Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

7/12/2016
11:30 AM
Kaushik Narayan
Kaushik Narayan
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

EUs General Data Protection Regulation Is Law: Now What?

Organizations have two years to prepare to act as borrowers, not owners, of customer data. Here are seven provisions of the new GPDR you ignore at your peril.

It’s time for companies to face the music on data privacy. EU legislators signed data privacy regulations into law in April, and the clock is ticking for implementation in 2018. Before we entertain objections that the law places unreasonable demands on companies with EU citizens’ personal data, let’s remember that security and privacy are joined at the hip. You can’t ensure data privacy without adequate information security.

Moving forward without proper security only slows the progress companies push for. Consumers have lost faith in cybersecurity in digital commerce and online activity, according to a recent National Telecommunications and Information Administration (NTIA) survey. The General Data Protection Regulation (GDPR) will hold companies accountable for security controls they should already have in place. New regulations are not only necessary, they’re overdue.

Getting Acquainted with the GDPR
Organizations essentially have two years to prepare to act as data borrowers, not owners. When a company collects customer data, it is on loan. The customer can monitor its use, decide who accesses it, and demand its return. A company must have the ability to audit and control each of these processes in order to comply with the new law. One can imagine how difficult this will be for global enterprises with thousands of vendors and partners. The sooner organizations can start, the better. The new law comes into effect on May 25, 2018.

IT, security, and compliance practitioners must familiarize themselves with the requirements. Ambitious readers can find the 200-page law available online, or an in-depth guide. To get started, here are seven key provisions you should not ignore:

  1. Fines With Teeth: In the past, regulators claim companies brushed fines off as mere "pocket money." Individual countries defined their own fines, further exacerbating the challenge to the regulation’s impact. The new law will raise the maximum fine to four percent of global revenue or €20M, whichever is higher.
  2. Ringing the Data Breach Alarm: We’ve grown accustomed to data breach notifications coming months after the fact – or even years. Under the new law, companies will have 72 hours to report data loss to their regional authority. Reducing the timeline from months to hours will force companies to put in place defined policies on responding to data breaches. If you thought having a breach response plan in place was a given, think again: only 44.5% of companies have a complete plan, according to a Cloud Security Alliance survey.
  3. Regulations Beyond Borders: This provision should grab the attention of any global companies who were exempt from the previous regulation because they were not headquartered in the EU. Now any organization with data on EU individuals must comply with the regulation, wherever they are based. Experts have already predicted the law will encompass "pretty much every website and app in the world."
  4. Know Your Partners: Hackers have realized that the easiest path to a company’s sensitive data can be third-party contractors, from an HVAC vendor to a press release wire service. Under the new law, any company who touches regulated data must comply with the law, even if they are not the data collector. For companies who do not have a full list of vendors and business partners, taking inventory and evaluating risk will be an essential undertaking.
  5. No Running from the Law: Companies can transfer data outside the EU, including to cloud providers with servers based in other countries. The company does not hand off responsibility and still remains liable for any lost data.
  6. One Law for One Continent: Up until now, enforcement on data privacy infractions has been inconsistent even among European countries, with certain countries taking tougher stances than others. The GDPR will standardize all countries under the same strict law, so there will be no surprises for companies based on the region of enforcement. 
  7. Encryption as a Saving Grace: Encryption is a powerful tool for reducing risk in the event of data loss, and the GDPR recognizes this capability. Encrypting data exempts a company from its breach notification responsibility. Rather than encrypt all customer data, companies should encrypt fields containing regulated data. Doing so before data leaves the company network can also provide a method of reducing third-party risk, especially from cloud providers.

Companies collect more information on customers than ever as business moves online and data collection happens so seamlessly that companies can lose sight of the responsibility that comes with storing sensitive information. The GDPR codifies the belief that "the protection of natural persons in relation to the processing of personal data is a fundamental right…" Rather than fight the regulation, companies should embrace the new requirements as a means of establishing trust with customers and ultimately accelerating digital commerce.

Related content:

Kaushik Narayan is a co-founder and CTO at Skyhigh Networks, where he is responsible for Skyhigh's technology vision and software architecture. He brings over 18 years of experience driving technology and architecture strategy for enterprise-class products. He has been ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Pablo Valerio
50%
50%
Pablo Valerio,
User Rank: Strategist
7/13/2016 | 11:13:52 AM
Re: Great Britain exits the EU: Now what?
Charlie, it is highly likely that the UK will join the European Economic Area (EEA) as a way to stay in the common market (the Norway option) without EU membership. Leaving the single market altogether will be disastrous.

Being part of the EEA, however, requres full compliance with EU regulations. The case law of the Court of Justice of the European Union is also of relevance to the EEA Agreement. 

For the most part the UK will probably have to comply with the GDPR, but it will have no voice in the EU council, nor in the EU parliament.

(for the record, I'm married to a Brit and she is really mad about Brexit)
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Ninja
7/12/2016 | 2:14:31 PM
Great Britain exits the EU: Now what?
"The GDPR will standardize all countries under the same strict law," the story says, which is true until Britain exits the European Union. Then it will either have to comply with the GDPR or data will have to migrate across the English channel.  
7 Ways VPNs Can Turn from Ally to Threat
Curtis Franklin Jr., Senior Editor at Dark Reading,  9/21/2019
Security Pros Value Disclosure ... Sometimes
Dark Reading Staff 9/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I wish they'd put a sock in it.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10754
PUBLISHED: 2019-09-23
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
CVE-2019-10755
PUBLISHED: 2019-09-23
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
CVE-2019-1255
PUBLISHED: 2019-09-23
A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service Vulnerability'.
CVE-2019-1367
PUBLISHED: 2019-09-23
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1221.
CVE-2019-11277
PUBLISHED: 2019-09-23
Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance creation, facilitating the malicious space developer to deny se...