11:13:52 AM
Re: Great Britain exits the EU: Now what?
Charlie, it is highly likely that the UK will join the European Economic Area (EEA) as a way to stay in the common market (the Norway option) without EU membership. Leaving the single market altogether will be disastrous.

Being part of the EEA, however, requres full compliance with EU regulations. The case law of the Court of Justice of the European Union is also of relevance to the EEA Agreement. 

For the most part the UK will probably have to comply with the GDPR, but it will have no voice in the EU council, nor in the EU parliament.

(for the record, I'm married to a Brit and she is really mad about Brexit)
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Ninja
7/12/2016 | 2:14:31 PM
Great Britain exits the EU: Now what?
"The GDPR will standardize all countries under the same strict law," the story says, which is true until Britain exits the European Union. Then it will either have to comply with the GDPR or data will have to migrate across the English channel.  
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: No, no, no! Have a Unix CRON do the pop-up reminders!
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.