GDPR at a critical stage, says information commissioner

Implementation of the EU’s General Data Protection Regulation (GDPR) is at a “critical stage” just 11 months in, according to UK information commissioner Elizabeth Denham.

“I believe we’re entering a new stage in the GDPR’s development. I want to talk about how that gives you, as data protection practitioners, an opportunity to make a positive impact,” she told the12th annual Data Protection Practitioners’ Conference (DPPC) hosted by the Information Commissioner’s Office (ICO) in Manchester.

“We find ourselves at a critical stage. For me, the crucial, crucial change the law brought was around accountability. Accountability encapsulates everything the GDPR is about.”

Denham said the GDRP enshrines in law an onus on companies to understand the risks that they create for others with their data processing, and to mitigate those risks. It also formalises the move away from box ticking to seeing data protection as something that is part of the cultural and business fabric of an organisation, and it reflects that people increasingly demand to be shown how their data is being used, and how it is being looked after, she added.

However, she said this change is not yet evident in practice. “I don’t see it in the breaches reported to the ICO. I don’t see it in the cases we investigate, or in the audits we carry out,” she said.

Denham said this is both a problem and an opportunity. “It’s a problem because accountability is a legal requirement, it’s not optional. But it is an opportunity because accountability allows data protection professionals to have a real impact on that cultural fabric of your organisation,” she said.

By helping organisations to understand the need to reassess the relationship with patients, employees, donors, residents and the general public, she said data protection professionals can have a real and lasting impact.

According to Denham, the next phase of GDPR requires a refocus on comprehensive data protection – embedding sound data governance in all business processes.

“An accountability approach gives those of you who have the skillset, who have the passion, a chance to see a changing world as an opportunity to have a real and lasting impact,” she said.

In this regard, Denham said the ICO is trying to lead by example, citing, among other initiatives, the ICO’s response to the challenge of Brexit by developing an international strategy that takes a fresh approach to the ICO’s relationship with the world and how it influences the global data protection debate.

Commenting on the government’s newly published Online Harms whitepaper, Denham said the proposals reflect people’s growing mistrust of social media and online services.

“People want to use these services, they appreciate the value of them, but they’re increasingly questioning how much control they have of what they see, and how their information is used,” she said.

“That relationship needs repairing, and regulation can help that. If we get this right, we can protect people online while embracing the opportunities of digital innovation.”