Freely subscribe to our NEWSLETTER

The new rules would give individuals greater control over their personal data, make businesses more accountable for that data – with stricter requirements for protection and penalties around data breaches, for example – and commit EU member states to a set of consistent, legally-enforced regulations and rigid definitions. Companies outside the EU would have to abide by these rules.
But three years is a long time in the rapidly evolving digital universe, and it is likely to be another year before the proposals are finally agreed upon. Consumer attitudes and behaviours have changed significantly since 2012, let alone 2010 when the research was undertaken. Moreover, new tools and technologies have transformed the way data can and is being used by business.

For example, over the last few years, new digital marketing tools have entered the market that can capture, track, profile, target and personalise individuals more effectively than ever before. They draw on the cloud of context, location, browsing and the behavioural data consumers now generate with every digital interaction. In such a complex, data-rich landscape, it will be a tough ask for businesses to seek and obtain ‘explicit consent’ from each consumer as demanded by the proposals.
The rise of e-health applications, personal lifestyle monitoring, cloud computing (where personal data could be held anywhere in the world), and of course the internet-of-things, are further transforming what data can be collected and how it is used. BMW recently reported that it is under growing pressure to release the data collected by its connected vehicles, including information on individual car performance, speed, navigation and even its current occupants.[ii]

With such technology-enabled, data-driven services entering everyday life, consumers are becoming more complacent about data use. Our own European research[iii] found that 88 per cent of consumers say they now deal with so many organisations, both online and offline, that they don’t know who holds what information about them. Three quarters (72 per cent) are not convinced that the benefits of having their information deleted are worth the bother of getting it removed.

However, such tolerance is not universal. There are areas where data privacy concerns are rising sharply. The widely reported NSA investigations, growing cyber-threats and invasive marketing leave many consumers feeling vulnerable and angry about how their personal data is gathered and put at risk.
In short, connected consumers are setting their own standards for acceptable data privacy. Studies show people are prepared to reveal more information to the organisations they trust[iv]. Often these are the businesses that have effective data security and privacy standards in place. As industry analyst Forrester says: “in the battle to win, serve and retain customers, data security and privacy have become competitive differentiators.”[v]

Companies may be better off responding to the evidence of such consumer behaviour than waiting for the legislation to be finalised before deciding how to prioritise and protect the use of personal data in their business.
This is even more important because, during the course of the last three years, a number of landmark events have meant that, in the absence of the new legislation, other entities have started to make important data protection decisions. These include the May 2014 judgement against Google on the ‘right to be forgotten’, a cornerstone of the proposed regulation.

There is a great deal that is valuable, and much needed, in the new proposals. They will ensure consistency across the 28 European member states and with organisations outside the EU that collect, store or process European data. The rules seek to build a strong framework around the use of personal data in research, and need for ‘anonymising’ such data. Furthermore, they aim to ensure that definitions for things such as ‘data consent’, ‘data portability’, the ‘right to erasure’ and ‘data breach notification’ are universally agreed, understood and implemented.

Organisations need to prepare. Iron Mountain has published a business advisory paper to mark World Data Protection and Privacy Day[vi] that we hope will help organisations to grasp the full implications of the new regulation and understand why they matter. Not just in 2016 when they are finally agreed upon and implemented; but right here, right now.

[i] http://ec.europa.eu/public_opinion/archives/ebs/ebs_359_en.pdf
[ii] http://www.ft.com/cms/s/0/685fe610-9ba6-11e4-950f-00144feabdc0.html#axzz3OsZu9BFU
[iii] The research was conducted by Opinion Matters for Iron Mountain, February 2014. Opinion Matters surveyed 1,257 office workers who work in manufacturing & engineering, legal, financial, pharmaceutical or insurance from the UK, France, Germany, Netherlands and Spain. The research was carried out between 10/01/2014 and 22/01/2014.
[iv] 50 per cent of UK of consumers will share more personal information with a brand they trust. One Poll survey of 2,000 UK online shoppers aged 18 to 55+, conducted online on Thursday 14 and Friday 14 August 2014.
[v]https://www.forrester.com/Predictions+2015+Data+Security+And+Privacy+Are+Competitive+Differentiators/fulltext/-/E-RES116328
[vi] An opportunity to plan and manage the impact of legal change http://www.ironmountain.co.uk/services/dpd.aspx