Magazine menu Close Magazine menu

regulation

Latest stories

chatGPT cybersecurity regulation

With ChatGPT’s vast innovative potential, regulators must take care

  • min read
    • ChatGPT and other artificial intelligence (AI) chatbot applications are major technological milestones with far-reaching benefits for many industries. But with each advance comes unintended consequences. With ChatGPT in its fourth iteration, and its underlying technologies growing fast, it's time to take stock of the policy landscape to understand its implications. What is ChatGPT, and how are businesses using it? ChatGPT is an AI chatbot made by OpenAI. It uses natural language processing (NLP) to create human-like text responses. Users can ask ChatGPT almost anything and receive relatively natural-sounding responses. It can write outputs like programming code, social media posts, summarize complex topics or almost anything text. ChatGPT is an example of generative AI: Artificial intelligence that learns to generate original content like images, music and text by identifying underlying patterns in existing examples. "Its primary objective is to create interactive and realistic conversations with users, making it a powerful tool for chatbots, virtual assistants and customer support applications," says AWS Solutions Architect Ragu Kuppannan. Many top companies are using ChatGPT. For example, travel outlet Expedia wants customers to be able to book a holiday in a way that feels like having a chat with a travel agent. Microsoft, a major investor in OpenAI, says ChatGPT already powers its search engine, Bing, and plans to add it to Word and Excel. ChatGPT could be promising for any application where natural, conversational interaction between people and tech would be beneficial. Risks of ChatGPT Critiques of ChatGPT and other chatbot applications generally focus on its potential to disrupt human employment, produce incorrect information or poor practice in training algorithms to identify harmful content. The underlying cybersecurity risks get less attention. Kaspersky's specialist threat intelligence teams have identified three main risk areas. First, ChatGPT can provide advice, even detailed guides, to help prospective attackers plan and target victims. Second, it can develop code and even create entire coding projects for those with little knowledge of software development. While ChatGPT has restrictions and safeguards to avoid abuse, they're fairly easily bypassed. Third, ChatGPT produces convincing and accurate text that can be used in phishing or spearphishing. To some extent, these three areas represent theoretical risks or outlier scenarios that don't represent how people and businesses usually use ChatGPT. Policy perspective beyond risks Policy should aim to be technology-blind – taking a similar approach to all related technology that might emerge in the future, rather than creating a unique approach for one of today's concerns. It should build the best possible defenses against the worst human intentions and applications. Practically speaking, there may be no way to prevent or limit use of tech like ChatGPT. And to limit an emerging technology's potential means being left behind in a global digital economy. While policy discussions usually focus on outputs – the material ChatGPT produces – its inputs (the data it's trained with) may be a bigger threat. Data-driven tools like ChatGPT are only as good or accurate as their training datasets. As chatbot systems may become the most common way to use the internet, issues will have wide impact. Ensuring balance in training data is a growing challenge as disinformation expands. Bad actors can influence what users see and read in ways that have global consequences. Datasets, devices and systems must be secure and accurate. How nations are regulating AI In our public policy work, Kaspersky advocates public-private partnerships. We think partnerships combining global private-sector expertise with policymakers' local needs will be the best defense. It's a middle-ground approach that avoids too much or too little caution. These partnerships in cybersecurity maximize the advantages of emerging technologies like ChatGPT, while safeguarding against risks. United Arab Emirates (UAE) is a role model for inclusive public-private partnerships. They've taken a progressive and collaborative stance on partnerships with international tech firms. Initiatives and forums like the Dubai Chamber of Digital Economy and the UAE Cybersecurity Council aim to safely and securely advance technological growth for short- and long-term benefit. In May 2023, Brazil was considering a Bill to regulate AI. It requires "systems [to] undergo a preliminary assessment carried out by the suppliers themselves, to determine whether they can be classified as being of high or excessive risk," according to OneTrust Data Guidance. It also restricts exploitative AI uses, like subliminal techniques that could cause harmful behavior or target vulnerabilities in older and disabled people. The Center for Strategic and International Studies says Japan looked at the European Union's sterner approach to AI regulation and had "concern that the burden of compliance and the ambiguity of regulatory contents may stifle innovation." Instead, Japan is adopting a "human-centered" approach based on seven principles – among them, privacy protection, security and innovation. They regulate AI through several laws. The Digital Platform Transparency Act, for example, requires fair and transparent practice from large online stores and digital advertising businesses, including disclosing how they decide search rankings. Values are the key to balanced regulation ChatGPT and other generative AI fit a model of technological development we've seen throughout history – it disrupts human lives and businesses with exciting potential but also serious risks that need policymakers' attention. UAE, Brazil and Japan have regulatory approaches that are values-led and aim for a middle ground: A balance between too much and too little caution. Alongside, partnerships between the public and private sector hold promise to let business embrace innovation while adequately managing risk.
digital trust

Customers’ trust in tech is changing. What should business do?

