What is the 'General Data Protection Regulation (GDPR)'

The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information of individuals within the European Union (EU). The GDPR sets out the principles for data management and the rights of the individual, while also imposing fines that can be revenue-based. The General Data Protection Regulation covers all companies that deal with data of EU citizens, so it is a critical regulation for corporate compliance officers at banks, insurers, and other financial companies. GDPR came into effect across the EU on May 25, 2018.

BREAKING DOWN 'General Data Protection Regulation (GDPR)'

The GDPR was adopted in April 2016 and adds to the EU’s general policy of protecting citizen’s data. In addition to the notifications of collection and legal ramifications for misuse, there is also a requirement to obtain explicit consent, notify in cases of a hack or breach, appoint dedicated data protection officers and much more. For financial institutions, the new rules will require significant investments in compliance to ensure continuing access to the EU market. The new rules are also pushing firms to pseudonymize personally identifiable information (PII) prior to processing it, meaning that the data can’t be attributed back to a particular person. The pseudonymization of data allows firms to do some larger data analysis such as assessing average debt ratios of its customers in a particular region — that would otherwise be beyond the original purposes of data collected for assessing creditworthiness for a loan.

GDPR Versus Big Data

The GDPR has effects beyond lending, insurance and other firms where sensitive personal data is collected and processed as a matter of course. The rules apply to the human resources record of employees and even the IP addresses of people using online services. The GDPR builds upon data rights that the EU has been pushing for, such as the right of an individual to be forgotten and the right to data portability.

As such, it is expected that the GDPR will lead to data minimization where companies willingly prune down the amount of information they collect to the functional essentials needed to complete a transaction. This could be a reversal of one of the big data trends where companies seek to collect and analyze as much data on their customers as possible in order to gain new insights. This analysis can still take place after appropriate pseudonymization, but other data rights prevent those insights from being used to profile customers in a way that could be discriminatory or put them at a financial disadvantage. As the GDPR is a new regulation, there will no doubt be a period of adjustment where gaps and thorny issues like profiling are addressed.   

Challenges Associated With the GDPR

The decision to implement the GDPR has come with criticism. Those opposed to the new regulation say that the position of the DPOs could be an administrative burden for many EU countries. The guidelines were set to include social networks and cloud providers, but did not consider how to deal with employee data. In addition, data cannot be transferred to another country outside the EU, unless it guarantees the same kind of protection. Companies that didn't have this kind of privacy protection may be required to change their business practices. The costs associated with the proposed regulation may also increase (due to the need for more investment) and general education in data protection may also be required. Data protection agencies across the EU will need to agree to a standard level of protection, something that may not be easy as they may disagree in the interpretation of the guidelines. 

RELATED TERMS
  1. Safe Harbor Agreement

    The Safe Harbor Agreement was drafted to protect EU citizen’s ...
  2. Compliance Cost

    Compliance cost refers to all the expenses a firm incurs in order ...
  3. Data Science

    Data science is a field of Big Data that seeks to provide meaningful ...
  4. Enterprise Information Management ...

    Enterprise information management refers to the optimization, ...
  5. Regulation C

    Regulation C is a regulation that orders depository institutions ...
  6. Portability

    Portability is an employee's ability or right to retain certain ...
Related Articles
  1. Investing

    All You Need to Know About GDPR, the New Data Law

    Here’s a look at the General Data Protection Regulation (GDPR) that will take effect on May 25
  2. Investing

    Data Furor Show's Apple's Competitive Edge: UBS

    Facebook and Google’s controversial handling of user data highlights the strength of Apple’s business model, said one Wall Street analyst.
  3. Managing Wealth

    Data Integrity Analyst: Job Description & Average Salary

    Learn about the average salary of a data integrity analyst and the required skills, education and previous experience needed to fill this role.
  4. Tech

    Data Analyst: Job Description & Average Salary

    Learn about a data analyst career and how much money you can expect to make. Understand the skills and education needed to become a data analyst.
  5. Tech

    Financial Advisors' Next Big Tech Tool: Big Data

    Here's how big data is playing a crucial role in the work life of financial advisors and some strategies on how to take advantage of the technology.
  6. Tech

    How Big Data Has Changed Marketing

    Big data has enabled marketers to enhance their customer engagement and customer retention strategies by providing insight into behavior and thoughts.
  7. Tech

    Predictive Analytics Drives Return for Investors

    A new industry of predictive analysis has developed to make sense of big data and give investors real-time buy and sell recommendations based on the patterns forming in the data long before traditional ...
  8. Insights

    World Bank Data For Dummies

    Developing countries can't always afford to track the data crucial to setting the right economic policies and programs. That's where the World Bank steps in.
  9. Investing

    Microsoft Updates Privacy Policy for Windows 10

    Microsoft is gearing up to share more information about the data it collects from Windows 10 users.
  10. Insights

    Countries With The Best And Worst Investor Protection

    Discover which countries do the most to protect the little guy from scheming executives and shady back-room deals.
RELATED FAQS
  1. In which industries is Average Collection Period most important?

    Find out which industries are most concerned with average collection period, and how different types of companies interact ... Read Answer >>
  2. How is cash flow affected by the average collection period?

    See how reducing a company's average collection period can help cash flow, and learn why collections practices are so important ... Read Answer >>
  3. What agencies oversee U.S. financial institutions?

    Discover the specific responsibilities of some of the major regulatory agencies that oversee financial institutions and markets ... Read Answer >>
Trading Center