GDPR requirements put focus on data ethics, governance

What hath GDPR wrought?

Jeff Smits

Meanwhile, even companies that endorse the GDPR ethos admit there are challenges in implementation. "GDPR has a great spirit to it, but it certainly also has far-reaching business implications that I don't think the EU fully understands," said Jeff Smits, vice president of IT and business services at RingCentral, a Belmont, Calif., provider of cloud-based telephone, messaging and collaboration services to businesses.

Nonetheless, Smits is confident that everything will be in order at his company by next month's compliance deadline. "We're pretty far down the path at this point," he said. "We'll be ready."

GDPR has a great spirit to it, but it certainly also has far-reaching business implications that I don't think the EU fully understands.

Containing 10 chapters and some 99 articles, the GDPR is a complex standard. The regulation's articles of enforcement leave room for some interpretation. But it also details possible penalties for parties that fail to safeguard data privacy. In some ways, GDPR requirements are an update or restatement of the existing EU Data Protection Directive of 1995. Here are some important highlights of the newer directive:

• Article 17 spells out the "right to be forgotten" -- also known as the right of erasure. The article compels companies doing business in the EU to be prepared to locate the data they hold on individuals and scrub it from their records if requested by users.
• Article 32 outlines methods to use in pursuit of data processing security, including anonymizing and encrypting personal data to ensure a level of security "appropriate to the risk."
• Article 33 includes detailed requirements for handling data breaches. It sets 72 hours as the limit for alerting supervisory authorities of the breach. Individuals should be notified of such breaches without "undue delay."
• Article 37 calls for designation of a data protection officer (DPO). The requirement isn't altogether clear. Companies with large-scale data stores are to be covered by GDPR, and exactly what that means can vary according to interpretation. (See "Do you need to hire a data protection officer?")

Behind each article are possible EU penalties. Within companies, that has spurred high-level discussions rippling through their legal, security, data management, marketing and other departments at different rates in different industries and geographies.

Do you need to hire a data protection officer?

Cindy Zhou

GDPR regulations specify that the DPO is necessary for companies that process data "on a large scale." But they offer no tangible definition of what constitutes large quantities of data, per se. If you are a Global 1000 company, however, it's better to be safe than sorry, Constellation Research analyst Cindy Zhou said.

"There's a lot of room for interpretation in GDPR," added J.R. Cunningham, vice president of product management at security services company Optiv Security. "If the framers of the regulation could have done anything differently, they would have done something similar to [Payment Card Industry] standards, where different levels are actually defined. We see companies that are very small who feel they have to have a DPO; meanwhile, others who are very large [are] getting legal opinions that say, 'No, we're good.'"

DPO positions "will start in large corporations and, over time, trickle down to become a key role in smaller organizations," consultant David Wells predicted. "Initially, I think those without a designated data privacy officer will make existing compliance and/or risk officers responsible for data privacy."

According to TechTarget's "2018 IT Priorities Survey," just 8% of North American IT professionals counted " for GDPR" among the broad initiatives their companies would implement this year, while a more strident 29% of their European counterparts cited for GDPR as a 2018 initiative.

Examining mistakes of the past

Are U.S. companies merely waiting to see if the EU or some consumer advocacy group goes after a high-profile player like Facebook , before working out their GDPR compliance strategy? (See "Facebook may well be the proverbial canary in the GDPR mine.")

Cases of law may in fact help iron out the fine GDPR details, Optiv Security's Cunningham said. The reaction of U.S. companies to GDPR, he added, may be influenced by prior experiences; they had seen the mistakes of the past when companies attempted to comply with regulations that weren't completely understood.

J.R. Cunningham

"If we look at prior regulations, such as the [Payment Card Industry] standard, [Health Insurance Portability and Accountability Act] or Sarbanes-Oxley, one of the things that we have seen is that companies would race to become compliant, but they weren't taking care of their overall security program properly," Cunningham explained. "Let's not rush to just 'check boxes.' There's a lot left to be fleshed out."

GDPR requirements could spark renewed interest in and commitment to data governance, according to Wells. "GDPR is 'big noise' today, but, like all things, [it] will become just one more among many corporate and data management pressures," he said.

Software that can help in complying with GDPR includes data ingestion, data pipeline, data preparation, data analysis and data lake tools, Wells advised. Add to that list data security tools that mask, anonymize and scramble data.

Mark Ramsey

Anonymizing technology is important among the tools used for overall data governance and GDPR-specific efforts at GlaxoSmithKline (GSK) PLC, according to Mark Ramsey, senior vice president and chief data officer at the London-based pharmaceutical giant. The company, which has worked to build and expand a centralized Hadoop data lake to make all kinds of data more readily available to various GSK departments, has dealt with data masking and anonymizing issues in the process.

To protect privacy, Ramsey said, governance should be applied at the point of data ingestion, when the data is into analytical systems, a step GSK is taking with software from StreamSets that can identify personal data as it's ingested. "We have automated the movement of data into the data lake," he explained. "We can discover data and anonymize or mask it at the same time we are moving that data."

He said the basic tenets of GDPR are not to GSK, whose clinical studies have always required informed consent to use patient data. "GDPR is a next-generation combining of things," he surmised, "making sure people provide consent for use of their data."

We can discover data and anonymize or mask it at the same time we are moving that data.

RingCentral's Smits said his company is creating a combination of manual, policy-based and automated processes to manage retention and deletion of personal data and respond to right-to-be-forgotten requests from EU residents. In some cases, the cloud communications company plans to obfuscate data to avoid skewing its operational records -- an approach that outside consultants blessed as "an adequate way to forget data," Smits noted.

RingCentral has deployed data governance software to track the data management policies, where personal data is stored and other aspects of its GDPR program. In addition, it plans to use data integration tools from Talend to pull together personal data from a variety of systems as part of the compliance effort.

While the detailed effect of GDPR is hard to predict, the opportunity it presents to reset the big data ethos is worth emphasizing, according to Constellation Research analyst Steve Wilson. "If data is the 'crude oil' as many people say, then we are going to see a host of societal norms, rules and legislation in the next 10 to 20 years," he noted. "This will all be for the better. The Wild West days are coming to an end."

Craig Stedman, senior executive editor in TechTarget's Business Applications and Information Management Media Group, also contributed to this article.