If you were like me, you must have received more than a dozen of emails from different organizations whose services/products you have signed up for (some of which you might have forgotten) telling you of updates to their privacy policies.
The recent policy updates were done to meet the May 25th, 2018 deadline to comply with the requirements of the General Data Protection Regulation (GDPR), a data protection law approved by the EU Parliament in 2016.
This regulation literarily shook the whole world, keeping service providers on their toes, making them accountable to the owners of the data held by them (maybe for once).
Even though, the regulation is directly aimed at protecting the data of EU citizens, but we all know how technology has removed all forms of boundaries and has made it possible to extend our online services to users in all parts of the world, so much has changed since the data protection acts of the 90’s, user data has become a tool in the hands of organizations, data has also become more available than before.
The GDPR places more responsibility on service providers who handle people data and gives power to the users so they can control how their data is being used (it belongs to them after all) Hence service providers no longer own the data as it were, May 25th therefore marked the day the users regained power over their data and the day service providers came to terms with that fact and became more accountable to data owners.
The main intent of the GDPR is in two folds, namely:
- More Responsibilities on Service Providers: organizations who handle and process user data need to:
- Seek for consents from users before collecting data about them.
- Let the users know in clear language the reason why such data is being collected, what it would be used for and how it would be handled
- Inform the users of how long the data will be held
- Inform the regulator (and sometimes the user) within 72 hours if the data is compromised
- Ensure that there are specific protections to the user data when moving it to certain countries that have not been approved by the EU as having adequate protection for user data.
Organizations who fail to comply with the rules will pay a fine equivalent to 4% of their previous year annual turnover or up to 20 million pounds whichever is greater. We can now understand why the new regulation is being taken more seriously than its predecessor and even the available security best practices requirements.
- More Power to the users: they now have the rights to
- Demand that their data be corrected or deleted if there is no strong reason for the organization to continue processing it
- Demand to have copies of the data collected about them (and may transfer the same to other organizations)
- Be informed of breach to their data
Obviously, this regulation calls for a change in the way software is being built, the way merger and acquisitions are being conducted, marketing, advertisements and other business activities that impact on user privacy, since everything eventually boils down to the way software are being developed to process data, there is no other time than now for us to develop our software following best practices and build secure applications.
Going by the mantra of the Information Commissioner’s Office (ICO), the UK’s independent authority tasked with the responsibility to uphold information rights in the public interest and also promote openness by public bodies and data privacy for individuals, software should be developed using a “privacy by design” approach