Gary LaFever | January 21, 2019

What the Google 50 Million Euro GDPR Fine Means for Big Data Analytics.

The 50 Million Euro fine against Google demonstrates that the first wave of GDPR enforcement has begun.

Companies must now focus on more than consent to ensure that they have the legal right to process analytics and AI which they rely on for their growth, competitive differentiation and innovation.

Many companies believe the way they processed analytics and AI before the GDPR is still legal - but that is not true.
When analytics and AI cannot be described with specificity at the time of data collection - which is mostly the case with secondary processing - corporations can no longer rely on consent as they did before the GDPR. New technical and organizational safeguards are required under the GDPR to support analytics and AI processing.

For secondary processing like iterative analytics and AI to remain legal under the GDPR - commonly referred to as Big Data - organizations must now have GDPR compliant technical and organizational safeguards in place that:

  • Satisfy a “balancing of interest” test that requires “functional separation” (the ability to separate the information value of data from the identity of data subjects) to reduce the negative impact on data subjects so that the data controller’s legitimate interests are not overridden. Recent high-profile lawsuits against Oracle and Acxiom make it clear that simply claiming a “legitimate interest” in commercializing personal data is not enough;

  • Ensure compliance with requirements that the secondary processing is compatible with the original purpose for which the data was collected; and

  • Restrict access by default to the minimum data necessary for each purpose for which it is processed - known as Data Minimisation, a level of granular control not supported by traditional technologies like encryption.

Technical and organizational safeguards satisfying these GDPR requirements were not previously required for lawful secondary processing using consent. As a result, most organizations do not have required new technology in place. What was “good enough” prior to the GDPR is no longer legal.

The recent 50 Million Euro fine against Google and lawsuit against Oracle and Acxiom highlight the proactive nature and significant influence of advocacy groups (Max Schrems’ None Of Your Business (nyob) organization in Austria and France's Quadrature du Net in the case of Google and UK-based Privacy International in the case of Oracle and Acxiom). As a result, organizations need to assess and implement appropriate technical and organisational safeguards that enforce functional separation in a timely manner to ensure uninterrupted access to data, analytics and AI to fuel growth, competitive differentiation and innovation.

The author, Gary LaFever, is Co-Founder and CEO of Anonos. Anonos’ patented decentralized privacy preserving BigPrivacy technology is the most comprehensive solution for lawful Big Data analytics and AI under the GDPR and evolving data protection regulations. BigPrivacy uses certified compliant GDPR Article 4(5) dynamic pseudonymisation to enforce technical and organizational safeguards that automate enforcement of privacy policies to enforce functional separation to help satisfy the Legitimate Interest balancing of interest test, compatible secondary processing and data minimisation requirements. BigPrivacy enforces "selectiveness for effectiveness" via secure access to only the minimum information required for each authorized process. By leveraging BigPrivacy, organizations can process lawful analytics and AI under the GDPR and other evolving data protection regulations to maximize Big Data value.

Contact Anonos to learn more.


Are you facing any of these 4 problems with data?

You need a solution that removes the impediments to achieving speed to insight, lawfully & ethically

to Insight
Are you unable to get desired business outcomes from your data within critical time frames? 53% of CDOs cannot achieve their desired uses of data. Are you one of them?
Lack of
Do you have trouble getting access to the third-party data that you need to maximise the value of your data assets? Are third-parties and partners you work with worried about liability, or disruption of their operations?
Inability to
Are you unable to process data due to limitations imposed by internal or external parties? Do they have concerns about your ability to control data use, sharing or combining?
Are you unable to defend the lawfulness of your current data processing activities, or data processing you have done in the past?
Traditional privacy technologies focus on protecting data by putting it in “cages,” “containers,” or limiting use to centralised processing only. This limitation is done without considering the context of what the desired data use will be, including decentralised data sharing and combining. These approaches are based on decades-old, limited-use perspectives on data protection that severely minimise the kinds of data uses that remain available after controls have been applied. On the other hand, many other new data-use technologies focus on delivering desired business outcomes without considering that roadblocks may exist, such as those noted in the four problems above.
Anonos technology allows data to be accessed and processed in line with desired business outcomes (including sharing and combining data) with full awareness of, and the ability to remove, potential roadblocks.