The 25th of May has come and gone and the one thing that stands out the most as a result of the effective date of the GDPR is the requirement to have a “registry”, or records of what data you process. This idea of inventorying and analyzing what data is processed, for what purpose, and who gets to use it has long been a central feature of intellectual property protection programs (pardon the alliteration). However, it is now the front and center “tent pole” which leads all other privacy controls to the result known as accountability.
(more…)

Over the last few months, the risks of collecting and sharing data, and the perils of ignoring these risks, have been demonstrated by data management scandals from Equifax to Strava to Cambridge Analytica. In these examples, companies failed to understand and manage the privacy risks posed by their data practices, and the people whose data they held were exposed as a result. The European Union’s General Data Protection Regulation, which took effect on May 25, emphasizes privacy risk and will force companies to carefully weigh the risks against the benefits.
(more…)