  • min read
    • Of course, businesses need customer trust, but understanding what trust means in a digital world is becoming more important. Digital trust is users' confidence that tech, people and processes they engage with are secure and private. Recent research suggests how customers decide where to place their digital trust is changing, so some businesses are changing their approach. As Minter Dial wrote before in Secure Futures, the 2022 Edelman Trust Barometer report shows eroding trust in institutions while remarkably, our trust in business remains. Now, there's an opportunity for business to use integrity, empathy, and privacy and ethics around new tech like artificial intelligence (AI) and customer relationships management (CRM,) to lead the way. Kaspersky's new podcast, Insight Story, unpacks emerging tech trends with global specialists and businesses successfully using new tech. In Episode 4, I discuss what digital trust means and how organizations can grow it with Müge Fazlioglu (US,) Principal Researcher, International Association of Privacy Professionals (IAPP), Malek Ben Salem (US,) emerging tech security expert and Fabio Assolini, Head of Research in Latin America for Kaspersky's Global Research and Analysis Team. Unpacking digital trust Digital trust covers much ground, Malek Ben Salem says. "It's about data integrity, technology, people and processes. It's our confidence that our privacy is protected and secured, the reliability of digital transactions and how sure we are of the identities of those we engage with. It's also about how much we trust the information we get as users." Müge Fazlioglu says trust is notoriously hard to pin down. "Our trust when we may or may not share data depends on many things, like our perception of the party we're sharing with, our data's value to them and us. We also weigh the data's sensitivity – what might happen if it were revealed." Trust can make or break a purchase IAPP's March 2023 Privacy and Consumer Trust Report shows privacy concerns influence consumer purchasing decisions. Müge says, "Many people take steps to protect their privacy, like deleting an app or withholding some personal information." So paying more attention to trust could pay dividends. "Organizations gain credibility by taking steps to enhance privacy and data protection. We're now seeing some big brands featuring privacy-related messaging in their advertising and marketing of web browsers and smart home devices," recounts Müge. Trust concerns also make brands hit the headlines for the wrong reasons. Amazon's recent purchase of robot vacuum cleaner brand iRobot triggered privacy objections from consumer and civil rights groups, then an EU investigation. How companies help (and harm) trust Tech research consultancy McKinsey's 2022 Digital Trust report said while 70 percent of people trust companies to protect their privacy, most companies aren't living up to the expectation. So what should companies do? Müge says much best practice is around transparency. "Few consumers have a good grasp of how companies use their information – what they collect, and if they follow good practice. So companies need to ensure they write a simple, clear privacy policy and have an easy-to-use page for people to manage their privacy settings." Regulators also think easy-to-adjust privacy settings matter. The US Federal Trade Commission (FTC) recently fined the company that makes the game Fortnite for its hard-to-use privacy settings. Müge thinks regulators, businesses and consumers can all play a role in improving communication around privacy. "How a company communicates its data practices affects trust – the duty should not be on customers to make daily decisions based on lengthy and complicated legal agreements. Regulators have an important role in raising awareness and providing education. Some, like the FTC and European Union data protection authorities, are starting to do that." Müge also recommends being prepared for how you'll handle a data leak. "Responding slowly means more consumer loyalty lost. Have an incident response plan for the inevitable." Data leaks are common but often have a big impact on business. Kaspersky's 2022 IT Security Economics report found that among 3,230 businesses surveyed, data leaks were the most commonly encountered security issue, with 55 percent considering them the most challenging incidents. Malek points to one business leading in digital trust. "Apple stands out in how it uses privacy-preserving technology to train artificial intelligence (AI) on mobile phones. Devices keep data locally and use it to train user speech-recognition and auto-complete models. Then the models are used to update a central model that can be applied to many users. So the data is not shared or uploaded, but still used to improve the AI." Using cybersecurity to build trust 29 percent of businesses with 500 to 999 employees have experienced a cybersecurity incident, according to Kaspersky's 2022 Small-to-Medium Business Cyber Resilience report.  As your business scales into a larger enterprise, so does the likelihood of a cyberattack or data leak. Malek thinks investing in cybersecurity is vital to protect customer trust. "To build secure infrastructure and allow for secure transactions, you need a cybersecurity strategy and proper governance, and you must hire the right talent. More importantly, be transparent." Or, as Müge says, "Shine a bright light on what you're doing." New technologies are evolving cybersecurity's contribution to digital trust. Malek sees many applications of AI in security tech: "It helps identify who is accessing a system by profiling user behavior. It can detect and respond to security incidents. It can classify unstructured data like business documents, so we don't need people to read them to know what's sensitive or confidential." A relatively new approach to security, zero trust, is influencing what we'll see next. "People will own their full identity and use pieces as needed. For instance, if I want to buy something that requires proof of age, I can share just my age without information the seller doesn't need, like full birth date. Zero-trust principles mean allowing access only to the information needed." But Kaspersky's Fabio Assolini says businesses may not be able to adopt these good practices overnight. "Many networks need adapting for zero-trust principles. It's a challenge for administrators, but it's important they understand how it works and prepare corporate networks for it." He also highlights the value of transparency, not just between businesses and customers, but between businesses and suppliers. "You must be able to trust your cybersecurity providers, especially as we're seeing many targeted attacks that abuse cybersecurity software or infrastructure. Security vendors could be more transparent about their technologies. At Kaspersky, we let customers review our code at transparency centers. We'd like to see other companies doing that." He adds, "Training is also important. Sometimes cybercriminals send a phishing attack to just one employee, so it matters that each employee is trained in identifying attack attempts." Asked for one key recommendation for business in building digital trust, Malek says, consider cybersecurity part of your environmental, social and governance (ESG) framework because "it elevates the discussion." Müge says, "Keep in mind all the smart technology you use. It uses many different kinds of information. Use the privacy features and regularly monitor data sharing." Listen to the full Insight Story audio series on Podbean or your usual podcast provider.
unexpected data collection, GDPR, regulations

