Countdown ... from days, we switch to hours.

Never has there been so much attention to privacy. At least it seems so, but is it sincere? My mailbox is overflowing with notices like 'we have rewritten our privacy regulations', 'opt in to stay with us' and so on. The introduction of the General Data Protection Regulation has preceded years of preliminary work. The starting point is the fact that privacy is a fundamental right and that in a data driven economy the ownership of data should really lie with you as a user and not with the app or the platform on which you have made your data available. The recent scandals have made it clear to us how things can go wrong.

Yet the question is whether the world will change substantially after the 25th of May? Undoubtedly there will still be a lot of consultants making long hours to inventorize all data that has been scattered accros companies. In order to convert this into an appropriate set of measures such as privacy regulations, privacy policies, procedures and technical measures. But how do we know for certain that companies 'improve' their behaviour when it regards your fundamental right for privacy?

Most of us have no idea what it is about. Who actually reads the privacy regulations now? Who asks questions about how it should all be interpreted. I often wonder why all those data are collected, I do not always see the need for it. In addition, it is often an all or nothing matter if you do not agree then you can forget the use of a product or service. Well, ... in that case what do you choose?

The implementation of the GDPR is a starting point, I think to a more and more privacy conscious society, were there is still a strong need to raise awareness as well as improvement in all kinds of areas. Many uncertainties that need to be clarified, also regards law enforcement. For example, it does not work at my private life when I first show my teeth to my kids and then be consistent in drawing a line. Children know how to play the game very well. How does enforcement work in practice? Will the Authoriteit Persoonsgegevens start to scale their investigations and and issue penalties? Not really likely if you rely on the news about limited manpower and capacity. Will companies and governments more intricately organize their handling of data and associated privacy? That’s also not very likely either, why should the rush … let’s see and wait how things evolve. The GDPR is derived from Wet Bescherming Persoonsgegevens, which has been in force since 2001. The GDPR was announced in 2016 with an implementation period of 2 years! And then in the last weeks the call they all call for postponement. Fortunately, the Authority holds on, but yes ... some leniency will be applied in the first period.

The question remains why do we come into action so slowly ...

In the past, it was the case that most of us only opened the books at the last moment and then went mad to study for a test or exam. Now it is true that many of us - sometimes with the heels over the ditch - succeed in that. But let's face it ... every time I thought next time I will do better. And then - ha ha - fall back into the old pattern again. Privacy can not be neglected. Nowadays a large amount of data is processed. Let alone that we know exactly which data we collect and how it is processed and to which outcome it leads. In addition, the way of working over the last years has changed a lot, we work flexible and with many partners who also add value, process data, etc. somewhere in this chain. This means that it is almost impossible to sit down for a last minute crash action. Because if a supervisor gives you a reprimand you have to. No, this is simply not possible.

So it requires a different approach, in which we learn to put the client (and the trust of the customer) first. And from the first design process respect the privacy and the way data is processed. You will see that this requires a multidisciplinary approach, because a marketer has different interests than a corporate lawyer or an IT professional. In the discussion and development of the proposition, the right balance must be found. The demand for all-round professionals who can properly translate the impact of privacy into service design will, I think, increase.

We will actually have to take measures whereby both the customer and internally involved parties are transparent about which customer data is used and which measures have been taken to protect it. I am very curious as to how the supervision will work out over time. It is to be hoped that enforcement by the Dutch Data Protection Authority will also give a lot of clarity. I think it's a utopia to think that self-regulation or the influence of a competitive playing field will have a lot of influence here. Then you will always have some ones in the ecosystem that will take advantage of this or abuse it. In short, a supervisory body that has the power to actually inspire, motivate and maintain the regulaory framework is needed. 'Is it the end of the world as we know it' as REM sang in their song in 1987?

I keep reading and developing myself in the field of privacy and cybersecurity because I think it is a fascinating playing field and it will probably become even more interesting in the coming years. Interesting times are coming up 'And I feel fine'.

#GDPR #AVG #Privacy #Privacybydesign #innovation #disruption