The the new European data protection law, the General Data Protection Regulation (GDPR), is an important topic of conversation for US companies. Since its inception, the GDPR has raised a number of questions as to whether or not businesses are properly prepared to comply.
The GDPR was adopted on April 27, 2016 and allotted a two-year, post-adoption grace period for businesses to strategize and implement their own compliance. With less than a month until the enforcement date, it has been reported that an estimated 61 percent of US businesses are not ready for the regulation, and that only 67 percent of European-based businesses have begun moving into the implementation phase of their compliance program, according to a study produced by TrustArc in San Francisco.
The potential fines have many concerned about compliance as the May 25 date approaches, but businesses struggle with fully understanding the regulation, thus fail to launch a comprehensive plan.
With respect to the retail industry, several chains have displayed international influence with the presence of brick-and-mortar stores in several nations, as well as through international marketing efforts. For example, after Amazon acquired Whole Foods Market in June 2017, the e-commerce giant became America’s fifth-largest grocery retailer. Outside of the benefit of concrete locations near its customers, the marketing data obtained through the acquisition provided Amazon valuable behavioral statistics on grocery-buying habits, patterns and product preferences.
The GDPR places Amazon’s acquired Whole Foods business under scope not only for its presence in the United Kingdom, but also due to its monitoring of European Union (EU) data subjects and attempt to offer them goods and/or services. Amazon’s practices most likely include the use of automated individual decision-making against EU data subjects, requiring explicit consent under the GDPR.
Processing is broadly defined in the regulation to include most actions that can be performed with data and can specifically refer to collection and storage, which in this case, would be under Amazon’s wheelhouse. The retailer must therefore have processes in place to honor nine distinct rights awarded to EU citizens, and be able to operate under the guiding privacy principles defined within the GDPR.
The regulation further dictates appropriate security efforts around the protection of personal data, establishes breach reporting requirements, and increases risk associated with vendors processing this data. These expansive requirements make the process of marketing and vendor outsourcing more complex for anyone with a direct consumer relationship with EU customers.
Many smaller agencies may not be considering the new regulation as seriously as they should be, but past enforcement actions point to enforcement risk even with smaller agencies. The GDPR states that non-compliant companies posing a risk to EU citizens and their privacy can be fined up to $20 million or 4 percent of their global turnover for the previous fiscal year, whichever is greatest.
It is important to note that this fine can be per violation. It can certainly be assumed that larger repercussions would be imposed in this hypothetical case, since case law suggests similar types of violations don’t stand alone and typically occur with others.
What’s Next?
There are several steps that companies must immediately embark on to mitigate their exposure to risk. A solid start begins with understanding GDPR regulation applicability to various parts of the business, and understanding each unit’s risk profile to establish priorities for the initiative. Once risk and priorities have been identified, it is critical for organizations to identify and establish their lawful basis for processing of this data.
Every industry has its own unique risk and operational challenges, and every business within has its own maturity relative to industry peers. Using the trusted counsel of a compliance firm helps to quickly identify both industry and organizational risk that, as a non-biased third-party, are often otherwise overlooked.
A risk management and compliance consulting firm can help organizations quickly identify risk, formulate a plan to mitigate this risk and set up ongoing monitoring programs to maintain valuable records of compliance.
Some have suggested the GDPR will set the global precedent for data privacy and security regulations. Brazil and China have both showed interest in forming similar requirements to protect the privacy of its citizens’ personal information from businesses storing and transferring data across borders.
To adequately prepare for the GDPR and similar regulations, businesses must become educated on these regulations and determine how to conquer the requirements. Applicable processes and procedures can help minimize exposure to fines, but also provide an opportunity within the market to reassure customers and earn their trust.