The one data privacy principle no one talks about

  • min read
    • Let's say there's a short form on your organization's website visitors use to sign up to receive company news. They're asked to give their name and email address. One day, you hear colleagues in marketing are going to add something to the regular company news email those sign-ups receive: Promotions of partner companies' products. Are your data protection alarm bells ringing? They should be, but if they're not, you're not alone. Purpose limitation is a data security principle many are unfamiliar with. Understanding it will help you reduce data security and data privacy risks and show your customers you respect their data. What is purpose limitation? Purpose limitation has two parts. First, when you gather anyone's personal information, your organization must be clear about how it will use the information from the start. Second, you must not use the data for another purpose. Much data protection regulation around the world includes some kind of purpose limitation requirements, notably the EU's General Data Protection Regulation (GDPR.) Under GDPR, organizations must document the data's purposes and specify the purposes in the privacy information they supply. But why does purpose limitation matter? Surely if someone chooses to give their data, your organization can use it without limit as long as you keep it private? Not so fast. This is one tin of spaghetti that fast turns into a can of worms. The young woman, the chaplain and the hospital Some privacy trainers tell a story about a young woman who was asked to fill in a form when she was admitted to hospital. One question on the form is asking for her religion. Perhaps this information is important in medical care and she's been asked this question on forms before, so she dutifully fills in her religion as she always has. Why the question? This hospital uses the information to tell the hospital chaplain there's a patient who may appreciate a visit, but they don't tell the patient this. Small world – the hospital chaplain is a friend of the young woman's family. She is unmarried and is in hospital for a pregnancy-related issue. Her family doesn't know she's pregnant and she has no intention of telling them. Now, the young woman and the chaplain are in an awkward position. Apart from infringement of data use regulation, some might say the woman had free choice over whether to give the information, so the results are her responsibility. On the other hand, the trust patients place in hospitals is crucial to the hospital being able to achieve its purpose: To help patients get well. Can organizations live up to the trust customers need to place in them? Data recycling happens all too often Several incidents around customers surprised how companies used or sold their data, given why they provided it, have hit headlines recently. Take for example, the period-tracker app that fed customer data to Facebook, where it was used to market products for expectant Moms. One user found herself suddenly marketed to as though she were pregnant, when she'd only forgotten to use the app to log her period. It's easy to imagine how this kind of sensitive information re-use could emotionally harm some customers. In 2017 Uber settled a complaint from the Federal Trade Commission out of court. Part of the complaint included that some employees had used the software's 'God View' function to track the movements of politicians, celebrities and even ex-partners. Although Uber hadn't sanctioned these misuses, it had no effective processes to prevent it. Do companies, and their employees, understand their responsibilities in limiting how they use customer data? Can you recycle personal data? What the law says GDPR is up front on purpose limitation being a core principle of data protection. Article 5 section 1b outlines how personal data must only be collected when its use is specified and explicit. The data cannot be further used in ways that don't match the original purpose. There's exceptions for historic, scientific and statistical uses, and "if the legitimate interests of that controller or a third party