Wired

It’s Time to Switch to a Privacy Browser

THERE'S A NEW battleground in the browser wars: user privacy. Firefox just made its Enhanced Tracking Protectiona default feature, Apple continues to pile privacy-focused features into its Safari browser, and people are more aware than ever before of the sort of information they can revealevery time they set a
/
ZDnet

Apple’s Tim Cook: Silicon Valley has created privacy-violating ‘chaos factory’

Big tech companies are failing to take responsibility for the chaos that their innovations have created, according to Apple CEO Tim Cook...
/

US GDPR

Recently, I was reading an article from The Hartford on how to protect business income. The Hartford recommends something that seems like a no-brainer to anyone who has ever heard of the cloud — meaning just about anyone doing business today. According to The Hartford, “It’s a good idea to backup your digital data in a cloud-based server and duplicate any data contained in hard assets.”

Despite the apparent obviousness of this statement, it implies something about American businesses and America’s regulatory structure regarding data: there’s no safety net required. Security is optional. Companies can possess the most valuable information about individuals. Companies can possess information that sums up your entire life, information that can be the difference between poverty and wealth, information worth billions of dollars, information that, in a capitalist system, can quite literally make the difference between life and death. Yet we — or rather, the government — doesn’t require companies to back that data up.

Data Recovery Services

The quick rejoinder is that requiring companies to backup data gives an unfair advantage to companies that sell cloudspace and other types of backup. It only takes two words to dispel that argument: private cloud. Others might contend that private blockchains could do the job. For EU lawmakers preparing to implement GDPR, it doesn’t matter what type of backup you choose, as long as your security measures are stringent and respectful of the datasource: EU citizens.

It might seem naive to ask this question, but why isn’t there a US GDPR? If your US-based company uses EU citizen data and doesn’t comply with GDPR’s strict rules, your company could get stung with a huge fine — nearly $24 million, or 4 percent of your annual global turnover, whichever is greater. If a EU-based company uses a US citizen’s personal data contrary to the spirit of GDPR, they get stung with … nothing. They might get hit with a lawsuit, but we all know how well corporate lawyers with millions of euros at their disposal can do against private citizens who don’t have as much cash to throw at problems.

In other words, the EU stands to make a great deal of money from US companies that mess this up, while US companies stand to lose. With the number of lobbyists and lawyers US companies have on their payroll (Steven Brill, founder of American Lawyer magazine, says there are twenty lobbyists for every one member of congress), you’d think there would be a bill to rival GDPR.

The only thing US-based companies can do besides lobby for such a bill is batten down the hatches in preparation for the coming GDPR storm. A last minute GDPR checklist reveals what that entails:

  1. Your company must find out if any of the data you’re mining is EU citizen data.
  2. Your company must determine whether any of the EU citizen data in your database is “sensitive data” — that is, data of a personal nature (see GDPR Article 9).
  3. Find out where you’re storing EU citizens’ sensitive data.
  4. Make sure you can easily cleanse your IT systems of all sensitive data, and that you can easily cease targeted marketing activities.
  5. Find out whether you can implement “privacy by design” with your IT processes.
  6. If you can’t implement privacy by design through built-in protocols, you’ll need to overhaul IT and make sure security and data privacy measures are in place at every touchpoint.
  7. Make sure you can immediately erase any EU citizens’ data — they have the right to be forgotten.
  8. For data breaches in which a EU citizens’ data is involved, you must report the breach within 72 hours; make sure you have a response plan in place such that no more data is vulnerable.
  9. If your organization mines and processes large amounts of sensitive personal data on EU citizens, you should hire a Data Protection Officer.

As you can see, a “last minute GDPR checklist” is no small item. In fact, Bloomberg reports that the world’s 500 biggest companies are spending $7.8 billion on GDPR compliance.

Overall, a greater number of EU companies have more at stake here. But some US-based companies process more data than anyone else in the world. Microsoft alone has 300 engineers working on the problem.

If the US were to implement its own version of GDPR, it would accomplish two things. One, it would show US citizens that the government actually cares about democracy and our right to control our own data. Two, it would level the playing field. European firms wouldn’t be able to continue capitalizing on US citizens’ personal data unless US citizens give consent.

For now, all we can do is prepare for GDPR, sit back, and watch this development play out. Once the first violation occurs, we’ll see how successful the EU is at collecting $24 million dollars from a shamefaced American company with plenty of lawyers at its disposal.

By Daniel Matthews

Daniel Matthews

Daniel Matthews is a freelance writer from Boise, ID. Daniel received his Bachelor's in English from Boise State University in 2006, and is currently working on a book about the 2008 financial crisis. Widely-published online, he specializes in research and analysis that sheds light on the intersection of tech, business, and current affairs. Daniel is an avid writer and technology enthusiast whose mission is to bring journalistic integrity and informed opinions to his audience in ways that make them think differently about the world. You can find him on Twitter and LinkedIn.

View Website
Business Intelligence Implementation

10 Tips For Successful Business Intelligence Implementation

Business Intelligence Implementation The cost of Business Intelligence (BI) software goes far beyond the purchase price. Time spent researching, implementing, ...
Marty Puranik

HIPAA Risk Assessment Guide for Smaller Practices

HIPAA Risk Assessment Guide Disconcertingly, one in four practices (25%) are failing meaningful use audits by the Centers for Medicare ...
Why Accept the Hype? Time to Transform How We Approach Emerging Technology

Why Accept the Hype? Time to Transform How We Approach Emerging Technology

Time to Transform How We Approach Emerging Technology It’s like a rite of passage – a new technology pops onto ...
Security infographic

Survey: 87% of Businesses Are Confident About Cybersecurity

Businesses Confident About Cybersecurity In a year that has seen multiple massive data breaches and troubling cyberattacks, a new survey ...
Slack

Slack to take unusual route to public markets, likely valuing it around $16 billion

/
NEW YORK (Reuters) - Slack Technologies, the fast-growing workplace messaging and communication platform, is poised for an unusual public listing on Thursday that will see it trade on the New ...
Tech Crunch

Libra currently looks more like a fiat currency than a cryptocurrency

/
Facebook unveiled a cryptocurrency called Libra yesterday as well as the Libra Association, a not-for-profit that will oversee all things Libra. While Libra’s white paper draws a lot of inspiration from other cryptocurrencies, the current ...
IBM

IBM to win unconditional EU okay for $34 billion Red Hat deal: sources

/
BRUSSELS (Reuters) - U.S. tech giant International Business Machines Corp is set to secure unconditional EU approval for its $34 billion bid for software company Red Hat, people familiar with ...