Impact of GDPR expands beyond the EU to the rest of the world

The initials GDPR have become synonymous with the need for companies within the European Union to provide consumers greater transparency and better control over their personal data. The General Data Protection Regulation (GDPR) has also increased awareness of privacy concerns around the world.

It’s not the only factor highlighting a need for greater privacy – high-profile privacy breaches by companies such as Facebook are also driving the trend. But GDPR’s global impact cannot be denied.

In fact, no company should assume that the need to address “GDPR-style” requirements is limited to the EU. As awareness has extended to the four corners of the globe, it has emboldened a new wave of laws and regulations that physical security companies ignore at their own peril. GDPR has increased awareness of privacy concerns around the world, and encouraged other areas to take notice

GDPR also regulates how and if data about EU citizens can be transferred outside EU member states’ borders; the receiving country should have equal or better data protection laws in place. This factor also expands the potential impact of GDPR globally.  

California's Consumer Privacy Act 2020

California, which has the world’s fifth largest economy, passed a law this year that some have called “GDPR Lite.” The law gives the state’s 40 million residents the right to view private data held by companies, to correct it, to request that it be deleted and to keep it from being sold to third parties. California’s Consumer Privacy Act takes effect in 2020 and could be amended in the interim.

The California law was passed quickly – and unanimously – by the state Assembly and Senate and was signed by Gov. Jerry Brown when it became clear that a ballot initiative was being organized to address the issue of privacy. In California, initiatives can be placed on the ballot by collecting signatures to require a direct vote by the electorate. Once passed, ballot initiatives are difficult to amend, requiring a two-thirds vote of state lawmakers. By passing the law, California’s legislature averted a proposed privacy initiative on the fall ballot.  GDPR also regulates how and if data about EU citizens can be transferred outside EU member states’ borders

There are differences in the California law and the European Union’s GDPR. For example, the California law only applies to companies that have annual gross revenues in excess of $25 million, that hold data on more than 50,000 people or that derive more than 50% of their annual revenues from the sale of personal information. Therefore, most small businesses are immune to the law’s requirements. However, the existence of the California law is a harbinger of more regulations to come, on the state or federal level.  

In another development related to the physical security industry, California has passed an Information Privacy: Connected Devices bill that requires electronics manufacturers to equip Internet of Things devices with “reasonable” security features – no more passwords such as “admin,” “password,” or “1234.”

California’s Consumer Privacy Act is modeled under the General Data Protection Act

Expanding the definition of personal information 

Other states are also getting involved. All 50 U.S. states have enacted breach notification laws requiring businesses to notify consumers if personal information is compromised. For example, Alabama’s new law, passed in June, applies to “unauthorised acquisition of sensitive personally identifying information in electronic form.” Many state laws are expanding the definitions of personal information and increasing cybersecurity requirements as they relate to that information. Globally, rapidly growing adoption of data protection laws is often modeled on regulations such as GDPR

The problem with a “patchwork” of state requirements is the possibility that businesses may be caught unaware when state laws have different specific requirements addressing the same general mandate. At the federal level, there have been calls for a data breach notification bill that would provide a single set of rules for organisations to follow.  

In general, privacy is seen differently in the U.S. than in the E.U., due in part to history and a U.S. commitment to the First Amendment. The U.S. also tends to address privacy rights based on the category of information being considered; i.e., HIPAA requirements cover health information and the Gramm-Leach-Bliley Act regulates financial information.

Globally, rapidly growing adoption of data protection laws is often modeled on regulations such as GDPR or on the Organization for Economic Co-operation and Development (OECD) Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. According to the United National Conference on Trade and Development, more than 100 countries around the world now have data protection legislation in place.

Protecting and managing data

All 50 U.S. states have enacted breach notification laws requiring businesses to notify consumers if personal information is compromisedWhen you consider the impact GDPR has had on the physical security market, the possible new hurdles can boggle the mind as additional privacy requirements take hold in the U.S and around the world. Challenges range from worries about management of access control and video surveillance data to concerns about biometrics. The success of new technologies using artificial intelligence (AI) depend on access to large data sets, so ensuring that data is protected and managed correctly is paramount.

The genie is out of the bottle. GDPR may be driving the first wave of privacy concerns, but there is much more to come. Anyone who dismissed GDPR as a “European” factor is missing an opportunity to address issues proactively and to ensure optimum management of data privacy and transparency in the future.