GDPR-EU General Data Protection Regulation

 

The EU's General Data Protection Regulation (GDPR) goes online in May 2018. And while it's an open question just how much impact the regulation will have on consumer technology, it's likely many will have to adapt to this new regulatory regime.

The GDPR has strict rules on how technology providers' services and products must handle the personal data of EU citizens, regardless of where they are located. For example, technology providers must respect a EU citizen's “right to be forgotten” by removing all their personal data upon request. What's more, organizations must inform EU citizens of how their personal data is captured, stored and used, and receive their clear and affirmative consent to retain or process the data.

Out of all the GDPR provisions, Roy Smith, CEO at PrivacyCheq told Legaltech News that the requirement for consent is perhaps the biggest compliance challenge for technology providers, such as social media companies, website publishers or app developers.

“Very few of the [tech companies] we talk to have really thought out the ramifications of affirmative consent,” he said, adding that just the amount of information organizations must provide users before they can consent can be daunting.

“Before you capture a person's email address, you have to show them a notice that says, 'Here's what we are going to do with the information we're requesting from you, here's how we keep it safe, here's what we'll do in case of breaches, here's where you can notify us if you want to see what we've captured, and make sure it's correct,” he added.

Speaking at the October 2017 ChIPs Women in Tech, Law and Policy Global Summit in Washington, D.C., Apple vice president and chief litigation counsel Noreen Krall noted that most organizations handling EU citizen data will need to implement some consent processes, given the GDPR's broad definition of personal information.

“It's far beyond your name, your Social Security, your bank account. It's your IP address or your device ID or a reference number to a customer or a complaint or question that you brought in. For any organization, beyond tech, it just covers just about anything,” she said.

Krall added that, because of its broad scope,  the consent requirement will likely change the user experience of many technology products. “The customer experience is going to be potentially dramatically changed by these regulations. It's almost as if governments are dictating the enterprise design or system design or consumer experience.”

What's more, she sees the need to manage consent of EU citizens as placing “heavy, heavy processing obligations on companies.” Such a requirement may force tech providers to create or reconfigure back-end processes for their products in order to record and manage a potentially high number of consent requests.

“I think at the back-end, there will be a lot more infrastructure for businesses to put in place” said Rohan Massey, partner at Ropes and Gray's privacy and cybersecurity practice in Europe. He believes, however, that the changes tech providers need to make “ will be less dramatic than some people are expecting.”

“I don't think [the GDPR] will require much change to the front end [of tech products] for consumers,” Massey added.

Most tech providers likely move to comply with need for consent because of the steep fines they may face for noncompliance. But, while the GDPR rules might be a burden for some tech providers, they may be a boon for those who seek to capitalize on the rush towards compliance. Tech companies like TRUSTe and OneTrust, for instance, offer GDPR assessments tools to help organizations understand how compliant their product may or may not be. Meanwhile, companies like PrivacyCheq have similarly released tools that help developers create tech products that comply with GDPR rules from the start.

What's more, legal technology providers, like ZL Technologies and NetDocuments, are adding functionality to their platforms, which allows organizations to more easily understand if their data falls under the purview of the GDPR.

Still, many organizations and tech providers still face a demanding road ahead. With 2018 quickly approaching and the end goal in sight, it's now a question of how one gets there.