From: Insurance Business
Author’s Note: The European Union adopted in April last year the General Data Protection Regulation, which has the potential to change the way cyber insurance is offered around the world. The rule takes full effect in 2018.
BDO Consulting Technology Advisory Services managing director Judy Selby took time to field Insurance Business’s questions on the matter. Here are her answers.
IB: How do you see the EU regulation changing the US regulatory environment?
JS: Generally speaking, US enterprises that handle or process the personal data of EU citizens will be subject to the provisions of the General Data Protection Regulation (GDPR)—regardless of where the company is headquartered. This means that US entities that transfer data to, from or within the EU will need to prepare to meet the regulation’s new requirements. The GDPR imposes liability on both the data controller and the processor, so these changes can have a significant impact on those conducting investigations or processing protected data. This includes when a US law firm or e-discovery service provider collects, processes and hosts data.
Since some of the GDPR provisions are stricter than US laws and regulations, many US businesses will need to tighten up their data protection standards to continue operating with EU citizens’ data. One notable difference between the EU and the US is the EU’s stronger emphasis on individual data privacy rights; this can be seen in the GDPR’s inclusion of EU citizens’ “right to be forgotten”. If a data subject makes this request, the controller must erase the subject’s personal data “without undue delay”, typically within a month. The controller must also inform other controllers about the individual’s objection. This makes it difficult for investigators, as they might find potentially relevant evidence temporarily or permanently unavailable—even though retaining that data may be legal in other jurisdictions or the erasure request may ultimately be unwarranted.
Leave a Reply