What is the 'General Data Protection Regulation (GDPR)'

The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information of individuals within the European Union (EU). The GDPR sets out the principles for data management and the rights of the individual, while also imposing fines that can be revenue-based. The General Data Protection Regulation covers all companies that deal with data of EU citizens, so it is a critical regulation for corporate compliance officers at banks, insurers, and other financial companies. GDPR came into effect across the EU on May 25, 2018.

BREAKING DOWN 'General Data Protection Regulation (GDPR)'

The GDPR was adopted in April 2016 and adds to the EU’s general policy of protecting citizen’s data. In addition to the notifications of collection and legal ramifications for misuse, there is also a requirement to obtain explicit consent, notify in cases of a hack or breach, appoint dedicated data protection officers and much more. For financial institutions, the new rules will require significant investments in compliance to ensure continuing access to the EU market. The new rules are also pushing firms to pseudonymize personally identifiable information (PII) prior to processing it, meaning that the data can’t be attributed back to a particular person. The pseudonymization of data allows firms to do some larger data analysis such as assessing average debt ratios of its customers in a particular region — that would otherwise be beyond the original purposes of data collected for assessing creditworthiness for a loan.

GDPR Versus Big Data

The GDPR has effects beyond lending, insurance and other firms where sensitive personal data is collected and processed as a matter of course. The rules apply to the human resources record of employees and even the IP addresses of people using online services. The GDPR builds upon data rights that the EU has been pushing for, such as the right of an individual to be forgotten and the right to data portability.

As such, it is expected that the GDPR will lead to data minimization where companies willingly prune down the amount of information they collect to the functional essentials needed to complete a transaction. This could be a reversal of one of the big data trends where companies seek to collect and analyze as much data on their customers as possible in order to gain new insights. This analysis can still take place after appropriate pseudonymization, but other data rights prevent those insights from being used to profile customers in a way that could be discriminatory or put them at a financial disadvantage. As the GDPR is a new regulation, there will no doubt be a period of adjustment where gaps and thorny issues like profiling are addressed.   

Challenges Associated With the GDPR

The decision to implement the GDPR has come with criticism. Those opposed to the new regulation say that the position of the DPOs could be an administrative burden for many EU countries. The guidelines were set to include social networks and cloud providers, but did not consider how to deal with employee data. In addition, data cannot be transferred to another country outside the EU, unless it guarantees the same kind of protection. Companies that didn't have this kind of privacy protection may be required to change their business practices. The costs associated with the proposed regulation may also increase (due to the need for more investment) and general education in data protection may also be required. Data protection agencies across the EU will need to agree to a standard level of protection, something that may not be easy as they may disagree in the interpretation of the guidelines. 

RELATED TERMS
  1. Data Protection Officer (DPO)

    A data protection officer (DPO) is a position within a corporation ...
  2. Compliance Cost

    Compliance cost refers to all the expenses a firm incurs in order ...
  3. Data Science

    Data science is a field of Big Data that seeks to provide meaningful ...
  4. Data Anonymization

    Data anonymization seeks to protect private or sensitive data ...
  5. Regulation C

    Regulation C is a regulation that orders depository institutions ...
  6. Order Protection Rule

    The Order Protection Rule is a policy that aims to ensure that ...
Related Articles
  1. Investing

    Facebook Faces $663K Fine for Cambridge Analytica Data Breach

    Facebook's stock was down in pre-market trading after Britain's data watchdog revealed the company is facing a fine of $662,900.
  2. Tech

    How Big Data Has Changed Finance

    The vast proliferation of data and increasing technological complexities continues to transform the way industries operate and compete.
  3. Investing

    Data Furor Show's Apple's Competitive Edge: UBS

    Facebook and Google’s controversial handling of user data highlights the strength of Apple’s business model, said one Wall Street analyst.
  4. Tech

    Big Data in Financial Services Comes With Some Risks

    Big data is playing a larger role in finance but its application does not come without risks.
  5. Managing Wealth

    Data Integrity Analyst: Job Description & Average Salary

    Learn about the average salary of a data integrity analyst and the required skills, education and previous experience needed to fill this role.
  6. Tech

    How Big Data Has Changed Insurance

    No longer confined to technology, big data has become integral to providing solutions to the insurance industry's long standing challenges.
  7. Tech

    How Big Data Has Changed Marketing

    Big data has enabled marketers to enhance their customer engagement and customer retention strategies by providing insight into behavior and thoughts.
  8. Investing

    Apple, IBM Call for More Regulation of Digital Data

    In the wake of the Facebook data scandal, Apple and IBM are calling for more data protections.
  9. Financial Advisor

    Build A Wall Around Your Assets

    Learn how to protect your money from lawsuits, creditors and other judgment proceedings.
RELATED FAQS
  1. What is the most important type of data used in business analytics?

    Consider what makes data useful in business analytics, and why companies should search for the types of data that provide ... Read Answer >>
  2. Why is Average Collection Period important to a company?

    Discover why the average collection period can be a particularly important accounting ratio for a company that relies heavily ... Read Answer >>
  3. In which industries is Average Collection Period most important?

    Find out which industries are most concerned with average collection period, and how different types of companies interact ... Read Answer >>
Trading Center