sb-eu logo
Story image

Why are Australian Organisations so unprepared for Europe’s GDPR law?

25 Jan 2018

The European Union's (EU) General Data Protection Regulation, scheduled to come into force on May 25th, will affect all organisations that handle personal information from European citizens. So why are Australian organisations, many of whom have customers and employees in the EU, so unprepared for the General Data Protection Regulation (GDPR)?

It’s the most comprehensive piece of privacy legislation developed by any jurisdiction to date and goes way beyond the requirements of Australia’s current privacy regulations, an update to which comes into effect on 23 February, effectively forcing Australian organisations to report any data breaches to the Australian Information Commissioner.

While a lot of Australian companies will be focusing their attention on being compliant with the Australian legislation, many are unaware of the fact that any Australian company that holds, controls or processes personal data of any EU residents, whether they are customers or employees, needs to be compliant by the GDPR deadline in May.

Australian organisations that trade with the EU are grappling with the issue of how to ensure compliance with yet another privacy law and still maintain solid business processes. And the bad news for businesses is that yet another privacy regulation to be compliant with may become a new barrier to trade with the EU.

The good news though, for Australian consumers, is that both the GDPR and our own privacy legislation are serving as the impetus for companies to put consumer data protection top-of-mind.

It’s definitely not to be ignored and assumed to be a problem for European companies only, penalties for non-compliance are steep, starting with fines of €20 million (AU$31.2 million) and going as high as four per cent of global revenue, as well as sanctions including the power to stop a company trading in the EU.

There will be statutory obligations that include implementing technical and organisational security measures and indirect stipulations, such as deploying a due diligence process when on‑boarding a supplier, as well as ongoing monitoring and exit management.

Every Australian company should be asking themselves what their data footprint is in the European Union and do they have visibility of and control over what personal data they collect? If the answer is yes, then how do they use it and who do they share it with?

At any time from May 25 onwards, any organisation could be asked to provide evidence of GDPR compliance to EU or Australian privacy regulators, so they need to be aware and fully prepared for that to happen. And while Australia is 14,000 kilometres from Europe, many organisations will be impacted by the EU’s GDPR. While some companies may regard it as a straightforward regulatory compliance exercise, others will view the opportunity to demonstrate a competitive advantage in terms of the level of digital trust of personal information that a company is perceived as having.

Regulatory complexities of data privacy

In today’s digital world, astute companies have recognised the enormous value that is associated with gathering huge swathes of customer data for analysis, segmentation and targeting purposes. As globalisation marches on and data flows easily across borders, so does the regulatory complexity associated with data protection and privacy.

Accordingly, risks associated with data protection and privacy will cease to be managed from a national regulatory standpoint alone. Australian companies now need to consider the protection of customer data from a global perspective. The Office of the Australian Information Commissioner (OAIC) recommends that organisations here start to evaluate their information handling processes and governance, looking for professional advice if they need it, to bring about the required changes in advance of the introduction of the EU GDPR.  

Preparation for GDPR compliance

The GDPR law will impose a range of new rules that have not been introduced under the local Australian legislation. To be compliant by May 2018 requires significant preparation and an investment in skilled resources, particularly for non-EU entities. Some companies may find that they have difficult choices to make about their priorities moving forward and some may feel that the risk of trading with the EU when they are unsure if they are compliant, is greater than the potential reward.

For any companies that are unsure, it is advisable is to conduct a Security and Privacy Risk Readiness Assessment, which they can either do in-house if they have the skills or bring in a professional security testing specialist. The process of identifying and mitigating potential risks will ensure that Australian companies can define a roadmap for GDPR compliance and have enough time to test, refine and implement their breach-response plan, which meets GDPR’s strict 72-hour notification requirement.

The risk assessment should include:

  • Identify critical data collection sources
  • Review appropriate safeguards to protect personal data privacy in collection, processing, and storage
  • Review limits and conditions on collection and usage of personal data
  • Review of authorisation rules for personal data usage and disclosures

Since non-compliance represents a significant financial and reputational risk, I would strongly suggest that achieving compliance with EU GDPR provides a significant opportunity for Australian organisations to be admired for their high level of digital trust of the personal information they hold on EU citizens.

Article by PlexNet CEO Sergio Ferreira.

Story image
Gartner predicts 75% of CEOs to be liable for cyber-physical security incidents by 2024
The nature of CPSs means incidents can quickly lead to physical harm to people, destruction of property or environmental disasters – and Gartner’s new research indicates that these incidents will increase drastically in the next few years if the lack of spending on these assets continues.More
Story image
Is cyber deception the latest SOC 'game changer'?
Cyber deception reduces data breach costs by more than 51% and Security Operations Centre (SOC) inefficiencies by 32%, according to a new research report by Attivo Networks and Kevin Fiscus of Deceptive Defense.More
Story image
Lazarus Group linked to phishing attacks on cryptocurrency sector
In this case, the attacks were launched through a phishing document sent via LinkedIn to employees at the targeted organisation. This phishing document was styled to look like a job advertisement for a role in a blockchain company.More
Story image
BT Security shakes up roster of vendors after 'largest ever' partner review
BT says the decision to review their security partner base was driven by the recognition that many customers find it difficult to navigate today’s complex security landscape, as well as customers’ desire to have a ‘leaner set of partners’.More
Story image
Global DDoS attacks: What they are, how they work, and how to defend against them
Do not pay the ransom, and do make sure you've got strong DDoS protection, security firms warn.More
Story image
Acronis announces new security endpoint solution
The solution is an integration of data protection and cybersecurity which provides customers with effective endpoint protection in a landscape where the pointlessness of perimeter security is becoming more pronounced.More