GDPR’s impact: The first six months
GDPR is now six months old – it’s time to take an assessment of the regulation’s impact so far. At first blush it would appear very little has changed. There are no well-publicized actions being taken against offenders. No large fines levied. So does this mean its yet another regulation that will be ignored? Actually nothing could be farther from the truth.
The day GDPR came into law complaints were filed by data subjects against Facebook and Google. Complaints – that does not sound like action by regulators, in fact its not – its action taken by lawyers. GDPR is a much-evolved form of European regulation allowing data subjects to file suits against data collectors whom they believe are violating their rights. This battle is going to be fought in 28 EU countries courts much sooner than in their Data Protection commissioners ministries who enforce the law and handout fines for violations.
Activist legal teams like Austrian noyb and its founder Max Schrems who had a strong hand in drafting GDPR are taking up these complaints. Meanwhile activist Privacy International is going after the likes of Oracle – filing complaints in the UK along similar lines as to the claims against Google and Facebook in that there is ongoing disregard to establishing legitimate-use of data collected and a disregard of individual’s rights because in fact those individuals do not know their data is being collected, so there is no expectation they can ask that their data be removed.
Regulator action will take time – six months is too early to get a proper read. Yet, we can still get a feel for what is going on by looking at what’s happening in a given country. The UK is interesting; their Information Commissioner predates GDPR as UKs privacy regulations go back to 1998. The UK commissioner is currently publishing findings and leveling fines after investigations for activities dating back to 2016. That gives us a feel for how long investigations may take under GDPR.
Perhaps we will not know the full impact for another two years to the magnitude of fines levied. Facebook’s challenges with Cambridge Analytica were lucky in that they fell under the prior law resulting in a smaller 500K GDP fine than the billions allowed by GDPR. Breaches at British Airways and others, which took place since GDPR became active, are being carefully monitored to see if in fact they were properly reported to the UK commission within the 72-hour limit of being discovered.
The hotbed for US companies is Dublin as Ireland is where many US companies have their European headquarters. Helen Dixon, the current Republic of Ireland Commissioner, and her office is one of the busiest in Europe working with these companies as they scrabble to be complaint under the law.
GDPR has had influence internationally – 10 countries including Canada, whose law just went active this month, now have very similar laws. California also has a much-watered down version that went into affect as well. None of these laws carry the same fines, but most allow for litigation. California is just one of 26 states that have such laws on the books. These laws vary widely in their rules. Because of this the Internet Association, an influential lobby group for Internet based companies, has come out indicating it would be for a single US law to provide uniform privacy assurance.
The difference being in how they want the law to be written. Here is an example: Google’s Android OS terms and conditions states that the user, by activating their service, consents to Google’s collection of their personal data across All Google products for any use. Today once you activate you can’t go back and ask them to remove you. The Internet Association’s President Michael Beckerman, states that individuals should have a right to ask what has been collected and then have this information removed – If they discontinue using the product/service. The difference is GDPR does not force you to disconnect your $1000 phone.
Given all that, perhaps its not surprising that Apple CEO, Tim Cook, has come out strongly in favor of having a similar strength version of GDPR here in the USA. Apparently they don’t collect the same data that Google, Facebook and Amazon do. Score one for capitalism?
All-in-all GDPR has had a subtle but extremely influential impact in the Internet world already. With all the lawyers involved, it’s not likely going by the wayside anytime soon.
Industry: Cyber Security News
- DevOps Engineer with IdAM
- Upto £80,000 plus benefits
We are ooking for an DevOps engineer, idealy with IdAM (identity access Management) experience, this is a senior role for someone that can be the lead hands on person on a project. Your role will be to work on the deployment project implementing the solution into the exsiting application so will be used to connect an applications into mulipe 3rd party appliactions. We Would look at someone who has done DevOps with Security and can cross train into IdaM, but preference would be given to someone with the IdAM experience this is a great opportunity to join a consultancy that work on some truely amazing and differnet solutions
- Senior SOC Analyst. Level 3 Palo Alto Wildfire, Rapid 7, Fortify, Splunk.
REF CH7840 Senior SOC analyst (Palo Alto Wildfire, Rapid 7, Fortify AND Splunk) Flexible location £55,000 + Senior SOC analyst needed (Level 3) that can achieve SC clearance for a permanent role. We are looking for Level 3 SOC Analysts with two or more of the following; Palo Alto Networks Wildfire (#malware) Rapid7 Nexpose Micro Focus Fortify (#automated #applicationsecurity) AND ideally Splunk. The role will include, but not be limited to; managing and handling incidents end to end, supporting and mentoring level 1 / level 2 staff, supporting the SOC manager in the delivery of the SOC roadmap, engaging with the client stakeholders (other technical teams) as and where needed, use case development, advanced search and reporting etc. Flexible location, commutable in the future to London or Birmingham This role will sit within a public sector client so the individual must be able to achieve SC clearance. To arrange a call with Chris Holt use this calendy link https://calendly.com/chris-holt/arranged-call-with-chris-holt-remote-soc-role Chris.Holt@dclsearch.com 07884666351
- Identity & Access Management (IdAM) Consultant
- Upto €100,000 plus bonus and benefits
An Identity & Access Management Consultant is needed to lead and drive technical and or business transformation projects in a client-facing position for a prestigious consultancy in Germany. The Identity & Access Management Consultant will be responsible for technical design and implementation of Identity & Access Management/IAM products within a wide variety of clients. The Identity & Access Management Consultant will have a blend of technical hands-on and client-facing consultancy with the ability to develop new business. Broad technical knowledge across Identity and access management is benefical. The Identity & Access Management Consultant will need to have technical hands-on experience with one or more of the following core areas; Privileged Access Management (PAM, CyberArk, Beyondtrust, Thycotic) Identity Governance Administration (IGA, Sailpoint, Omada, RSA) Customer Identity & Access Management (CIAM, Forgerock PSD2) The Identity & Access Management Consultant must have the willingness to travel to customer sites across Germany.
- PCI DSS Security Specialist, Level 1 Service Provider,
CH7827 Payment Card Industry DSS Security Specialist, Level 1 Service Provider End User. £75,000 Flexible location, ocassional travel to London- Covid permitting Payment Card Industry DSS Security specialist needed to join a Security team to work with a highly respected CISO within a Level 1 Payment Service Provider. The PCI- DSS Security Consultant will have end to end responsibility for PCI - DSS and its continuing certification. 2021 / 2022 plan is to transition PCI to the cloud. Experience must include a focus into the Payment Card Industry. A mix of Information Security standards, frameworks, audit principles, controls / policies and the management and use of the technical tooling to achieve compliance is essential. PCI objectives / 12 key requirements, OWASP top 10, ISO 27001, NIST Cybersecurity Framework etc An ideal candidate will be working within an end user environment with a cyber consultancy background. PCI Cloud compliance, specifically someone with experience taking PCI-DSS from on premise into the cloud is HIGHLY desired. However, someone with Solid PCI experience with a strong technical background which include Cyber / Secure by design etc would be considered. Experience managing internal stakeholders and external third parties essential. Flexible working, but with the ability to get into London. This is an exclusive role to DCL Search & Selection. Arrange a call with Chris Holt on https://calendly.com/chris-holt/arrange-a-call-chris-dcl-pci-compliance