sb-as logo
Story image

Google's €50m fine a wake up call for big data analytics

23 Jan 2019

You only have to look as far as Google’s €50 million slap on the wrist from France to know that GDPR is here and the first wave has begun.

Now that there’s another high-profile case that demonstrates the consequences, companies must now focus on more than just consent to show that they are legally allowed to process analytics and AI, says security firm Anonos.

Data analytics are essential to company growth, competitive differentiation, and innovation. But there’s now a huge challenge.

“When analytics and AI cannot be described with specificity at the time of data collection - which is mostly the case with secondary processing - corporations can no longer rely on consent as they did before the GDPR. New technical and organisational safeguards are required under the GDPR to support analytics and AI processing,” says Anonos CEO Gary LaFever.

Now to remain legal under GDPR, organisations must have GDPR-compliant technical and organisational safeguards in place for secondary processing like iterative analytics and artificial intelligence (big data).

Those safeguards must do the following, according to Anonos:

1.    Satisfy a "balancing of interest" test that requires "functional separation" (the ability to separate the information value of data from the identity of data subjects) to reduce the negative impact on data subjects so that the data controller's legitimate interests are not overridden. Recent high-profile lawsuits against Oracle and Acxiom make it clear that simply claiming a "legitimate interest" in commercialising personal data is not enough;

2.    Ensure compliance with requirements that the secondary processing is compatible with the original purpose for which the data was collected; and

3.    Restrict access by default to the minimum data necessary for each purpose for which it is processed - known as Data Minimisation, a level of granular control not supported by traditional technologies like encryption.

“Technical and organisational safeguards satisfying these GDPR requirements were not previously required for lawful secondary processing using consent. As a result, most organisations do not have required new technology in place. What was ‘good enough’ prior to the GDPR is no longer legal.”

Advocacy groups that champion privacy are proactive – (Max Schrems' None Of Your Business (nyob) organisation in Austria and France's Quadrature du Net in the case of Google and UK-based Privacy International in the case of Oracle and Acxiom), LaFever notes.

Organisations need to assess and implement appropriate technical and organisational safeguards that enforce functional separation in a timely manner to ensure uninterrupted access to data, analytics and AI to fuel growth, competitive differentiation and innovation,” concludes LaFever.

Story image
CompTIA forms Cybersecurity Advisory Council, led by 16 security execs
The new body will be co-chaired by Tech Data director of security solutions Tracy Holtz, and Alvaka Networks chief operating officer and chief information security officer Kevin McDonald.More
Story image
Cybersecurity spending to increase following SolarWinds hacking
Hackers breached software provider SolarWinds, directly infecting the company’s Orion software as well as several local, state and federal agencies.More
Story image
Hornetsecurity acquires Altaro, the latest in acquisition spree
The move is a culmination of a medley of acquisitions made by Hornetsecurity recently, following the January 2019 acquisition of Spamina, a Spanish cloud email security company, as well as EveryCloud, its British market partner, in early 2020.More
Story image
Malware variants becoming increasingly prevalent, sophisticated and evolved
"The modern threat landscape and ongoing evolution of malware are loud factors pushing every business to understand and identify modern malware threats and the necessary precautions to take to protect against them."More
Story image
Dark net vendors wanting Bitcoin payments for unverified COVID-19 vaccines
As the medicines are being offered on the dark net, purchasers have no way of knowing whether they are genuine, according to Check Point.More
Story image
Cybercriminals leverage AI to sustain attacks on enterprises
What is less discussed is how cybercriminals are taking advantage of those very same technologies to automate their attacks, too.More