Cloud

7/12/2016
11:30 AM
Kaushik Narayan
Kaushik Narayan
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

EUs General Data Protection Regulation Is Law: Now What?

Organizations have two years to prepare to act as borrowers, not owners, of customer data. Here are seven provisions of the new GPDR you ignore at your peril.

It’s time for companies to face the music on data privacy. EU legislators signed data privacy regulations into law in April, and the clock is ticking for implementation in 2018. Before we entertain objections that the law places unreasonable demands on companies with EU citizens’ personal data, let’s remember that security and privacy are joined at the hip. You can’t ensure data privacy without adequate information security.

Moving forward without proper security only slows the progress companies push for. Consumers have lost faith in cybersecurity in digital commerce and online activity, according to a recent National Telecommunications and Information Administration (NTIA) survey. The General Data Protection Regulation (GDPR) will hold companies accountable for security controls they should already have in place. New regulations are not only necessary, they’re overdue.

Getting Acquainted with the GDPR
Organizations essentially have two years to prepare to act as data borrowers, not owners. When a company collects customer data, it is on loan. The customer can monitor its use, decide who accesses it, and demand its return. A company must have the ability to audit and control each of these processes in order to comply with the new law. One can imagine how difficult this will be for global enterprises with thousands of vendors and partners. The sooner organizations can start, the better. The new law comes into effect on May 25, 2018.

IT, security, and compliance practitioners must familiarize themselves with the requirements. Ambitious readers can find the 200-page law available online, or an in-depth guide. To get started, here are seven key provisions you should not ignore:

  1. Fines With Teeth: In the past, regulators claim companies brushed fines off as mere "pocket money." Individual countries defined their own fines, further exacerbating the challenge to the regulation’s impact. The new law will raise the maximum fine to four percent of global revenue or €20M, whichever is higher.
  2. Ringing the Data Breach Alarm: We’ve grown accustomed to data breach notifications coming months after the fact – or even years. Under the new law, companies will have 72 hours to report data loss to their regional authority. Reducing the timeline from months to hours will force companies to put in place defined policies on responding to data breaches. If you thought having a breach response plan in place was a given, think again: only 44.5% of companies have a complete plan, according to a Cloud Security Alliance survey.
  3. Regulations Beyond Borders: This provision should grab the attention of any global companies who were exempt from the previous regulation because they were not headquartered in the EU. Now any organization with data on EU individuals must comply with the regulation, wherever they are based. Experts have already predicted the law will encompass "pretty much every website and app in the world."
  4. Know Your Partners: Hackers have realized that the easiest path to a company’s sensitive data can be third-party contractors, from an HVAC vendor to a press release wire service. Under the new law, any company who touches regulated data must comply with the law, even if they are not the data collector. For companies who do not have a full list of vendors and business partners, taking inventory and evaluating risk will be an essential undertaking.
  5. No Running from the Law: Companies can transfer data outside the EU, including to cloud providers with servers based in other countries. The company does not hand off responsibility and still remains liable for any lost data.
  6. One Law for One Continent: Up until now, enforcement on data privacy infractions has been inconsistent even among European countries, with certain countries taking tougher stances than others. The GDPR will standardize all countries under the same strict law, so there will be no surprises for companies based on the region of enforcement. 
  7. Encryption as a Saving Grace: Encryption is a powerful tool for reducing risk in the event of data loss, and the GDPR recognizes this capability. Encrypting data exempts a company from its breach notification responsibility. Rather than encrypt all customer data, companies should encrypt fields containing regulated data. Doing so before data leaves the company network can also provide a method of reducing third-party risk, especially from cloud providers.

Companies collect more information on customers than ever as business moves online and data collection happens so seamlessly that companies can lose sight of the responsibility that comes with storing sensitive information. The GDPR codifies the belief that "the protection of natural persons in relation to the processing of personal data is a fundamental right…" Rather than fight the regulation, companies should embrace the new requirements as a means of establishing trust with customers and ultimately accelerating digital commerce.

Related content:

Kaushik Narayan is a co-founder and CTO at Skyhigh Networks, where he is responsible for Skyhigh's technology vision and software architecture. He brings over 18 years of experience driving technology and architecture strategy for enterprise-class products. He has been ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Pablo Valerio
50%
50%
Pablo Valerio,
User Rank: Strategist
7/13/2016 | 11:13:52 AM
Re: Great Britain exits the EU: Now what?
Charlie, it is highly likely that the UK will join the European Economic Area (EEA) as a way to stay in the common market (the Norway option) without EU membership. Leaving the single market altogether will be disastrous.

Being part of the EEA, however, requres full compliance with EU regulations. The case law of the Court of Justice of the European Union is also of relevance to the EEA Agreement. 

For the most part the UK will probably have to comply with the GDPR, but it will have no voice in the EU council, nor in the EU parliament.

(for the record, I'm married to a Brit and she is really mad about Brexit)
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Ninja
7/12/2016 | 2:14:31 PM
Great Britain exits the EU: Now what?
"The GDPR will standardize all countries under the same strict law," the story says, which is true until Britain exits the European Union. Then it will either have to comply with the GDPR or data will have to migrate across the English channel.  
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10008
PUBLISHED: 2019-04-24
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login a...
CVE-2019-9950
PUBLISHED: 2019-04-24
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an authentication bypass vulnerability. The login_mgr.cgi file checks credentials agains...
CVE-2019-9951
PUBLISHED: 2019-04-24
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php...
CVE-2018-10055
PUBLISHED: 2019-04-24
Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memory via a crafted configuration file.
CVE-2018-7577
PUBLISHED: 2019-04-24
Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.