The European Union's impending General Data Protection Regulation has been giving legal departments plenty of headaches, even though the new data security rules don't go into effect for almost six months. With companies potentially looking at fines as steep as 4 percent of their annual global revenue and facing questions around whether to utilize privacy impact assessments or if there's a need to appoint a data protection officer, for instance, there's no doubt much to do ahead of the May 2018 deadline.

For all the planning, however, without proper employee training, these efforts may all be for naught, said Daniel Pepper, vice president and deputy general counsel of data and privacy at Comcast Corp., who spoke on a panel at ALM's 2017 cyberSecure conference in New York.

At Comcast, there are a number of different internal organizations that deal with customers in the European Union and question how the GDPR will apply to their operations, Pepper said on the panel Monday. “We can develop all the policies in the world,” he explained, “but at the end of the day, if we're not doing road shows with all these teams and identifying exactly what they should be looking for, no one's going to read this stuff.”

And it shouldn't just be generalized training for any part of the business that will be impacted by the GDPR, Pepper noted. It's important, he said, to consider “what matters to that particular division, and [to customize] your training and your education and your awareness program to those folks so they understand what to look for.”

“It's amazingly complex, as we know. There is so much subjectivity and confusion built into this regulation, no one has the answers yet,” Pepper said. “What we are doing is telling our folks: 'Look, this is what you should be looking for. We can't tell you necessarily how to solve it, but if you find it, come to us and we can talk about it.'”

But the prospect of training may be complicated by lingering ambiguity around the GDPR.

As a company that's already subject to regulations from the Federal Communications Commission, for instance, Comcast is no stranger to ongoing employee training on regulatory compliance, Pepper said. The difference between the training the company is using to deal with and training around the GDPR, Pepper said, is that with the former, “there's more certainty and definition in those areas.”

“We can provide some cut-and-dried responses, very black and white, five-minute sound bites, and they're good to go,” Pepper said. “We can't do that yet with GDPR.”