override the interests of the data subject." The European Commission gives guidance to help organizations know if what they're planning to do with data is consistent or inconsistent with its purpose. They suggest considering for example, whether the data is sensitive (including health information, political beliefs and more) and how further use could affect the person who gave the data. While penalties for breaching the purpose limitation principle so far haven't been huge, there's been a steady stream of reputation-damaging prosecutions. Norway's data protection authority fined the Norwegian Public Roads Administration the equivalent of 50,000 US dollars for using 'security' cameras to monitor contractors' work. Breaching the principle with just one customer's data doesn't mean lesser fines – Spanish authorities fined bank Bankia the equivalent of 50,000 US dollars for retaining and reusing one customers' data 16 years after they'd stopped being a customer. When considering fines, regulators punish not for violation of principle, but for the consequences. For example, if companies don't comply with data processing purpose limitation, they may also violate other GDPR requirements, such as having a legitimate reason to process the data. It's not just Europe that has enshrined purpose limitation in data use law. California added a purpose limitation clause to their California Consumer Privacy Act (CCPA) in 2018. The clause says businesses must, before collecting personal information, inform consumers how it will be used and need consumer agreement to use the data for another purpose. What do businesses do to meet purpose limitation obligations? "Every organization processes different kinds of personal data, in different ways, for different purposes," says Kaspersky's Head of Data Protection and Privacy for Europe, Alexey Testsov. "GDPR requires data controllers and processors keep records of what data the organization gathers, why they're gathering it and how long it's kept for. Alongside information auditing and data mapping, these records are vital in complying with purpose limitation responsibilities. "Employees must know how to collect, store and use personal data within the law. Given the high risks of data processing, it's more reliable to discuss changes in processes with a security officer or legal department. Employees should know how to consult internal experts and not be afraid to do so." Here are two examples of identified problems that can lead to failures to control data use purposes. Systems to keep data separate Effective safeguards to prevent any set of data being used for other purposes might have avoided some recent cases of data recycling. In the UK, the Information Commissioners' Office (ICO) fined a political campaigning organization and an insurance company 120,000 UK pounds (around 165,000 US dollars.) The ICO found personal information given for political campaigning had been used to market insurance. It highlighted ineffective data protection systems within the two organizations. "Systems for segregating the personal data of insurance customers' from that of political subscribers' were ineffective." Look for changes in how upgraded software uses data Hunter Nelson, President of Tortoise and Hare Software, says software developers should realize the potential privacy impacts of 'function creep.' He advises, "Controllers and processors must use care when developing systems not to breach privacy law as new features are released. A process checkpoint should be included in the release to review new features with a privacy lens." Regardless of the privacy legislation your organization operates under, knowing the importance of purpose limitation will help you uphold high data privacy standards. Ensure that when you ask customers for personal information, they understand how you will use it. Put in place systems to ensure their data cannot be used for other purposes. These actions will show your respect for customers' privacy and help build the trust that every organization needs.
legal regulatory systems keep up rapid change

Regulation can keep pace with changing tech. Here’s how.

