No real change a year into GDPR, says privacy expert

Window dressing data privacy

Room believes that one of the key reasons there has not been an “appreciable movement in data protection maturity levels” in the past year is that organisations are not engaging with the people who can change data itself.

“So if you take the fact that we are being asked to do privacy maturity programmes when they should have been done, together with the evidence that data scientists may be disenfranchised, it tells us we are potentially no further forward, and until that changes, we are not going to see any real improvement.”

According to Room, the disenfranchisement of data scientists is symptomatic of a “significant failure to understand in the economy that if we are not engaged with people who are truly experts on data itself, we cannot lead the dialogue in a meaningful sense.”

The result of many GDPR readiness programmes was a plethora of privacy policies, but Room said all that essentially amounts to “window dressing” because policies and procedures are not the “corpus” of data privacy.

“They are facilitators of data privacy. What you want is data privacy to operate inside data and technology. That is the goal, not the policy. It’s about the change to how data is used, and the rest is just window dressing in my mind,” he said. 

Business purpose

Since the implementation of the GDPR, Room said there has been a “fixation” among privacy practitioners on the idea that the regulatory system needs to deliver pain and punishment to deliver change, with a great deal of discussion and focus on the potentially huge fines under the GDPR.

“We are deluding ourselves about the power to change that comes from enforcement action such as fines. We should not be investing our hopes in pain if we want to deliver change,” he said, adding that already this has led many to believe GDPR is about US tech giants.

“One year on, many organisations are thinking the fight is against US technology companies and not really about them. Not only is that distortion troubling, but so too is the view that pain is key to change because that suggests a fundamental failure to understand the significance and importance of the subject matter in its own right,” said Room.

The focus should not be on the fines and other enforcement actions, he said, but on the fact that the GDPR is about fundamental rights and freedoms. “Data privacy, in the European sense, is about human rights and human protection, which is important on its own without the threat of fines,” he added.

According to Room, there needs to be a change of perspective. “I don’t think that the idea of looking at data privacy as a legislative or compliance issue is the most productive way of looking at it. Instead, we need to look at this from the perspective of business purpose.

“Business purpose is the reason for its existence, and that delivers a value and societal contribution for good. While that value equates to profit, profit itself is not the purpose of the business. The business purpose of PwC, for example, is to help solve complex problems.”

Understanding business purpose and having a purpose, said Room, is recognised as being at the heart of good corporate governance. “The new UK corporate governance code from the Financial Reporting Council [FRC] specifically requires the identification of purpose and a consideration of the risks to the business in the context of its purpose,” he added.

In this context, he said if the use of personal information is critical to the well-being and success of a business, the business importance of data privacy is clear.

“What companies need to be talking about, therefore, is how to equate good use of personal data and data privacy with business purpose, and not how to equate it with a legal compliance issue that may deliver pain,” he said.

Business purpose is about “gain”, while the regulatory regime is about preventing “loss”, said Room. “The argument about gain is much more attractive than the argument about loss. If we start looking at data privacy in the context of the purpose of the business, the reason for its existence and its long-term health, we can start to deliver better outcomes,” he said.

If businesses view data privacy as something that is going to make them successful and look at it through the lens of how to enable business gain, Room believes data is going to be better analysed. “Better quality data analytics may be able to accelerate the performance of particular business functions or it might become an economic asset in its own right,” he added.

But a year on from the GDPR compliance deadline, very few organisations are looking at data privacy from a gain perspective. “Otherwise, the chief data architect would be involved because the whole business is going to be engaged towards gain. Instead, people are hoping for fines to deliver change, which I believe is wholly the wrong way round. What we should be looking at is how do we gain from data privacy, not how do we avoid loss,” said Room.

“Business purpose is the right conversation. If we get to purpose, it will then deliver data privacy outcomes inside technology and data and therefore complete the journey to code. Hopefully, the new UK corporate governance code will act as an accelerator in this regard by putting the obligation on boards to consider the business purpose and the associated risks, and to do what they perceive to be necessary to maintain the health of the business,” he said.