A global revolution is quietly taking place in the world of data law.

In January, the California Consumer Privacy Act (CCPA) took effect, essentially making one's privacy a constitutional right. Since then new, wide-ranging data laws have been introduced in both the Middle East and Africa.

What do these new pieces of legislation all have in common? They wouldn't exist were it not for the European Union's General Data Protection Regulation (GDPR). The GDPR has started an understated but significant process of change around the world. And lawyers believe there is more to come.

A little over two years has passed since the GDPR landed and transformed the relationship between people, business, and that most precious of commodities—data.

Brought in to "harmonize" the mostly well-meaning but highly diffuse data laws across the European Union, the GDPR ushered in a fresh suite of new and enhanced rights for European consumers. To name but a few, these included the right to be informed that your data was being collected; the right to access your data; the right to rectification and, famously, the right to erasure.

It's introduction came, crucially, at a time when the online world superseded the tangible one for commercial dominance, when businesses like Amazon and Apple were hitting $1 trillion valuations, and concurrently, when one's place online faced a growing threat by an ever deepening and vastly sophisticated pool of scammers and hackers, and a panoply of other technologically astute ill-willers.

|

Europe-made

So how did the GDPR become a springboard for this quiet but very global data law revolution?

"[Other nations] see the GDPR as the quintessential data law, not so much because it enshrines values we've held dear for so long, but because it has huge simplification power," says a data partner at a U.S. firm. "And laws that are simple, and generally translate into meaningful on the ground regulation are those that do best and achieve their outcomes.

"The GDPR does this," they add.

One of the world's fastest growing financial districts cottoned onto this, with little hesitation. Earlier this month, the Dubai International Financial Centre (DIFC) Authority introduced new data protection legislation designed to align the area's data laws with the GDPR.

Dino Wilkinson, partner and head of the technology, media and telecommunications team at Clyde & Co in the Middle East, said that the new law positions the DIFC as a safe and top-tier jurisdiction as regards data protection issues.

"Data protection is becoming an increasingly important global issue and the new DIFC Data Protection Law will help to align the DIFC's regulatory framework with international best practices."

A partner at a local Dubai firm said the GDPR responds to a "deep yearning" for "better data hygiene" and a greater desire to "take control over how your information is being used".

"Once the GDPR was effective, there was a surge in demand for data subject access requests. But whether that will happen in the UAE remains to be seen. But what it shows is that Dubai knew that if it was going to modernize its data laws, it had to introduce GDPR concepts, like requirements around transparency and fairness, and data security and limiting purpose for storing people's data — concepts captured in the GDPR quite elegantly."

Similarly, in June South Africa introduced a wide-ranging data protection and privacy act. It was a symbolic move by President Cyril Ramaphosa's that underscores his attempt to modernize South Africa's legal framework. Like the DIFC's new data law, South Africa's is designed to put the nation on an even footing with the GDPR.

Without data protection legislation, South Africans have been powerless to do anything when their privacy is violated, says Kelly Hutchesson, a lawyer at Eversheds Sutherland.

In introducing the Personal Information Act, she says that South Africa has "learned valuable lessons from the EU" regarding protecting people from data violations and granting them heightened powers for controlling their own data.

|

Just the Beginning 

Hutchesson believes other African countries are likely to follow suit and to "look to us for guidance on how to implement such first-world laws".

Indeed, as the parter at the U.S. firm says, "this is likely to be just the beginning."

He adds: "The GDPR has been so successful in enshrining into law elemental principles like data security, transparency and access that it was only a matter of time before other nations took their cue and introduced their own laws. We're seeing it across the U.S., and the EMEA region. And others will follow."

Another partner in the cybersecurity practice of a U.K. law firm echoes this point, suggesting that, while most of the principles enshrined in the GDPR are replicated elsewhere, for example in the Australian Privacy Act 1988, it is ushering in a "new era for data protection, where suddenly companies are having to give a damn about holding and using, and sometime abusing, personal data."