  • min read
    • With rising concerns about consumer privacy, anti-competitive business activity and the spread of misinformation, public and policymakers' scrutiny of the high-tech space is intensifying. Big Tech's influence is still rising. Safety and data privacy laws already struggle to keep up. Who should oversee and police the online giants, and how can we ensure privacy and security standards meet what consumers rightly expect? The blistering clip of technology If you thought the world moved fast before the pandemic, it's now positively frantic. COVID-19 prompted business to leap forward a technological decade in just three months. "From news, images and videos to apps, games and user-generated content, most material we consume is funneled through the largest technology firms," Taylor Tresatti, head of industry research for BIZDEV: The International Association for Business Development, told me. "More of the world's conversations only take place online." Tech firms' disproportionate influence, alongside concerns about their opaque business practices, raises questions about where responsibility lies for overseeing and governing online worlds. Regulatory processes and technological change International law's often outdated rules, lack of alignment between territories and government bodies and ongoing new technology add up to a mess for government and industry leaders. They're also concerned regulation could throttle innovation. Politicians are often quick to play to public fear but slow to understand new technologies' impacts fully. "These systems are often slow to change and adapt, so they're at direct odds with the technology they aim to manage," Tresatti observes. "That's before artificial intelligence (AI) and machine learning start to drive more exponential industry advancement and growth." Other fast-moving advancements regulation must consider include robotics, quantum computing and industrial automation. Political and public concern not always aligned Political leaders can be part of the problem, Bob Ehrlich, head of consumer insights at Techsavvy, told me. "These and other virtual boogeymen are hot topics for voters, but politicians also face the challenge of how to keep up with a growing technological arms race among international powers." He expects this to lead to greater regulation in the high-tech space. Meanwhile, consumer concerns over privacy and data sharing are skyrocketing. Even as companies like Apple and Google adopt new privacy measures, Meta (formerly Facebook) has fought against them. In technologically advanced nations like the US, there's no comprehensive federal law regulating how most companies collect, store or share customer data − data often prone to compromise or breach by more sophisticated, complex threat actors. "The stage is set for a perfect storm," says Ehrlich. "From back-end oversight and management of data to front-end user experiences, many potential points of failure present themselves. We've got to be more thoughtful and make speedier decisions to have any hope of staying on top of this rapidly changing space." Rethinking the future of high-tech regulation To get better at addressing these challenges, I think we must have more informed discussions and make decisions on these topics more often, indeed, routinely. Given their unprecedented scope and influence, we must fundamentally rethink our approach to tackling technology-related issues. Government and IT leaders can use these three approaches. 1.    Adopt new standards for content sharing Instituting new industry, state and international policy standards and guidelines can help govern content sharing and moderation, data privacy and user security. Active cross-collaboration between agencies and governments would improve regional and international consistency. Christchurch Call is an example of how heads of state and the tech sector can work together to create effective new standards and processes. The international strategy for removing extremist content from social media fast was developed in the wake of a terrorist attack live-streamed on Facebook in 2019. 2.    Form partnerships between public and private sector We must bring together experts from different industries and policymakers to research, discuss and make recommendations on how to regulate emerging technologies and trends. These charter taskforces or committees should be empowered and resourced to report and recommend to lawmakers more rapidly. They should also include younger voices – digital natives – to offer up-to-date insights and perspectives. India has already begun working with Google similarly to help curb the spread of misinformation. 3.    Turn the focus from past to future Lawmakers should challenge themselves to rely less on historical precedents when making decisions. Instead, they could hold future-focused scenario-planning exercises to steer their decision-making around emerging technological use-cases and concerns. Screening processes and regular training would help ensure key decision-makers have contemporary, working tech knowledge. The lawmakers' role should also involve finding and closing the loopholes in legal and regulatory frameworks that unscrupulous actors exploit. Already, the US has convened task forces to help plan for and tackle topics like AI and robotics. Keeping tabs on tomorrow's world More regulatory oversight and governance is obviously coming soon in the IT space, but it needn't hinder industry growth or advancement. Partnerships between technology sector firms, lawmakers and industry bodies can mean opportunities to fast-track innovation while giving customers a more positive high-tech experience. As a futurist who's helped over 1,500 businesses and government agencies adapt to challenges like these, I know ensuring regulation and law keep up with technological change isn't impossible. We must get more government and industry leaders on the same page and promote teamwork and collaboration between the public and private sectors. "When everyone with a stake in the technology ecosystem works in tandem, it creates a more stable playing field and more chances to benefit industry players and everyday consumers," says Ehrlich. "From organization and government leaders' perspectives, finding more harmonious ways to collaborate at every turn is a meaningful upgrade worth pursuing."

