The most talked about day of the last two years is almost upon us. The European General Data Protection Regulation (GDPR) will come into force tomorrow, promising much stronger rights and safeguards for users’ personal data. For now, the main effect it has had has been, paradoxically, to irritate the very people it is supposed to protect, due to the deluge of emails we have all received from companies seeking fresh consent. While businesses fear GDPR’s hefty fines, it is likely that regulators at least will be flexible in the first few months.
With the sweeping pace at which technology has progressed in the last 20 years, it is almost unquestionable that the rules needed an update. We will now finally be able to know whether such update has been sensible and effective against the ambitious objectives of the Regulation.
On one front though, things are shaping up for GDPR to be a success: it has triggered a race to the top, rather than one to the bottom, among lawmakers around the world. The necessity to be seen as an “adequate destination” for personal data of EU customers has pushed several countries to adopt legislation accordingly; recent privacy scandals like the one involving Facebook and Cambridge Analytica have sped up this process too, because nobody wants to be seen as careless about the rights of their own citizens (and voters).
Two aspects trigger businesses’ biggest concerns around GDPR: the hefty financial penalties they could face, and the need to extensively document their choices related to data processing. There is no doubt that GDPR compliance will require keeping detailed documentation of how a company goes about data processing; but this also means that, if a company gets that aspect right, it will also be less likely to incur large fines. In the short run, regulators are also likely to give businesses the benefit of the doubt. The French authority for instance has said explicitly it will be flexible in the first months, and others are likely to follow a similar approach.
