Why Isn’t There a US GDPR?

US GDPR

Recently, I was reading an article from The Hartford on how to protect business income. The Hartford recommends something that seems like a no-brainer to anyone who has ever heard of the cloud — meaning just about anyone doing business today. According to The Hartford, “It’s a good idea to backup your digital data in a cloud-based server and duplicate any data contained in hard assets.”

Despite the apparent obviousness of this statement, it implies something about American businesses and America’s regulatory structure regarding data: there’s no safety net required. Security is optional. Companies can possess the most valuable information about individuals. Companies can possess information that sums up your entire life, information that can be the difference between poverty and wealth, information worth billions of dollars, information that, in a capitalist system, can quite literally make the difference between life and death. Yet we — or rather, the Government — doesn’t require companies to back that data up.

Data Recovery Services

The quick rejoinder is that requiring companies to backup data gives an unfair advantage to companies that sell cloudspace and other types of backup. It only takes two words to dispel that argument: private cloud. Others might contend that private blockchains could do the job. For EU lawmakers preparing to implement GDPR, it doesn’t matter what type of backup you choose, as long as your security measures are stringent and respectful of the datasource: EU citizens.

It might seem naive to ask this question, but why isn’t there a US GDPR? If your US-based company uses EU citizen data and doesn’t comply with GDPR’s strict rules, your company could get stung with a huge fine — nearly $24 million, or 4 percent of your annual global turnover, whichever is greater. If a EU-based company uses a US citizen’s personal data contrary to the spirit of GDPR, they get stung with … nothing. They might get hit with a lawsuit, but we all know how well corporate lawyers with millions of euros at their disposal can do against private citizens who don’t have as much cash to throw at problems.

In other words, the EU stands to make a great deal of money from US companies that mess this up, while US companies stand to lose. With the number of lobbyists and lawyers US companies have on their payroll (Steven Brill, founder of American Lawyer magazine, says there are twenty lobbyists for every one member of congress), you’d think there would be a bill to rival GDPR.

The only thing US-based companies can do besides lobby for such a bill is batten down the hatches in preparation for the coming GDPR storm. A last minute GDPR checklist reveals what that entails:

  1. Your company must find out if any of the data you’re mining is EU citizen data.
  2. Your company must determine whether any of the EU citizen data in your database is “sensitive data” — that is, data of a personal nature (see GDPR Article 9).
  3. Find out where you’re storing EU citizens’ sensitive data.
  4. Make sure you can easily cleanse your IT systems of all sensitive data, and that you can easily cease targeted marketing activities.
  5. Find out whether you can implement “privacy by design” with your IT processes.
  6. If you can’t implement privacy by design through built-in protocols, you’ll need to overhaul IT and make sure security and data privacy measures are in place at every touchpoint.
  7. Make sure you can immediately erase any EU citizens’ data — they have the right to be forgotten.
  8. For data breaches in which a EU citizens’ data is involved, you must report the breach within 72 hours; make sure you have a response plan in place such that no more data is vulnerable.
  9. If your organization mines and processes large amounts of sensitive personal data on EU citizens, you should hire a Data Protection Officer.

As you can see, a “last minute GDPR checklist” is no small item. In fact, Bloomberg reports that the world’s 500 biggest companies are spending $7.8 billion on GDPR compliance.

Overall, a greater number of EU companies have more at stake here. But some US-based companies process more data than anyone else in the world. Microsoft alone has 300 engineers working on the problem.

If the US were to implement its own version of GDPR, it would accomplish two things. One, it would show US citizens that the government actually cares about democracy and our right to control our own data. Two, it would level the playing field. European firms wouldn’t be able to continue capitalizing on US citizens’ personal data unless US citizens give consent.

For now, all we can do is prepare for GDPR, sit back, and watch this development play out. Once the first violation occurs, we’ll see how successful the EU is at collecting $24 million dollars from a shamefaced American company with plenty of lawyers at its disposal.

By Daniel Matthews

Jonathan Custance
IoT and cloud computing are on the increase High-profile cybersecurity breaches are increasingly in the news, a prime example being the NHS incident of May 2017 when services were brought to a standstill for several ...
Dana Gardner
Low-code Development Has Entered a Maturity Spurt Closing the gap between the applications and services a company needs -- and the ones they can actually produce -- has long been a missing keystone for attaining ...
Oxylabs
A conversation with Aleksandras Šulženko – Product owner at Oxylabs.io In a global economy where change happens by the second, one of the best ways to keep up with industry information, including your competitors, is ...
Louis
Manufacturers’ Top Demands For Quality Software Competing on product quality has never been more urgent as rising raw material and component costs continue to squeeze manufacturers’ margins. At the same time, unpredictable supply chains make ...
Yuliya Melnik
DevOps Services Outsourcing The sooner you release your unique idea to the public, the higher the chance that it will receive the lion's share of the audience's attention. Delays in development can lead competitors to ...

SECURITY TRAINING

  • Isc2

    ISC2

    (ISC)² provides IT training, certifications, and exams that run online, on your premises, or in classrooms. Self-study resources are available. You can also train groups of 10 or more of your employees. If you want a job in cybersecurity, this is the route to take.

  • App Academy

    App Academy

    Immersive software engineering programs. No experience required. Pay $0 until you're hired. Join an online info session to learn more

  • Cybrary

    Cybrary

    CYBRARY Open source Cyber Security learning. Free for everyone, forever. The world's largest cyber security community. Cybrary provides free IT training and paid IT certificates. Courses for beginners, intermediates, and advanced users are available.

  • Plural Site

    Pluralsite

    Pluralsight provides online courses on popular programming languages and developer tools. Other courses cover fields such as IT security best practices, server infrastructure, and virtualization.