Human augmentation: Experts on why business must act now

  • min read
    • Far from science fiction, human augmentation has long been with us, from prosthetic limbs to hearing aids to pacemakers. As augmentation gets more sophisticated, most agree the greater independence it can give many, such as ill or disabled people, is worth celebrating. But what about augmentation that makes 'super humans' or implanted identification or payment tech? What ethical limits and security standards do human augmentation technologies need, and how should business be part of the change? In my role as director of global research and analysis (GReAT) in Europe for Kaspersky, human augmentation is one of the most exciting and challenging topics I delve into. I was proud to take part in the Kaspersky-hosted conversation about the future of human augmentation as part of the Internet Governance Forum (IGF) conference 2021 with leaders who create, secure and regulate human augmentation. Here's what we said about how business can prepare for human augmentation's future. 1.  Realize human augmentation will become mainstream fast Ilya Chekh, CEO of affordable artificial limb makers Motorica, spoke of how plastic surgery began as a way to repair war injuries, but was fast adapted for cosmetic use. This shows demand to 'improve' an undamaged and fully mobile human body is inevitable. I said we must stop thinking of augmentation as niche and see it as an essential part of future human lives. "We have important challenges to solve today, technologically and for society. We need more standardizations, policies and regulations – not to limit, but to shape this new world." 2.  Give space to discuss concerns Marcelo de Araujo, professor of philosophy of law at Federal University of Rio de Janeiro (@profdraraujo,) said debates around COVID-19 vaccination show the prevalence of strong feelings about what could or should go inside our bodies, even for medical reasons. He stressed the importance of giving room to discuss concerns upfront. Kaspersky's research agrees concerns are common. A survey of nearly 14,500 people in 16 countries found most support human augmentation used for the good of humanity, but almost all had concerns about cybersecurity (88 percent) and many worried only the wealthy would have access (69 percent.) Chekh of Motorica says his company already gets approached by people who want to remove a healthy limb and replace it with a prosthetic. "It's a big ethical question. Another example: A client's prosthetic arm was broken in an assault. Is the crime breaking someone's device or arm? The prosthesis is part of their body for our clients – it's not like a smartphone. We should address these ethical questions in the development process." 3.  Prioritize uses that reduce inequality Tristan Vouga, co-founder and mechanics designer for powered exoskeleton creators TWIICE, believes augmentation technologies can vastly improve access for people with disabilities. But, To improve financial access to their powered exoskeletons, TWIICE lets customers hire the technology when they need it. They have also embedded considering of inequality and ethics in their process for choosing ideas to develop. Jorge Quevedo is co-founder of Robotics Lab, which makes robots tailored for sectors like logistics and healthcare. He believes while we should prioritize uses of augmentation that help people, such as medical and mobility, it may be unwise to restrict other uses, because advances for any use will benefit all uses. He says instead, government funding and private sector investment should steer towards inequality-reducing augmentation uses. 4.  Consider security early in the process The first step to better security is not thinking about security when the product is done and ready to ship, but instead, as early as possible in the development process. I said, "When security isn't considered upfront, we see easily avoided mistakes. For example, many IoT devices lack a way to update, so there's no way to correct a problem." I believe businesses must involve the right expertise to understand their security needs, and it needn't be a struggle. "Security is a huge global community – you'll find someone near you." Quevedo of Robotics Lab said with the speed augmentation technology is progressing, we shouldn't wait for the technologies to cause problems before we put security protocols in place. 5.  Get involved to help regulators make better regulation Eva Kaili (@evakaili,) Chair of the European Parliament Committee on the Future of Technology and Science, says good regulation would ensure human augmentation technologies don't harm society while not restricting technological development. Kaspersky research found widespread support for regulation of human augmentation: As high as 77 percent of respondents in the UK. But Professor de Araujo advised countries must work together to regulate fairly. "Perceptions around human augmentation vary between countries and change over time. We see lots of ethical questions revolving around the role of the state. We need international cooperation." Vouga thinks diverse viewpoints make for the best regulation. "I'd love to see more people get involved. As we step into a future radically different from now, artists, policymakers, business – everyone needs to take part." I agreed with Vouga, adding, "It's clear these technologies are essential for our future, but to ensure more including than excluding technologies, all of us together must shape this future."
global regulations

