New reforms under the General Data Protection Regulation (GDPR) started as an attempt to standardize data protection regulations in 2012. The European Union intends to make Europe “fit for the digital age.” It took four years to finalize the agreements and reach a roadmap on how the laws will be enforced.
The GDPR presents new opportunities as well as difficulties for businesses, digital companies, data collectors, and digital marketers. On the one hand, these regulations will make it more difficult for businesses and data mining firms to collect and analyze customer data for marketers, while on the other, they will present an opportunity for data collectors to innovate and enhance their techniques. This will lead to better collection of more meaningful data, as customers will be directly involved.
Understanding GDPR
The GDRP will go into effect on May 25, 2018. It will apply to all organizations and businesses that process personal and marketing data from European residents.
There are six underlying principles of GDPR.
⦁ Organizations must ensure that the personal data of users is processed transparently, lawfully, and fairly.
⦁ Personal data of users must only be collected for explicitly specified and legitimate purposes.
⦁ Data collectors must only gather limited amounts of personal information that is adequate to the gatherer’s needs and relevant to their business.
⦁ It is the responsibility of data collectors to ensure that the personal data is accurate and kept up to date.
⦁ Data collectors must maintain personal data in a form where the data subject can be identified for only as long as it is necessary for processing.
⦁ Personal data must be processed in a way that ensures that it remains secure and cannot be stolen.
The regulations apply to organizations that are trading within the EU. However, this potentially includes organizations from every part of the world. The regulations would keep European organizations from working with companies and states that do not meet the requirements of GDPR.
Implications of Reduced Customer Data
The regulation aims to protect the personal data of natural persons, whatever their nationality or place of residence. The regulations have the potential to apply to citizens and businesses from the U.S., Asia, and other parts of the world.
EU organizations are bound by the regulation to protect the personal data of anyone from anywhere in the world, and not just the EU citizens. Data collectors from outside the EU are also bound to protect the personal data of European citizens as long as it is collected within the European borders.
Personal Data
The scope of the term personal data has been expanded in the new legislation. It now encompasses any information relating to an identified or natural person such as their name, location data, identification number, or employment, etc. Personal data also includes the physical, genetic, mental, physiological, economic, cultural, or social identity of that person.
Rights of the Data Subjects
The major implication of the GDRP is that it drastically increases the rights of subjects on their personal data held by organizations.
Data collectors must now clearly communicate to the subjects of their data gathering efforts about what data they are collecting and what purposes it will be used for.
The data collectors must also obtain consent from the data subjects for collecting most types of personal data. While consent is not strictly necessary, it can restrict the type of data that can be collected or used by organizations.
Right to be Forgotten
Perhaps the most interesting thing about the new regulations is the right of data subjects to have their data removed from an organization’s records. If a person removes their consent at any time or explicitly asks an organization to remove their personal data, the organization is bound by the new regulations to comply with the request.
Organizations will need to build a process that enables them to erase records. This could be especially tricky in situations where data becomes archived. Organizations might find it too costly to search through their records just to remove data that they no longer use.
Real Time Analytics
GDPR regulations will soon be put into practice, and the million dollar question that has been on everyone’s mind is how it will impact the data collection and processing industry.
The co-author of this article,Bob Nieme, the founder of Datastreams.io and a long-time data collection expert, pointed out that the new regulations will have a significant impact on data analytics. Collection, retention, and processing of data with the organization will become more difficult, and businesses will need to shift towards an approach of real time analytics.
Real time analytics involves the use and analysis of data as soon as it enters a system. The term real-time refers to a level of responsiveness from the server where processing is done while the user is still connected to the network.
Real time analytics of user data could remove the need to keep the personal data on organizational files.
Researchers have developed a number of technologies that make real-time data analytics faster and better compared to post-dated analytics. Some of these technologies include the following.
In-Database Analytics
With this technology, the analytical tools are built into the database itself. As soon as personal data is received from a data subject, the protocol performs the analysis to create new logical conclusions. This technology can allow businesses to process the data without keeping a record of the user on their systems.
Data Warehousing Appliances
Specialized hardware and software products can be designed that perform data analysis on the customer’s premises. Technically speaking, the data would remain in the possession of the customer and they would have complete control on what relevant information they choose to pass on to their vendor.
Real Time Analytics Application
The GDPR allows for a new risk-based approach to data protection. It shifts the burden of risk for incomplete data security from individual data subjects to larger corporations and processors which have the organizational capacity to improve data security.
The new regulations recognize that static identifiers are not doing the task of privacy protection as intended. Static identifiers may be connected to Mosaic effects, which leads to unauthorized re-identification of data subjects. Continued use of these static modules places additional risk on data subjects.
Instead of using static identifiers, the use of dynamic identifiers will allow data gatherers to process information without linking it back to individual data subjects.
The new GDPR mandates Data Protection by default. While it may put additional pressure on data collectors and marketers in the short run, we can be sure that the regulations will lead to new innovations from businesses. This will make the process more secure for users and also increase trust that the data is being used for relevant purposes by businesses.
About the Authors
Bob Nieme
For over 15 years, Bob Nieme has been a Digital Transparency protagonist , being the most essential condition for long term relationships based on trust and mutual interest. In 2014 Bob was recognized as a Privacy by Design Ambassador by the Information and Privacy Commissioner of Ontario, Canada, and in 2013 he was admitted to the Advisory Board of the Department of Mathematics and Computer Science of Eindhoven University of Technology. As a Data Science Ambassador, he initiates and supports various start-ups and education programs. Bob Nieme founded three leading data-technology companies: Adversitement specializes in data process management, O2MC I/O offers a prescriptive web computing framework, and Datastreams.io empowers data-driven collaboration by providing governed access to trusted data sources.
Ronald van Loon
Ronald van Loon is Director at Adversitement, and an Advisory Board Member and Big Data & Analytics course advisor for Simplilearn. He contributes his expertise towards the rapid growth of Simplilearn’s popular Big Data & Analytics category.
If you would like to read more from Ronald van Loon on the possibilities of Big Data and the Internet of Things (IoT), please click “Follow” and connect on LinkedIn, Twitter, and YouTube.
