The regulatory landscape is changing rapidly. Several new data protection regulations have been passed, and many of them are inconsistent, increasing the complexity and fragmentation of the regulatory landscape. Achieving and maintaining compliance requires organizations to perform a data audit to identify where protected data is located within their network and the steps needed to bring it into compliance.
Challenges of the New Regulatory Landscape
The number of new data privacy regulations is one of the main causes of regulatory complexity; however, it isn’t the only one. The rapid shift in the regulatory landscape over the past few years and the details of the regulations coming into effect create multiple challenges for organizations seeking to achieve and maintain compliance.
The Proliferation of New Regulations
One of the major contributors to regulatory uncertainty is the fact that the last few years have included the passage and implementation of numerous new data privacy laws. The EU’s General Data Protection Regulation (GDPR) set off the rush of new regulations, both by inspiration and its requirement that either an organization or the nation where it is located have equivalent protections in place in order to be permitted to collect, store, and process the personal data of EU citizens.
As a result, many nations and US states have passed their own data protection regulations in the last few years. However, while these regulations have the same overall intentions, they can vary dramatically in the details. The resulting mess of new privacy laws has driven 51 major tech CEOs to ask the US government to pass a federal data privacy law that would supersede all of the state-specific regulations and simplify the US regulatory landscape.
However, general data privacy laws are not the only change to regulation in the US.
This also complicates reporting practices in the event of an incident. The more regulatory authorities that need to be notified after a breach, the more complex the incident response process and the fewer resources that can be devoted to actually dealing with the incident rather than filling out paperwork.
Inconsistent Requirements
While many of the new data protection regulations are designed with the same purposes in mind, they take very different approaches to achieving their goals. A comparison of just two of the most well-known new regulations, the GDPR and the California Consumer Privacy Act (CCPA), reveals many differences in the rights of data subjects and the responsibilities of organizations with access to protected data.
Adding in the dozens of additional state and national privacy laws around the globe that can apply to multinational organizations creates a complex data privacy landscape where organizations must be able to achieve and demonstrate compliance with a wide range of regulations and to understand when and how they need to report potential incidents to the appropriate authorities.
Regulatory Uncertainty
While many new data protection regulations have been passed or enacted in various jurisdictions, there is a great deal of uncertainty about the future of data privacy laws. The end goal of the 51 tech CEOs asking for a national data protection regulation is a federal law that would supersede the mess of state-specific regulations. However, it is uncertain if these efforts will be successful. Organizations are forced to put the necessary effort into achieving compliance with the patchwork of state-specific regulations today, not knowing if all of that hard work will be useless tomorrow.
Another significant area of uncertainty is the enforcement of these new privacy laws. The EU’s GDPR is the oldest and best-known of the new wave of data protection regulations, and it has been in effect for less than two years. It is difficult to judge, based off of regulatory actions to date, the extent to which the wide variety of regulatory authorities will enforce the regulations and exercise their privileges to levy substantial penalties against non-compliant organizations. Some GDPR regulators, like the UK’s Information Commissioner’s Office (ICO), have levied significant fines under the GDPR, like the one against British Airways for $230 million, while others still seem to be playing with kid gloves. Until more precedent is established, it is difficult to guess how regulators will use their newfound powers.
Operating in the New Era of Compliance
With the rise of new data privacy regulations, most organizations have a great deal of work ahead of them in identifying and deploying the security controls, policies, and procedures needed for compliance. Instead of being bogged down in the details, it is useful to first take a step back and focus on the big picture: since these regulations are designed to protect personal data, designing and implementing a security strategy for protecting data provides a good foundation for achieving the requirements of all of the new regulations.
Like our Facebook Page here at NasiLemakTech.com for more news and in-depth reviews! Also, join our Facebook Group for insightful information and memes!
Subscribe to our YouTube channel too!
