The 50 Million Euro fine against Google demonstrates that the first wave of GDPR enforcement has begun.
Companies must now focus on more than consent to ensure that they have the legal right to process analytics and AI which they rely on for their growth, competitive differentiation and innovation.
Many companies believe the way they processed analytics and AI before the GDPR is still legal - but that is not true.
When analytics and AI cannot be described with specificity at the time of data collection - which is mostly the case with secondary processing - corporations can no longer rely on consent as they did before the GDPR. New technical and organizational safeguards are required under the GDPR to support analytics and AI processing.
For secondary processing like iterative analytics and AI to remain legal under the GDPR - commonly referred to as Big Data - organizations must now have GDPR compliant technical and organizational safeguards in place that:
Satisfy a “balancing of interest” test that requires “functional separation” (the ability to separate the information value of data from the identity of data subjects) to reduce the negative impact on data subjects so that the data controller’s legitimate interests are not overridden. Recent high-profile lawsuits against Oracle and Acxiom make it clear that simply claiming a “legitimate interest” in commercializing personal data is not enough;
Ensure compliance with requirements that the secondary processing is compatible with the original purpose for which the data was collected; and
Restrict access by default to the minimum data necessary for each purpose for which it is processed - known as Data Minimisation, a level of granular control not supported by traditional technologies like encryption.
Technical and organizational safeguards satisfying these GDPR requirements were not previously required for lawful secondary processing using consent. As a result, most organizations do not have required new technology in place. What was “good enough” prior to the GDPR is no longer legal.
The recent 50 Million Euro fine against Google and lawsuit against Oracle and Acxiom highlight the proactive nature and significant influence of advocacy groups (Max Schrems’ None Of Your Business (nyob) organization in Austria and France's Quadrature du Net in the case of Google and UK-based Privacy International in the case of Oracle and Acxiom). As a result, organizations need to assess and implement appropriate technical and organisational safeguards that enforce functional separation in a timely manner to ensure uninterrupted access to data, analytics and AI to fuel growth, competitive differentiation and innovation.
The author, Gary LaFever, is Co-Founder and CEO of Anonos. Anonos’ patented decentralized privacy preserving BigPrivacy technology is the most comprehensive solution for lawful Big Data analytics and AI under the GDPR and evolving data protection regulations. BigPrivacy uses certified compliant GDPR Article 4(5) dynamic pseudonymisation to enforce technical and organizational safeguards that automate enforcement of privacy policies to enforce functional separation to help satisfy the Legitimate Interest balancing of interest test, compatible secondary processing and data minimisation requirements. BigPrivacy enforces "selectiveness for effectiveness" via secure access to only the minimum information required for each authorized process. By leveraging BigPrivacy, organizations can process lawful analytics and AI under the GDPR and other evolving data protection regulations to maximize Big Data value.
Contact Anonos to learn more.
6 MIN SUMMARY VIDEO FROM FIMA LONDON CHIEF DATA OFFICER CONFERENCE