What the Google 50 Million Euro GDPR Fine Means for Big Data Analytics

Anonos BigPrivacy , announced the following perspective on what the Google 50 Million Euro GDPR fine means for data insight driven companies.

The 50 Million Euro fine against Google demonstrates that the first wave of GDPR enforcement has begun.

Companies must now focus on more than consent to ensure that they have the legal right to process analytics and AI, which they rely on for their growth, competitive differentiation and innovation.

Many companies believe the way they processed analytics and AI before the GDPR is still legal – but that is not true.

When analytics and AI cannot be described with specificity at the time of data collection – which is mostly the case with secondary processing – corporations can no longer rely on consent as they did before the GDPR. New technical and organizational safeguards are required under the GDPR to support analytics and AI processing.

Read More:  Interview With Maria Loupa, Account Director at Ballou PR

For secondary processing like iterative analytics and AI to remain legal under the GDPR – commonly referred to as Big Data – organizations must now have GDPR compliant technical and organizational safeguards in place that:

1. Satisfy a “balancing of interest” test that requires “functional separation” (the ability to separate the information value of data from the identity of data subjects) to reduce the negative impact on data subjects so that the data controller’s legitimate interests are not overridden. Recent high-profile lawsuits against Oracle and Acxiom make it clear that simply claiming a “legitimate interest” in commercializing personal data is not enough;
2. Ensure compliance with requirements that the secondary processing is compatible with the original purpose for which the data was collected; and
3. Restrict access by default to the minimum data necessary for each purpose for which it is processed – known as Data Minimisation, a level of granular control not supported by traditional technologies like encryption.

Read More: Interview With Sven Lubek, Managing Director at WeQ

Technical and organizational safeguards satisfying these GDPR requirements were not previously required for lawful secondary processing using consent. As a result, most organizations do not have required new technology in place. What was “good enough” prior to the GDPR is no longer legal.

The recent 50 Million Euro GDPR fine against Google and lawsuit against Oracle and Acxiom highlight the proactive nature and significant influence of advocacy groups (Max Schrems’ None Of Your Business (nyob) organization in Austriaand France’s Quadrature du Net in the case of Google and UK-based Privacy International in the case of Oracle and Acxiom). As a result, organizations need to assess and implement appropriate technical and organisational safeguards that enforce functional separation in a timely manner to ensure uninterrupted access to data, analytics and AI to fuel growth, competitive differentiation and innovation.

Read More: Interview with Scot Marcotte, Chief Technology Officer at Buck