Challenges, Fines, and Operational Impacts of the GDPR

The GDPR, or General Data Protection and Regulation, is going into effect in May 2018 throughout the European Union (EU) and presents important legal changes and challenges for organizations and consumers alike.

Interactions and relationships between customers and businesses are transforming; the GDPR shifts authority over customer data from the business to the customer. Companies need to obtain prior approval from each customer to access and use their data, and customers choose how it’s used, and which businesses can use it.

To avoid hefty fines, legal consequences, challenges, loss of public trust and brand integrity, businesses need to follow the parameters of the GDPR and ensure the legally use of customer data. 

Who Will Be Impacted by the GDPR

Every business inside the EU is going to be affected by the GDPR starting on May 25th, 2018. Companies who contract, partner with, and interact with another EU businesses will also be held accountable to the GDPR.

Brexit occurs on March 29, 2019, whereby the UK is removing themselves from the European Union, and confusion has arisen over how this will impact the U.K.’s treatment of the GDPR. The U.K’s government has stated that the GDPR will be part of UK law after the country exits from the EU, but they are going to make legislative changes to the GDPR guidelines according to their own judgments.

Businesses within the EU who have international partnerships, vending and supplier agreements, and contracts with other companies outside of the EU have to ensure that these third-parties also abide by the GDPR.

The GDPR also includes targeted marketing from US websites to EU data subjects if language and advertising are aimed towards specific EU users, including references to EU customers.

Abiding by Data Privacy Levels

Companies need to establish trust with their customers by using their information legally and as indicated by the customer. Customer data includes demographic information, purchasing information, or sensitive Personally Identifiable Information (PII). Any transactions, like financial exchanges, signing up for an account or services, or website or online interaction also falls under the umbrella of customer data.

Client consent and the framework for handling their data:

• Consent needs to be informed, highly specific and given by the customer without coercion.
• Needs to be a clear indication of the customer’s explicit agreement of their personal information being processed, used, or stored.
• Customer silence, pre-checked boxes, auto-filled data, and inactivity don’t legally count as client consent.

Customer privacy levels that either directly or indirectly identify an individual ranked in consecutive order from general identifiers to most sensitive information:

• Level 1: Anonymous customer data that indirectly identifies a customer.
• Level 2: Indirect personal data or information that indirectly identifies an individual but does not reveal who the person is direct.
• Level 3: Personal direct data, which identifies who the user is.
• Level 4: Highly sensitive data, such as Personally Identifiable Information (PII) like credit cards. 

GDPR Challenges and How to Overcome Them

One of the most difficult GDPR related challenges is focusing on excellent customer experiences while still respecting potentially limited consent and managing an influx of customer data.

Other GDPR related challenges include:

• Enforcing transparency and revealing what your company does with customer data, extending across all data and analytics, and all applications, including data warehouses, data lakes, marketing applications, and businesses intelligence.
• Ensuring that customer data isn’t kept any longer than is required for the purpose.
• Promptly removing client data upon request, which is specifically challenging for older businesses that have decades of client files and data.
• Managing massive quantities of data streams.

Businesses need to take steps to overcome challenges:

• Implement external network defenses and restriction measures, such as data minimization that limits customer data collection to what’s necessary for specific purposes.
• Apply security to customer data via data encryption.
• Apply Pseudonymization, as it replaces identifying data with encrypted data and artificial identifiers, so that customer personal data identifiers aren’t traceable.
• Design a data stream map to document all processed customer data and update privacy statements for all data streams, including CRM, HR, digital channels, and marketing tools.
• Remove redundant, obsolete, or trivial data to minimize risks associated with retaining unnecessary personal data.
• Create a unified data governance framework that aligns objectives with data governance processes, policies, and practices. 

Penalties and Fines for Non-Compliance

Fines and penalties for data breaches and non-compliance can be severe. Breaches include hacking incidents, sending attachments to the wrong recipients, misplaced passwords, and data stored in the wrong database. Should data breaches occur, businesses must notify authorities within 72 hours and immediately inform the subject.

The GDPR guides data security and consistency, and fines are levied according to the degree of non-compliance. Cloud data is not exempt from the GDPR.

• Upper Level: Businesses can expect a 20 million Euro fine or 4% of their annual fiscal turnover for failing to be GPR compliant. This is for severe data infringements, such as not obtaining proper consent before using customer data or failing to abide by the Privacy by Design framework, which promotes client privacy and compliance throughout the lifecycle of a business’s systems and processes.
• Lower Level: Organizations can be fined 2% of their annual fiscal turnover for failing to keep records in order, failing to perform an impact assessment, and failing to inform authorities and the data subject about a breach.

A Data Protection Officer (DPO) should be assigned to instill data protection frameworks, particularly if the business manages massive quantities of personal data, or if the company is a public authority, or if the businesses deal with large-scale systematic monitoring. Otherwise, a DPO isn’t required. 

Transparent GDPR Adherence and Accountability

International companies, like outsourcing leader Data Entry Outsourced (DEO), need to take extraordinary measures to stay compliant, obtain customer consent, and treat sensitive data according to the GDPR framework. As an upstanding member of the global business community, DEO has deployed a GDPR architecture for complete legal compliance so that we can continue to serve our valued clientele and provide impeccable customer data standards.

– DataEntryOutsourced