INFOGRAPHIC: How GDPR changed the world, and privacy regulation’s future

  • min read
    • One piece of regulation has never before had such global impact as the EU Global Data Protection Regulation (GDPR.) It's firmly established data privacy in the public mind, giving extensive and unassailable rights and affecting behavior well beyond the EU's borders. GDPR legislation was a pioneer that other regions followed. The California Consumer Privacy Act (CCPA) came into force in 2020. The more expansive California Privacy Rights Act (CPRA) will replace it in 2023. While there is no federal nationwide data protection law in the US, all fifty states have regulated data safeguarding, disposal and breach disclosure. US data privacy is pointing towards giving consumers more rights. Africa and Asia, with few exceptions, have a way to go in privacy regulation. It may be fair to say data protection regulation follows economic and political development. But China has a different focus. Having enacted strong privacy regulation, it's regaining control of local Big Tech, starting with corporate dismemberment of Alibaba. It aims to control the massive amounts of data held by Chinese companies that may list overseas. New consumer expectations of data privacy GDPR and other regulations worldwide have raised awareness of privacy issues. There's a gap between what customers want and what businesses think customers want in their digital experience. Businesses think it's profiles (for example, offering relevant suggestions,) live help and price-matching. But consumers prioritize rewards, free shipping and data protection. Forced innovation is also good innovation Data protection is now front of mind for everyone. Many once saw security regulations as an innovation inhibitor adding friction to the customer experience, but now they're customer experience's new best friend. With today's cybercrime landscape, data protection has never had so much focus, driving the need for strong authentication. 3-D Secure is a great example. Ecommerce businesses saw the first version of 3-D Secure as an important tool for tackling fraud, but also the main culprit for customers not completing checkout. But the same businesses are finding the latest version, which includes new security features like biometrics, highly attractive for easier authentication across the whole customer experience. 3-D Secure's latest iteration links with new EU regulation's authentication requirements. Privacy expectations impact on cybercrime The COVID-19 pandemic has sped up changes in digital consumer behavior like never before. Security and fraud risk increased, triggering more stringent regulation. Ransomware gangs try to extort money from victims by encrypting their data, but also releasing it if the ransom isn't paid, adding data privacy insult to injury. Nations are stepping up to address ransomware, now the world's biggest cyberthreat. But it's early days. Attempts to reduce ransomware risk are sometimes surprising with little consensus on how to address it, like US proposals to make ransomware payments tax-deductible or, conversely, making paying a ransom illegal. Once a profitable niche, cyber insurance now struggles to stay afloat with increasing ransomware and skyrocketing demands. Emerging trends in data regulation and oversight Data protection and privacy regulations are now part of life. We also see several emerging trends. For example, increased data protection and privacy oversight; in the three years since GDPR, nearly half of UK businesses have been reported to the Information Commissioner's Office over breaches. With longstanding data breach disclosure laws in the US, a new bill could force businesses to report breaches faster. India has long deliberated its Personal Data Protection Bill (PDP.) We're also seeing financial and security regulations aligning. Financial services regulations now include extensive obligations overlapping with security. Penalties are no longer the sole domain of national data protection authorities but could come from any regulator. UK's Financial Conduct Authority fined Tesco Bank 16.4 million pounds sterling for failing to protect customers' accounts and not doing enough to prevent financial crime. And we see increased desire to control Big Tech. The most notable example started in China with Alibaba in 2019. New Chinese data protection regulation has more scope for oversight, as we saw with the crackdown on ride-hailing service Didi and others. China perhaps sees its companies listed overseas as a national security risk because foreign governments could scrutinize the massive amounts of data they hold. But there are other risks: Several shareholders sued Didi since their share price fell after regulatory crackdown. It's not just China wanting to rein in Big Tech and their data – security concerns led to Germany's data protection commissioner telling government organizations to shut down their Facebook pages. UK's draft Online Safety Bill proposes a new Big Tech oversight body to help tackle illegal and harmful online content. Another trend is increasing regulatory oversight of start-ups, especially in fintech. Stock trading app Robinhood must pay 30 million US dollars to the New York State regulatory body for cybersecurity and anti-money laundering failures. The Swedish financial regulator is investigating buy-now-pay-later firm Klarna for data privacy breaches. Coming soon: The data regulation to prepare for Data regulation laws are often challenged. In Europe in 2020, the Schrems II judgment invalidated Privacy Shield, the data-sharing mechanism between the EU and the US. Austrian activist Max Schrems scored a major win as his case questioning Facebook's legal basis to collect data was referred to the EU Court of Justice. Trump's US attempt to ban TikTok and WeChat shows this isn't confined to the EU. India's Reserve Bank banned Mastercard from issuing new credit and debit cards for not keeping to local data storage rules. Three years since GDPR came into force, regulators aren't standing still. In April 2021, the EU Commission published a draft proposal to regulate artificial intelligence in line with GDPR. With increased automation globally, this is one area to watch.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries