Why Isn’t There a US GDPR?

US GDPR

Recently, I was reading an article from The Hartford on how to protect business income. The Hartford recommends something that seems like a no-brainer to anyone who has ever heard of the cloud — meaning just about anyone doing business today. According to The Hartford, “It’s a good idea to backup your digital data in a cloud-based server and duplicate any data contained in hard assets.”

Despite the apparent obviousness of this statement, it implies something about American businesses and America’s regulatory structure regarding data: there’s no safety net required. Security is optional. Companies can possess the most valuable information about individuals. Companies can possess information that sums up your entire life, information that can be the difference between poverty and wealth, information worth billions of dollars, information that, in a capitalist system, can quite literally make the difference between life and death. Yet we — or rather, the Government — doesn’t require companies to back that data up.

Data Recovery Services

The quick rejoinder is that requiring companies to backup data gives an unfair advantage to companies that sell cloudspace and other types of backup. It only takes two words to dispel that argument: private cloud. Others might contend that private blockchains could do the job. For EU lawmakers preparing to implement GDPR, it doesn’t matter what type of backup you choose, as long as your security measures are stringent and respectful of the datasource: EU citizens.

It might seem naive to ask this question, but why isn’t there a US GDPR? If your US-based company uses EU citizen data and doesn’t comply with GDPR’s strict rules, your company could get stung with a huge fine — nearly $24 million, or 4 percent of your annual global turnover, whichever is greater. If a EU-based company uses a US citizen’s personal data contrary to the spirit of GDPR, they get stung with … nothing. They might get hit with a lawsuit, but we all know how well corporate lawyers with millions of euros at their disposal can do against private citizens who don’t have as much cash to throw at problems.

In other words, the EU stands to make a great deal of money from US companies that mess this up, while US companies stand to lose. With the number of lobbyists and lawyers US companies have on their payroll (Steven Brill, founder of American Lawyer magazine, says there are twenty lobbyists for every one member of congress), you’d think there would be a bill to rival GDPR.

The only thing US-based companies can do besides lobby for such a bill is batten down the hatches in preparation for the coming GDPR storm. A last minute GDPR checklist reveals what that entails:

  1. Your company must find out if any of the data you’re mining is EU citizen data.
  2. Your company must determine whether any of the EU citizen data in your database is “sensitive data” — that is, data of a personal nature (see GDPR Article 9).
  3. Find out where you’re storing EU citizens’ sensitive data.
  4. Make sure you can easily cleanse your IT systems of all sensitive data, and that you can easily cease targeted marketing activities.
  5. Find out whether you can implement “privacy by design” with your IT processes.
  6. If you can’t implement privacy by design through built-in protocols, you’ll need to overhaul IT and make sure security and data privacy measures are in place at every touchpoint.
  7. Make sure you can immediately erase any EU citizens’ data — they have the right to be forgotten.
  8. For data breaches in which a EU citizens’ data is involved, you must report the breach within 72 hours; make sure you have a response plan in place such that no more data is vulnerable.
  9. If your organization mines and processes large amounts of sensitive personal data on EU citizens, you should hire a Data Protection Officer.

As you can see, a “last minute GDPR checklist” is no small item. In fact, Bloomberg reports that the world’s 500 biggest companies are spending $7.8 billion on GDPR compliance.

Overall, a greater number of EU companies have more at stake here. But some US-based companies process more data than anyone else in the world. Microsoft alone has 300 engineers working on the problem.

If the US were to implement its own version of GDPR, it would accomplish two things. One, it would show US citizens that the government actually cares about democracy and our right to control our own data. Two, it would level the playing field. European firms wouldn’t be able to continue capitalizing on US citizens’ personal data unless US citizens give consent.

For now, all we can do is prepare for GDPR, sit back, and watch this development play out. Once the first violation occurs, we’ll see how successful the EU is at collecting $24 million dollars from a shamefaced American company with plenty of lawyers at its disposal.

By Daniel Matthews

Episode 6: Cloud Migration: Why It’s More Important Than Ever

The Importance of Cloud Migration Moving fully to the cloud is still a concern for ...

Episode 5: How the Pandemic is Changing Business and the Cloud

An Interview with Ed Dryer of Steadfast With the global pandemic wreaking havoc on business ...

Episode 1: Why Small and Medium Sized Businesses Need an MSP

Small and Medium Sized Businesses Need an MSP Small and medium-sized businesses don’t enjoy the ...
Sebastian Grady

Digital Transformation – Updated Metrics for the Cloud Era

Cloud Era Metrics Undertaking digital transformation means also transforming how IT success is defined, including metrics that address business in the cloud.  With up to ...
Medical

5 Realtime Coronavirus (COVID-19) Tracking Maps using Big Data

Coronavirus Realtime Tracking Maps We are living in a pandemic world. As of March 12th, 2020 the Director-General of the World Health Organization (WHO) Dr ...
Kayla Matthews

The California Consumer Privacy Act: What You Should Know

The California Consumer Privacy Act GDPR or the European Union’s General Data Protection Regulation effectively altered the way that businesses interact with European citizens. It ...
Or Lenchner

Seeing what consumers see: opening the internet with IPPN

Opening the internet with IPPN To remain competitive and profitable, all brands must be data-gatherers. This is part of any brand’s daily routine, but a ...
Steve Prentice

Cloud-Based Financial Software Reinforces the 80/20 Rule of Business Management

Cloud-Based Financial Software Sponsored by Sage 50cloud Small businesses are known for being innovative and customer-focused in a way that their larger competitors cannot. This ...
Andrew Marsh Washington Frank

Why should SMEs embrace Cloud ERP solutions?

SMEs & ERP Solutions Remaining competitive in the market is the primary goal of every business. For SMEs, moving to the cloud can help that ...
Atman Rathod

How APIs and Machine Learning are Evolving? 

Machine Learning Continues to Make API Development Better  For any developer, API or Application Programming Interfaces come as the helpful components to add valuable features ...
Kokumai

Identity Assurance – Sufficient and Necessary Conditions

Identity Assurance It is not easy to define the 'sufficient condition' for describing a set of processes used to establish that a natural person is ...
Armen Najarian

Martech: Brand Marketing is the New Demand Generation

Martech: Brand Marketing First, An Apology Sorry, demand generation professionals. We still love you and your jobs aren’t going away. But, as you are well aware, the ...
Johan

Why the digital infrastructure is a matter of national interest!

Digital Infrastructure National Interest When the Internet was born, it promised a form of democracy and guarantee that everybody could be part and setup their ...