Articles - GDPR a journey not a destination

The regulation arriving at platform 6 is the delayed 2016 data protection regulation from Brussels.This probably comes as a surprise to most people. If you were to get your information solely from the mainstream media, which appears to have only discovered the issue in the last week, you would think that the General Data Protection Regulation (GDPR) was being introduced in May 2018.

 By Tom Murray, Head of Product Strategy, Exaxe.
 In fact, it was introduced in May 2016, but two years were given for companies to comply. This ‘lead in’ time is about to run out, which gives the media the opportunity for a surge in scare stories.
 Scare stories are tempting for the mass media. The threat of impending apocalypse (or a €20 million fine) makes it so much easier to lure in readers to an extremely important, but essentially boring, piece of regulation and make it interesting. As a result, there has been a high level of panic stories in newspapers, periodicals and on TV and radio over the last month as journalists leap on the bandwagon.
 The problem with scare stories is that in emphasising the worst-case scenarios, they omit much of the more mundane but important issues that arise from the regulation. It gets across the point that something needs to be done, but the scale of the changes and the threats of huge fines for non-compliance can be frightening and end up leading to bad and/or expensive decisions.
 In many ways, the GDPR panic brings back memories of the Y2K panic that gripped most of the world in the lead-up to the millennium. The massive amounts of money poured into resolving the Y2K problem without anyone having a clear definition of the scale of the problem to be solved was immense. In the end, very few issues arose when the clocks struck midnight on 31st December, 1999. This is held by some to be the justifications for the estimated 300 billion US dollars that was spent on preparing systems world-wide for the event. It worked. Others feel that the evidence from South Korea and Italy, two countries that spent little to nothing in Y2K remediation and yet experienced the same level of low-impact issues as other western countries, shows that it was essentially just a panic-driven event and was a complete waste of investment.
 With the GDPR panic now well and truly on, many companies are belatedly waking up to the issue and starting to spend left, right and centre in order to prepare themselves for the event. They are being pushed into an over-reaction in a frenzy that is being fed by some consultants in the area of data protection. It is always dangerous to allow the debate to be forced by those who can profit from it most.
 Perhaps firms should take a step back and consider adopting an approach like the South Koreans and Italians. They should start by remembering that the GDPR is the successor to the original Data Protection Act of 1998, with which they are already in full compliance. This regulation is a significant step forward, but it is building on that solid foundation. This is not a total revamp but a broadening of the work that is already done.
 The regulation itself is not prescriptive but is principle-based. Thus, it is not possible to have a checklist approach, whereby once you tick off all the actions, you have achieved compliance and can basically forget about it.
 Instead, a key feature is that the regulation demands that companies are able to demonstrate compliance. This means that they must have the policies and procedures to monitor the way the organisation is seeking to uphold the six key principles of the GDPR.
 These policies must be monitored and updated as the regulation is further defined by ongoing case law and updates from the Information Commission’s Office.
 No regulation can remove all risk of a data security breach, and therefore this is not the standard that organisations have to achieve. Rather, they must show that they are using best practices for adhering to the GDPR and that they are treating this as a journey, not a destination. Regular and systematic monitoring of how an organisation is treating the personal data it is processing is key to showing that an organisation takes its data protection principles seriously and is doing everything it can to protect the rights of the individuals whose data it is holding. Rather than panicking over meeting an unachievable target in a very short time-frame, companies should be focusing on putting in robust procedures to protect data and to regularly monitor the effectiveness of these procedures and adjust them when necessary.

Back to Index

Similar News to this Story

Aiming for calm seas in our market reforms
The size and scale of the UK financial sector is worth reflecting on. It employs more than 2.5 million people and produced £278bn of economic output
Key innovations and changes impacting insurers in 2024
The speakers explore the impact of AI in the insurance industry, the industry's role in social issues, climate change, closing the global protect
Murder on the LPI floor
DB schemes, by and large, are in a far healthier position than they have been for over a decade. This is good news, but it also changes the challenges

Site Search

Exact   Any  

Latest Actuarial Jobs

Actuarial Login

 Jobseeker    Client
Reminder Logon

APA Sponsors

Actuarial Jobs & News Feeds

Jobs RSS News RSS


Be the first to contribute to our definitive actuarial reference forum. Built by actuaries for actuaries.