Tech Giants Brace for Europe’s New Data Privacy Rules
nytimes.com
nytimes.com
As a programmer who has to make sure my code and business conform to these regulations it will mean more effort.
Taken together I'd rather have the data protections for me and my family, so on balance I'm happy with the data protection laws in Europe, and the strengthening of them these rules bring in.
For example your data scientist can't now look at the raw data and decide to feed it into some new machine learning process to identify fraudulent transactions if when the data was collected explicit consent wasn't obtained to do that.
Technical people now need to understand what data is 'protected' by GDPR and what consents have been given for the processing of that data. And that for example linking an IP address to a piece of data can suddenly transform it into personal data now protected by GDPR.
With internal audit you're generally overseeing the compliance folks (from a distance), as a compliance person you're more often implementing the technology yourself. Another role to look into is risk management. All of them are a small step back from "hard" IT like sysadmin or programming and getting more into the people and process side of the IT house.
Highly recommend the move for anyone who doesn’t want to be on call or carry a pager anymore.
But with regards to your point about having a law degree - I'm not sure where you're based but a qualified solicitor with a specialism in cyber law and data protection here in the UK will be set for a while. The GDPR enforcement date is a cash cow for consultants, but for lawyers this is just the beginning.
Edit: After seeing what freehunter posted at the same time as me - If you don't want to go through the hassle of becoming a qualified solicitor, then compliance is definitely a way to go. GDPR sets out a requirement for organisations to employ 'Data Protection Officers' so if compliance/risk management is of interest to you then the compliance ladder is pretty solid.
It's not just GDPR, but lots of other EU regulations this year that are having large impacts on tech systems (e.g. in the financial world), and being across those is valuable.
Perhaps you won't get your hands dirty on actual code, but technical implementation of regulation is a lucrative field (or, at least, this phase of "oh shit we need to do something" is).
Banks, especially, are inundated with regulations (high-level, abstract) that necessitate technical (low-level, concrete) implementations or adaptations. Often, there are great legal minds at work on the one side, and great technical minds on the other side, with a large gap and significant barriers communication in between.
Being proficient in both of these matters can enable one to bridge that gap.
European banks are scrambling to patch software to purge older records. Backup strategies have to be changed to accommodate this as well.
The GDPR is not really a law in the conventional sense. It's better understood as a political maneuver. I've been researching it lately as it may affect the company I work for (which has a presence in the EU, well UK, but EU for now).
First problem - the GDPR is so vague that it's impossible to know what it really says, what it bans and what it allows. With just months to go before enforcement begins there are still 50/50 splits amongst legal professionals about basic things like how it affects backup strategies. For instance if someone invokes their "right to be forgotten", do you have to restore and rewrite all backup tapes? Or can you filter out their data at restore time? If not then what if you start getting a constant stream of forget-me requests - do your backups have to be now constantly rewritten and if so, are they still really backups? What about if someone emails you from Europe. You now hold their "personal data", so what if they ask you to delete it? Do you have to erase not just their email but any email that quotes or forwards that email? If so, how exactly can you do that given that no email software supports such a feature? What if you're hosting email and someone emails one of your users, then demands to be forgotten - do you erase their email right out of your users inbox? These are just a few obvious questions of hundreds.
Second problem - the new regulator being set up does not issue binding decisions except in case of cross-border disputes. If you want clarification you're meant to ask local data protection agencies, or the new regulator, but the answers you get back might be wrong, or too vague to be useful, and there's nothing you can do.
Third problem - the potential fines are so vast they could instantly bankrupt most companies. So not only is there a law you can't ever be sure you're in compliance with, because it's so badly written, but if the EU decides you are in violation, that can be the end of your firm.
The cynic in me looks at this terrible low quality law and frankly doesn't see a law at all. He sees a political project - namely a clever way to sidestep the EU treaty's ban on the EU levying a corporation tax. With increasing euroscepticism across the continent the chance of the EU being given direct tax raising powers is now very low, but the EU is stuffed with true believers who want to turn it into a new country ("Europe") that replaces the existing countries. To become the new de-facto government of Europe the EU must be able to fund itself and not rely on member states or their pesky votes .... being able to fund itself by "fining" i.e. taxing foreign tech firms for endless violations of a law they cannot ever hope to understand is an ideal way to do this.
I am curious on how did they arrive at the 4% cap?
For example, if you're in e-commerce like my previous employer, then having your website/app channels shut down while you implement some bizarre scheme can cost you even more than 4% of your annual revenue. For a big, established company with byzantine operations and large code bases, being caught entirely unprepared can mean a mountain of effort - months - to become compliant.
(And I haven't checked but I imagine it's past year's revenue that is used for the calculation so the double whammy doesn't even get reduced by being shut down.)
I imagine the four percent had to be large enough to motivate compliance without scaring people away and further fueling anti-EU sentiment? I'm just speculating.
Voting for a government doesn't require that level of in depth knowledge because you are voting on wether you feel the direction of the country is right and you can then change that decision in a few years time.
Allow me to introduce you to https://en.wikipedia.org/wiki/Brexit
Already noted.
Saying "besides Brexit, what anti-EU sentiment are you talking about" is like saying "besides oxygen, what gasses do you inhale in order to survive". Sure other gasses may exist... but you're kinda missing a big one.
This would be a value-added tax levied at every step in the supply chain. It's a bad idea because it favors large, vertically integrated companies.
And the of course the big advantage that the EU has over other clusters of countries is the (mostly) unified legal and regulatory system. Which makes it easy to target every country in the EU at the same time.
I think the EU has had a lot of soft-power for a very long time, and we are finally starting to see it flexing that power to protect it's citizens.
[1]. http://ec.europa.eu/trade/policy/eu-position-in-world-trade/...
What global tech company can really afford not to be in Europe? Google? Facebook? Twitter?
Now I wonder what might happen if a company says it's not sharing then their data is found somewhere (yes, I'm thinking about the Asian companies)
I think the biggest thing about the GDPR might be encouraging companies to not hoard data and not ask for lots of personal data "just because"
>Among their provisions, the rules enshrine the so-called right to be forgotten into European law
Codifying a terrible ruling into law.
>The rules also require anyone under 16 to obtain parental consent before using popular digital services
It's like COPA but at least an order of magnitude worse.
>... the company unveiled a program that uses artificial intelligence to monitor Facebook users for signs of self-harm. But it did not open the program to users in Europe... The social network has also kept out of Europe facial recognition software that tracks when photos of users are posted across the platform.*
It hinders innovation, and these examples are probably the least of it.
It is very much apparent that these rules were meant for US companies but they will very likely hinder the growth and even the formation of smaller companies that in turn will have to dedicate non trivial resources to insure compliance. Inadvertently or not the EU have introduced a huge barrier to entry.
Additionally GDPR simply enshrines some pretty basic social norms around informed consent and transparency. It doesn't prevent anyone doing anything that's privacy invasive, it just requires that:
1) You tell people what you are doing with their data (in plain English)
2) You get their informed consent and give them the option to opt-out (additionally you can't bundle multiple "purposes" together).
Both of those things seem pretty fair to me, and it certainly a standard that we apply to other aspects of life (with sex being the most obvious example).
So Facebook could train their self-harm detecting AI in the EU, and it can deploy it there. It just needs to ask and get consent from people first, and honour their personal choices.
Equally they could train and deploy their face recognition technology in the EU as well. But again they need to get informed consent, and they can't coerce people by only offering their self-harm technology if they also opt into their face recognition technology (they can't bundle multiple "purposes").
Altogether I think that this is pretty simple and fair, and really technology companies are only suffering because in the past they have collected personal data indiscriminately on the basis that it might be useful some day. And for companies that rely on tricking people into handing over personal data, I don't think the world will suffer without them.
1) Some of the ideas in there are welcome.
2) When you put roadblocks in front of every data point it's difficult to develop a half decent pattern matching system. A consent prompt upon joining ought to suffice.
> technology companies are only suffering because in the past they have collected personal data indiscriminately on the basis that it might be useful some day
Perhaps, but the "might be useful someday" part is a route for many an innovation that I want to preserve.
Companies like DeepMind are already showing that collecting every data point under the sun is unnecessary, and that ML systems can be built with privacy in mind. Anyone that can't be bothered to put the effort in can, quite frankly, die at the hands of the market.
In other words: I really doubt that this is a targeted attack on the US/US companies.
Finally, I think a lot of GDPR is at least as hard to implement for non tech companies as it is in tech/information type companies. The latter at least have lots of in house expertise in both tech and usually tech related law. It's just really expensive for them. More traditional companies that run some crazy IT system built by an outsourcer 20 years ago might have a bigger problem.
Disclaimer and source: implemented several GDPR components when working at Booking.com.
That makes no sense. The rules are not different for US companies so how can it be an attack on them?
>The social network has also kept out of Europe facial recognition software that tracks when photos of users are posted across the platform.
Are you sad about this? If so, why?
That seems like a disingenuous question, the companies that are mainly impacted by these laws are US companies. It might theoretically apply to all companies but in reality they had a handful of US companies in mind when they wrote theses regulations.
As for the impeded innovation question, yes I feel that something is lost when a "cool" and useful feature is prevented from materializing.
Any company who handles personal data is impacted. Facebook and Google are not the only ones which do. European online shops and banks also have to comply.
Just because Facebook and Google generate the most press on this issue doesn't mean it is an attack on them in particular. Privacy and data concerns are real societal issues. Tackling them is absolutely necessary and the EU is doing a good job by ruling that we own our data.
Sure in the best case you can do a lot of good with such data. But that would probably need the data to be open to researchers, not in some corporate silo somewhere.
And in the worst case, pervasive surveillance data can do a lot of harm. Just ask yourself what an organization like the Stasi could have done with that kind of data.
Care to elaborate?