Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

7/12/2016
11:30 AM
Kaushik Narayan
Kaushik Narayan
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

EUs General Data Protection Regulation Is Law: Now What?

Organizations have two years to prepare to act as borrowers, not owners, of customer data. Here are seven provisions of the new GPDR you ignore at your peril.

It’s time for companies to face the music on data privacy. EU legislators signed data privacy regulations into law in April, and the clock is ticking for implementation in 2018. Before we entertain objections that the law places unreasonable demands on companies with EU citizens’ personal data, let’s remember that security and privacy are joined at the hip. You can’t ensure data privacy without adequate information security.

Moving forward without proper security only slows the progress companies push for. Consumers have lost faith in cybersecurity in digital commerce and online activity, according to a recent National Telecommunications and Information Administration (NTIA) survey. The General Data Protection Regulation (GDPR) will hold companies accountable for security controls they should already have in place. New regulations are not only necessary, they’re overdue.

Getting Acquainted with the GDPR
Organizations essentially have two years to prepare to act as data borrowers, not owners. When a company collects customer data, it is on loan. The customer can monitor its use, decide who accesses it, and demand its return. A company must have the ability to audit and control each of these processes in order to comply with the new law. One can imagine how difficult this will be for global enterprises with thousands of vendors and partners. The sooner organizations can start, the better. The new law comes into effect on May 25, 2018.

IT, security, and compliance practitioners must familiarize themselves with the requirements. Ambitious readers can find the 200-page law available online, or an in-depth guide. To get started, here are seven key provisions you should not ignore:

  1. Fines With Teeth: In the past, regulators claim companies brushed fines off as mere "pocket money." Individual countries defined their own fines, further exacerbating the challenge to the regulation’s impact. The new law will raise the maximum fine to four percent of global revenue or €20M, whichever is higher.
  2. Ringing the Data Breach Alarm: We’ve grown accustomed to data breach notifications coming months after the fact – or even years. Under the new law, companies will have 72 hours to report data loss to their regional authority. Reducing the timeline from months to hours will force companies to put in place defined policies on responding to data breaches. If you thought having a breach response plan in place was a given, think again: only 44.5% of companies have a complete plan, according to a Cloud Security Alliance survey.
  3. Regulations Beyond Borders: This provision should grab the attention of any global companies who were exempt from the previous regulation because they were not headquartered in the EU. Now any organization with data on EU individuals must comply with the regulation, wherever they are based. Experts have already predicted the law will encompass "pretty much every website and app in the world."
  4. Know Your Partners: Hackers have realized that the easiest path to a company’s sensitive data can be third-party contractors, from an HVAC vendor to a press release wire service. Under the new law, any company who touches regulated data must comply with the law, even if they are not the data collector. For companies who do not have a full list of vendors and business partners, taking inventory and evaluating risk will be an essential undertaking.
  5. No Running from the Law: Companies can transfer data outside the EU, including to cloud providers with servers based in other countries. The company does not hand off responsibility and still remains liable for any lost data.
  6. One Law for One Continent: Up until now, enforcement on data privacy infractions has been inconsistent even among European countries, with certain countries taking tougher stances than others. The GDPR will standardize all countries under the same strict law, so there will be no surprises for companies based on the region of enforcement. 
  7. Encryption as a Saving Grace: Encryption is a powerful tool for reducing risk in the event of data loss, and the GDPR recognizes this capability. Encrypting data exempts a company from its breach notification responsibility. Rather than encrypt all customer data, companies should encrypt fields containing regulated data. Doing so before data leaves the company network can also provide a method of reducing third-party risk, especially from cloud providers.

Companies collect more information on customers than ever as business moves online and data collection happens so seamlessly that companies can lose sight of the responsibility that comes with storing sensitive information. The GDPR codifies the belief that "the protection of natural persons in relation to the processing of personal data is a fundamental right…" Rather than fight the regulation, companies should embrace the new requirements as a means of establishing trust with customers and ultimately accelerating digital commerce.

Related content:

Kaushik Narayan is a co-founder and CTO at Skyhigh Networks, where he is responsible for Skyhigh's technology vision and software architecture. He brings over 18 years of experience driving technology and architecture strategy for enterprise-class products. He has been ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Pablo Valerio
50%
50%
Pablo Valerio,
User Rank: Strategist
7/13/2016 | 11:13:52 AM
Re: Great Britain exits the EU: Now what?
Charlie, it is highly likely that the UK will join the European Economic Area (EEA) as a way to stay in the common market (the Norway option) without EU membership. Leaving the single market altogether will be disastrous.

Being part of the EEA, however, requres full compliance with EU regulations. The case law of the Court of Justice of the European Union is also of relevance to the EEA Agreement. 

For the most part the UK will probably have to comply with the GDPR, but it will have no voice in the EU council, nor in the EU parliament.

(for the record, I'm married to a Brit and she is really mad about Brexit)
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Ninja
7/12/2016 | 2:14:31 PM
Great Britain exits the EU: Now what?
"The GDPR will standardize all countries under the same strict law," the story says, which is true until Britain exits the European Union. Then it will either have to comply with the GDPR or data will have to migrate across the English channel.  
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
A Lawyer's Guide to Cyber Insurance: 4 Basic Tips
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  7/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13951
PUBLISHED: 2019-07-18
The set_ipv4() function in zscan_rfc1035.rl in gdnsd 3.2.0 has a stack-based buffer overflow via a long and malformed IPv4 address in zone data.
CVE-2019-13952
PUBLISHED: 2019-07-18
The set_ipv6() function in zscan_rfc1035.rl in gdnsd 3.2.0 has a stack-based buffer overflow via a long and malformed IPv6 address in zone data.
CVE-2019-10100
PUBLISHED: 2019-07-18
The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfs_cat_traverse() in lines: 952, 1062. The attack v...
CVE-2019-10102
PUBLISHED: 2019-07-18
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/devel...
CVE-2019-10102
PUBLISHED: 2019-07-18
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically ...