Magazine menu Close Magazine menu

regulation

Latest stories

legal regulatory systems keep up rapid change

Regulation can keep pace with changing tech. Here’s how.

  • min read
    • With rising concerns about consumer privacy, anti-competitive business activity and the spread of misinformation, public and policymakers' scrutiny of the high-tech space is intensifying. Big Tech's influence is still rising. Safety and data privacy laws already struggle to keep up. Who should oversee and police the online giants, and how can we ensure privacy and security standards meet what consumers rightly expect? The blistering clip of technology If you thought the world moved fast before the pandemic, it's now positively frantic. COVID-19 prompted business to leap forward a technological decade in just three months. "From news, images and videos to apps, games and user-generated content, most material we consume is funneled through the largest technology firms," Taylor Tresatti, head of industry research for BIZDEV: The International Association for Business Development, told me. "More of the world's conversations only take place online." Tech firms' disproportionate influence, alongside concerns about their opaque business practices, raises questions about where responsibility lies for overseeing and governing online worlds. Regulatory processes and technological change International law's often outdated rules, lack of alignment between territories and government bodies and ongoing new technology add up to a mess for government and industry leaders. They're also concerned regulation could throttle innovation. Politicians are often quick to play to public fear but slow to understand new technologies' impacts fully. "These systems are often slow to change and adapt, so they're at direct odds with the technology they aim to manage," Tresatti observes. "That's before artificial intelligence (AI) and machine learning start to drive more exponential industry advancement and growth." Other fast-moving advancements regulation must consider include robotics, quantum computing and industrial automation. Political and public concern not always aligned Political leaders can be part of the problem, Bob Ehrlich, head of consumer insights at Techsavvy, told me. "These and other virtual boogeymen are hot topics for voters, but politicians also face the challenge of how to keep up with a growing technological arms race among international powers." He expects this to lead to greater regulation in the high-tech space. Meanwhile, consumer concerns over privacy and data sharing are skyrocketing. Even as companies like Apple and Google adopt new privacy measures, Meta (formerly Facebook) has fought against them. In technologically advanced nations like the US, there's no comprehensive federal law regulating how most companies collect, store or share customer data − data often prone to compromise or breach by more sophisticated, complex threat actors. "The stage is set for a perfect storm," says Ehrlich. "From back-end oversight and management of data to front-end user experiences, many potential points of failure present themselves. We've got to be more thoughtful and make speedier decisions to have any hope of staying on top of this rapidly changing space." Rethinking the future of high-tech regulation To get better at addressing these challenges, I think we must have more informed discussions and make decisions on these topics more often, indeed, routinely. Given their unprecedented scope and influence, we must fundamentally rethink our approach to tackling technology-related issues. Government and IT leaders can use these three approaches. 1.    Adopt new standards for content sharing Instituting new industry, state and international policy standards and guidelines can help govern content sharing and moderation, data privacy and user security. Active cross-collaboration between agencies and governments would improve regional and international consistency. Christchurch Call is an example of how heads of state and the tech sector can work together to create effective new standards and processes. The international strategy for removing extremist content from social media fast was developed in the wake of a terrorist attack live-streamed on Facebook in 2019. 2.    Form partnerships between public and private sector We must bring together experts from different industries and policymakers to research, discuss and make recommendations on how to regulate emerging technologies and trends. These charter taskforces or committees should be empowered and resourced to report and recommend to lawmakers more rapidly. They should also include younger voices – digital natives – to offer up-to-date insights and perspectives. India has already begun working with Google similarly to help curb the spread of misinformation. 3.    Turn the focus from past to future Lawmakers should challenge themselves to rely less on historical precedents when making decisions. Instead, they could hold future-focused scenario-planning exercises to steer their decision-making around emerging technological use-cases and concerns. Screening processes and regular training would help ensure key decision-makers have contemporary, working tech knowledge. The lawmakers' role should also involve finding and closing the loopholes in legal and regulatory frameworks that unscrupulous actors exploit. Already, the US has convened task forces to help plan for and tackle topics like AI and robotics. Keeping tabs on tomorrow's world More regulatory oversight and governance is obviously coming soon in the IT space, but it needn't hinder industry growth or advancement. Partnerships between technology sector firms, lawmakers and industry bodies can mean opportunities to fast-track innovation while giving customers a more positive high-tech experience. As a futurist who's helped over 1,500 businesses and government agencies adapt to challenges like these, I know ensuring regulation and law keep up with technological change isn't impossible. We must get more government and industry leaders on the same page and promote teamwork and collaboration between the public and private sectors. "When everyone with a stake in the technology ecosystem works in tandem, it creates a more stable playing field and more chances to benefit industry players and everyday consumers," says Ehrlich. "From organization and government leaders' perspectives, finding more harmonious ways to collaborate at every turn is a meaningful upgrade worth pursuing."

Human augmentation: Experts on why business must act now

  • min read
    • Far from science fiction, human augmentation has long been with us, from prosthetic limbs to hearing aids to pacemakers. As augmentation gets more sophisticated, most agree the greater independence it can give many, such as ill or disabled people, is worth celebrating. But what about augmentation that makes 'super humans' or implanted identification or payment tech? What ethical limits and security standards do human augmentation technologies need, and how should business be part of the change? In my role as director of global research and analysis (GReAT) in Europe for Kaspersky, human augmentation is one of the most exciting and challenging topics I delve into. I was proud to take part in the Kaspersky-hosted conversation about the future of human augmentation as part of the Internet Governance Forum (IGF) conference 2021 with leaders who create, secure and regulate human augmentation. Here's what we said about how business can prepare for human augmentation's future. 1.  Realize human augmentation will become mainstream fast Ilya Chekh, CEO of affordable artificial limb makers Motorica, spoke of how plastic surgery began as a way to repair war injuries, but was fast adapted for cosmetic use. This shows demand to 'improve' an undamaged and fully mobile human body is inevitable. I said we must stop thinking of augmentation as niche and see it as an essential part of future human lives. "We have important challenges to solve today, technologically and for society. We need more standardizations, policies and regulations – not to limit, but to shape this new world." 2.  Give space to discuss concerns Marcelo de Araujo, professor of philosophy of law at Federal University of Rio de Janeiro (@profdraraujo,) said debates around COVID-19 vaccination show the prevalence of strong feelings about what could or should go inside our bodies, even for medical reasons. He stressed the importance of giving room to discuss concerns upfront. Kaspersky's research agrees concerns are common. A survey of nearly 14,500 people in 16 countries found most support human augmentation used for the good of humanity, but almost all had concerns about cybersecurity (88 percent) and many worried only the wealthy would have access (69 percent.) Chekh of Motorica says his company already gets approached by people who want to remove a healthy limb and replace it with a prosthetic. "It's a big ethical question. Another example: A client's prosthetic arm was broken in an assault. Is the crime breaking someone's device or arm? The prosthesis is part of their body for our clients – it's not like a smartphone. We should address these ethical questions in the development process." 3.  Prioritize uses that reduce inequality Tristan Vouga, co-founder and mechanics designer for powered exoskeleton creators TWIICE, believes augmentation technologies can vastly improve access for people with disabilities. But, To improve financial access to their powered exoskeletons, TWIICE lets customers hire the technology when they need it. They have also embedded considering of inequality and ethics in their process for choosing ideas to develop. Jorge Quevedo is co-founder of Robotics Lab, which makes robots tailored for sectors like logistics and healthcare. He believes while we should prioritize uses of augmentation that help people, such as medical and mobility, it may be unwise to restrict other uses, because advances for any use will benefit all uses. He says instead, government funding and private sector investment should steer towards inequality-reducing augmentation uses. 4.  Consider security early in the process The first step to better security is not thinking about security when the product is done and ready to ship, but instead, as early as possible in the development process. I said, "When security isn't considered upfront, we see easily avoided mistakes. For example, many IoT devices lack a way to update, so there's no way to correct a problem." I believe businesses must involve the right expertise to understand their security needs, and it needn't be a struggle. "Security is a huge global community – you'll find someone near you." Quevedo of Robotics Lab said with the speed augmentation technology is progressing, we shouldn't wait for the technologies to cause problems before we put security protocols in place. 5.  Get involved to help regulators make better regulation Eva Kaili (@evakaili,) Chair of the European Parliament Committee on the Future of Technology and Science, says good regulation would ensure human augmentation technologies don't harm society while not restricting technological development. Kaspersky research found widespread support for regulation of human augmentation: As high as 77 percent of respondents in the UK. But Professor de Araujo advised countries must work together to regulate fairly. "Perceptions around human augmentation vary between countries and change over time. We see lots of ethical questions revolving around the role of the state. We need international cooperation." Vouga thinks diverse viewpoints make for the best regulation. "I'd love to see more people get involved. As we step into a future radically different from now, artists, policymakers, business – everyone needs to take part." I agreed with Vouga, adding, "It's clear these technologies are essential for our future, but to ensure more including than excluding technologies, all of us together must shape this future."
global regulations

INFOGRAPHIC: How GDPR changed the world, and privacy regulation’s future

  • min read
    • One piece of regulation has never before had such global impact as the EU Global Data Protection Regulation (GDPR.) It's firmly established data privacy in the public mind, giving extensive and unassailable rights and affecting behavior well beyond the EU's borders. GDPR legislation was a pioneer that other regions followed. The California Consumer Privacy Act (CCPA) came into force in 2020. The more expansive California Privacy Rights Act (CPRA) will replace it in 2023. While there is no federal nationwide data protection law in the US, all fifty states have regulated data safeguarding, disposal and breach disclosure. US data privacy is pointing towards giving consumers more rights. Africa and Asia, with few exceptions, have a way to go in privacy regulation. It may be fair to say data protection regulation follows economic and political development. But China has a different focus. Having enacted strong privacy regulation, it's regaining control of local Big Tech, starting with corporate dismemberment of Alibaba. It aims to control the massive amounts of data held by Chinese companies that may list overseas. New consumer expectations of data privacy GDPR and other regulations worldwide have raised awareness of privacy issues. There's a gap between what customers want and what businesses think customers want in their digital experience. Businesses think it's profiles (for example, offering relevant suggestions,) live help and price-matching. But consumers prioritize rewards, free shipping and data protection. Forced innovation is also good innovation Data protection is now front of mind for everyone. Many once saw security regulations as an innovation inhibitor adding friction to the customer experience, but now they're customer experience's new best friend. With today's cybercrime landscape, data protection has never had so much focus, driving the need for strong authentication. 3-D Secure is a great example. Ecommerce businesses saw the first version of 3-D Secure as an important tool for tackling fraud, but also the main culprit for customers not completing checkout. But the same businesses are finding the latest version, which includes new security features like biometrics, highly attractive for easier authentication across the whole customer experience. 3-D Secure's latest iteration links with new EU regulation's authentication requirements. Privacy expectations impact on cybercrime The COVID-19 pandemic has sped up changes in digital consumer behavior like never before. Security and fraud risk increased, triggering more stringent regulation. Ransomware gangs try to extort money from victims by encrypting their data, but also releasing it if the ransom isn't paid, adding data privacy insult to injury. Nations are stepping up to address ransomware, now the world's biggest cyberthreat. But it's early days. Attempts to reduce ransomware risk are sometimes surprising with little consensus on how to address it, like US proposals to make ransomware payments tax-deductible or, conversely, making paying a ransom illegal. Once a profitable niche, cyber insurance now struggles to stay afloat with increasing ransomware and skyrocketing demands. Emerging trends in data regulation and oversight Data protection and privacy regulations are now part of life. We also see several emerging trends. For example, increased data protection and privacy oversight; in the three years since GDPR, nearly half of UK businesses have been reported to the Information Commissioner's Office over breaches. With longstanding data breach disclosure laws in the US, a new bill could force businesses to report breaches faster. India has long deliberated its Personal Data Protection Bill (PDP.) We're also seeing financial and security regulations aligning. Financial services regulations now include extensive obligations overlapping with security. Penalties are no longer the sole domain of national data protection authorities but could come from any regulator. UK's Financial Conduct Authority fined Tesco Bank 16.4 million pounds sterling for failing to protect customers' accounts and not doing enough to prevent financial crime. And we see increased desire to control Big Tech. The most notable example started in China with Alibaba in 2019. New Chinese data protection regulation has more scope for oversight, as we saw with the crackdown on ride-hailing service Didi and others. China perhaps sees its companies listed overseas as a national security risk because foreign governments could scrutinize the massive amounts of data they hold. But there are other risks: Several shareholders sued Didi since their share price fell after regulatory crackdown. It's not just China wanting to rein in Big Tech and their data – security concerns led to Germany's data protection commissioner telling government organizations to shut down their Facebook pages. UK's draft Online Safety Bill proposes a new Big Tech oversight body to help tackle illegal and harmful online content. Another trend is increasing regulatory oversight of start-ups, especially in fintech. Stock trading app Robinhood must pay 30 million US dollars to the New York State regulatory body for cybersecurity and anti-money laundering failures. The Swedish financial regulator is investigating buy-now-pay-later firm Klarna for data privacy breaches. Coming soon: The data regulation to prepare for Data regulation laws are often challenged. In Europe in 2020, the Schrems II judgment invalidated Privacy Shield, the data-sharing mechanism between the EU and the US. Austrian activist Max Schrems scored a major win as his case questioning Facebook's legal basis to collect data was referred to the EU Court of Justice. Trump's US attempt to ban TikTok and WeChat shows this isn't confined to the EU. India's Reserve Bank banned Mastercard from issuing new credit and debit cards for not keeping to local data storage rules. Three years since GDPR came into force, regulators aren't standing still. In April 2021, the EU Commission published a draft proposal to regulate artificial intelligence in line with GDPR. With increased automation globally, this is one area to watch.
unexpected data collection

The one data privacy principle no one talks about

  • min read
    • Let's say there's a short form on your organization's website visitors use to sign up to receive company news. They're asked to give their name and email address. One day, you hear colleagues in marketing are going to add something to the regular company news email those sign-ups receive: Promotions of partner companies' products. Are your data protection alarm bells ringing? They should be, but if they're not, you're not alone. Purpose limitation is a data security principle many are unfamiliar with. Understanding it will help you reduce data security and data privacy risks and show your customers you respect their data. What is purpose limitation? Purpose limitation has two parts. First, when you gather anyone's personal information, your organization must be clear about how it will use the information from the start. Second, you must not use the data for another purpose. Much data protection regulation around the world includes some kind of purpose limitation requirements, notably the EU's General Data Protection Regulation (GDPR.) Under GDPR, organizations must document the data's purposes and specify the purposes in the privacy information they supply. But why does purpose limitation matter? Surely if someone chooses to give their data, your organization can use it without limit as long as you keep it private? Not so fast. This is one tin of spaghetti that fast turns into a can of worms. The young woman, the chaplain and the hospital Some privacy trainers tell a story about a young woman who was asked to fill in a form when she was admitted to hospital. One question on the form is asking for her religion. Perhaps this information is important in medical care and she's been asked this question on forms before, so she dutifully fills in her religion as she always has. Why the question? This hospital uses the information to tell the hospital chaplain there's a patient who may appreciate a visit, but they don't tell the patient this. Small world – the hospital chaplain is a friend of the young woman's family. She is unmarried and is in hospital for a pregnancy-related issue. Her family doesn't know she's pregnant and she has no intention of telling them. Now, the young woman and the chaplain are in an awkward position. Apart from infringement of data use regulation, some might say the woman had free choice over whether to give the information, so the results are her responsibility. On the other hand, the trust patients place in hospitals is crucial to the hospital being able to achieve its purpose: To help patients get well. Can organizations live up to the trust customers need to place in them? Data recycling happens all too often Several incidents around customers surprised how companies used or sold their data, given why they provided it, have hit headlines recently. Take for example, the period-tracker app that fed customer data to Facebook, where it was used to market products for expectant Moms. One user found herself suddenly marketed to as though she were pregnant, when she'd only forgotten to use the app to log her period. It's easy to imagine how this kind of sensitive information re-use could emotionally harm some customers. In 2017 Uber settled a complaint from the Federal Trade Commission out of court. Part of the complaint included that some employees had used the software's 'God View' function to track the movements of politicians, celebrities and even ex-partners. Although Uber hadn't sanctioned these misuses, it had no effective processes to prevent it. Do companies, and their employees, understand their responsibilities in limiting how they use customer data? Can you recycle personal data? What the law says GDPR is up front on purpose limitation being a core principle of data protection. Article 5 section 1b outlines how personal data must only be collected when its use is specified and explicit. The data cannot be further used in ways that don't match the original purpose. There's exceptions for historic, scientific and statistical uses, and "if the legitimate interests of that controller or a third party override the interests of the data subject." The European Commission gives guidance to help organizations know if what they're planning to do with data is consistent or inconsistent with its purpose. They suggest considering for example, whether the data is sensitive (including health information, political beliefs and more) and how further use could affect the person who gave the data. While penalties for breaching the purpose limitation principle so far haven't been huge, there's been a steady stream of reputation-damaging prosecutions. Norway's data protection authority fined the Norwegian Public Roads Administration the equivalent of 50,000 US dollars for using 'security' cameras to monitor contractors' work. Breaching the principle with just one customer's data doesn't mean lesser fines – Spanish authorities fined bank Bankia the equivalent of 50,000 US dollars for retaining and reusing one customers' data 16 years after they'd stopped being a customer. When considering fines, regulators punish not for violation of principle, but for the consequences. For example, if companies don't comply with data processing purpose limitation, they may also violate other GDPR requirements, such as having a legitimate reason to process the data. It's not just Europe that has enshrined purpose limitation in data use law. California added a purpose limitation clause to their California Consumer Privacy Act (CCPA) in 2018. The clause says businesses must, before collecting personal information, inform consumers how it will be used and need consumer agreement to use the data for another purpose. What do businesses do to meet purpose limitation obligations? "Every organization processes different kinds of personal data, in different ways, for different purposes," says Kaspersky's Head of Data Protection and Privacy for Europe, Alexey Testsov. "GDPR requires data controllers and processors keep records of what data the organization gathers, why they're gathering it and how long it's kept for. Alongside information auditing and data mapping, these records are vital in complying with purpose limitation responsibilities. "Employees must know how to collect, store and use personal data within the law. Given the high risks of data processing, it's more reliable to discuss changes in processes with a security officer or legal department. Employees should know how to consult internal experts and not be afraid to do so." Here are two examples of identified problems that can lead to failures to control data use purposes. Systems to keep data separate Effective safeguards to prevent any set of data being used for other purposes might have avoided some recent cases of data recycling. In the UK, the Information Commissioners' Office (ICO) fined a political campaigning organization and an insurance company 120,000 UK pounds (around 165,000 US dollars.) The ICO found personal information given for political campaigning had been used to market insurance. It highlighted ineffective data protection systems within the two organizations. "Systems for segregating the personal data of insurance customers' from that of political subscribers' were ineffective." Look for changes in how upgraded software uses data Hunter Nelson, President of Tortoise and Hare Software, says software developers should realize the potential privacy impacts of 'function creep.' He advises, "Controllers and processors must use care when developing systems not to breach privacy law as new features are released. A process checkpoint should be included in the release to review new features with a privacy lens." Regardless of the privacy legislation your organization operates under, knowing the importance of purpose limitation will help you uphold high data privacy standards. Ensure that when you ask customers for personal information, they understand how you will use it. Put in place systems to ensure their data cannot be used for other purposes. These actions will show your respect for customers' privacy and help build the trust that every organization needs.
brittany kaiser interview

After Cambridge Analytica, Brittany Kaiser has a solution for personal data privacy

  • min read
    • In 2018 she hit the headlines as the whistle-blower exposing data privacy violations between Cambridge Analytica and Facebook. Trained as a human rights lawyer, Brittany Kaiser since testified at the UK government's fake news inquiry. Kaiser has now established a foundation helping the next generation live a safer digital life to experience the benefits of technology, and has explored her experiences in her book, Targeted, and the Netflix documentary The Great Hack. I spoke with Brittany about how personal data use could shift from harming to saving society, and what business can do. Brittany Kaiser, Co-Founder, Own Your Data Foundation Susi O'Neill: How can legislation best protect our data rights? Brittany Kaiser: There's a dichotomy in the privacy community: Many say data rights should be human rights. But we've had human rights protecting privacy enshrined in law for decades. During my legal training, I was frustrated by how hard it is to uphold human rights law in court. People can't easily get compensation for human rights abuses. Privacy isn't real – suing to protect it under human rights has never worked. A legal framework won't help when data is the world's most valuable asset class. It's a multi-trillion dollar industry – we can't stop it from functioning. Access to data makes organizations more effective. We should legislate so people are protected from bad actors and abuse, but in a way that lets artificial intelligence, data science and the internet of things (IoT) help us solve the world's greatest problems. How can we change the status quo of organizations, rather than people, owning our data? The framework I like to work with is data ownership. Property is the most potent form of law. If someone damages your property, you'll win compensation, even with fractional ownership. If I own 20 percent of Facebook's data about me, I should get 20 percent of the revenue from it. Data ownership as a business model could look a lot like Airbnb. If data is my property like my house, if you want to use it, I say how you can use it, for how long, and we agree a price before I hand over the keys. It should be transparent. Perhaps I give a license for six months or a year. Then I get compensated, either upfront or as a dividend based on use. This solves the world's most significant human rights problem: Extreme poverty. Many supply chains are damaged after the pandemic – the United Nations says 270 million are at risk of starvation. If everyone owns their data, some could earn enough to feed themselves. Zuckerberg (Mark Zuckerberg, Facebook CEO) says everyone's data is only worth 17 US dollars a quarter. I think it's worth far more and that's just Facebook data, but let's work with this figure. Two billion people live on less than 2 US dollars a day, so 17 dollars every three months would make a huge difference. Data could solve poverty. It's a bold and far-reaching idea that personal data could be turned into personal value. How can we improve privacy standards at the same time? Right now, data protection and privacy legislation is an ideal. It's new, and we're in a pandemic where some countries have given exemptions, so laws haven't been fully ratified. We're heading in the right direction to provide more transparency and rights. The goal should be, once people are educated, we have the legislation in place and technologies to secure our data. After that, no one should access it until we give consent. And we consent because we're incentivized. Now we have no incentive, so people shout about privacy. There's no benefit except to open ourselves up to abuse. Business and government have exposed us to this. What if we flip the incentive structure? I could share my data with a diabetes research company, earn money and help cure diabetes. People would opt-in. How would a personal data market work in practice? Personal data is the world's most valuable industry, but we can't see or participate in it, even though our data is in these markets. We should control and decide which data markets to take part in and what to consent to. Like sharing your data with the government so they can help prevent a terrorist attack. Or a pharma researcher, so medicines work better on women and minorities, rather than the 18-year-old white guys that sign up to medical trials for beer money. You could consent to smart cities and IoT (internet of things), so there are fewer traffic accidents. You could use your time to do surveys or watch targeted content for a universal earned income. Most policymakers propose a universal basic income as a handout from the government. The income from your data you've earned from its value – it's not a handout. It could pay for a few groceries, or in some economies, for your apartment. A 'data wallet' could show the data you're producing and opportunities to join different marketplaces or research. You decide which opportunities to participate in. Thousands of companies are building solutions to solve parts of this problem – digital identity management, smart contracts and automated monetization like token rewards or digital money. Soon, we'll see enterprise-level solutions that we can use reliably. After your experience with the Cambridge Analytica scandal, you've talked about data being used as a weapon in democracy. What does this mean? Data weaponization means using data to target people for purposes they didn't consent to. It could be considered violent. Data has been used to target people who break social norms, to incite racial hatred and violence, and by political organizations to suppress voters. We need to solve this problem in a more systemic way. Put pressure on big tech companies who are doing too little, too late. We need to pass regulation that demands they invest. With the money they make, they could invest more in solving this problem. Zuckerberg says he's got thousands of people working on it. Why don't you have hundreds of thousands of people solving it? It's nothing compared to efforts made towards shareholder profits. What role can regulation and cyber standards play in safeguarding our data? I'm doing legal work about the custodian responsibilities and standards expected of those holding our data. If they prioritize fiduciary responsibilities before obligations to shareholders, there will be more ethical practices. Right now, the greatest responsibility is consumer protection, but organizations have little incentive to protect your data. Facebook has already been fined over 5 billion US dollars for failing to protect its customers. But it isn't enough. We need stricter legal protocols. In 2019, Senator Elizabeth Warren put the Corporate Executive Accountability Act bill to the US government. It's proposed that if a company allows a data breach or hack through negligence, its executives are criminally liable. It's a vital step. If Zuckerberg or Sheryl Sandberg (Facebook COO) thought they were going to jail or lose their job, they'd have more incentive to protect people. In both the Cambridge Analytica and Equifax scandals, it's gross negligence. It's nothing to do with cybersecurity protocols. For Equifax, 3,000 security certificates weren't updated, then they got hacked. And their business is holding and sharing personal data. I was an expert witness in the case against them. A lawyer said not installing the update was like leaving the house with the doors open and lights on, then being surprised to get robbed. We need to enforce higher cybersecurity standards if you want to hold personal data. If you've shown good practice and have upheld standards, then no, you shouldn't be held criminally liable as you've done everything you reasonably can. Some hackers are really good, and some vulnerabilities too hard to predict. What can governments and regulators do to help businesses comply? I believe most businesses want to do the right thing. We need to make it easy and affordable for them. That's one of the most important things about California's Proposition 24. They've established the first data protection commission. 50 staff will use their expertise to help companies comply, so it's not a burden. We need more of this worldwide, particularly as many businesses and economies have taken a hit with the pandemic. What advice would you give an employee if they see a potential data breach in their company? Always raise the red flag internally first. Your company may not know they're doing something wrong, or it's a decision by one rogue employee. They could fix it. But if you continually raise flags and suddenly you're being cut out of meetings, getting cold-shouldered, or you get fired, it's time to go public. A whistleblowing lawyer is one path, or you could directly approach a data regulator. Hold the company to account to make sure they comply and can't misuse their power. What's the philosophy of your Own Your Data Foundation? I co-founded the Own Your Data Foundation in 2019 when I realized it would take time to get the right data protection legislation, and the enterprise-level tech isn't yet available. The sustainable way is to empower people to protect themselves. We give digital literacy training for the Digital Intelligence (DQ) curriculum, which this year became an Institute of Electrical and Electronics Engineers (IEEE) global standard. Leading technology universities, government ministries, think tanks and Microsoft developed it. It's supported by UNICEF, the World Economic Forum and OECD. It begins by assessing your digital intelligence and giving you a DQ score – like IQ or EQ – to improve upon. Training topics include your data rights, cybersecurity protocols and media literacy. Tests include spotting fake news and phishing, how to show emotional intelligence online and protecting yourself and others from cyberbullying. We also explore mental and physical health and stop device addiction. After I'd trained to be a human rights lawyer with Amal Clooney, my first paid job was at Amnesty International in London. Over ten years, they implemented a human rights education program through 13 countries' education ministries. For the DQ program, I'm excited as the IEEE standard was only released this year. The Kingdom of Saudi Arabia announced at the G20 Summit they're adopting it and will include it in their national education curriculum by 2022. In ten years, I hope every country is teaching this. What problem does the DQ curriculum help solve? This year we've been thrown into a new digital life unprepared, with far more screen time and more platforms. Many people aren't yet digitally literate. We have to educate fast. That's why we're delivering our courses low-cost, or free in some cases, with virtual classes and resources to make it accessible across the world. DQ is essential. It should be part of everyone's education – whether you're a child, parent or worker. Older people are also vulnerable as some are using this tech for the first time. Our foundation delivers training of trainers, supporting the teachers, to establish good habits early for young people. Many companies' most significant cybersecurity risk is a staff member who doesn't recognize a phishing attempt. At work, HR should deliver professional programs, training new staff to protect themselves and your organization. To find out more about digital intelligence (DQ) training, contact Own Your Data Foundation. Comments represent the opinions of the interviewee.
cryptocurrency regulation

Regulating cryptocurrency needn’t kill the Bitcoin buzz

  • min read
    • There are more cryptocurrency users worldwide than people living in Canada. As of mid-2020, there were 40 million. That's not surprising, given cryptocurrency's many attractions, but projected market growth between 2019 and 2025 – at 50 percent – seems modest. An indication of why might be found in an October 2020 report, in which global financial services giant PwC (formerly known as PricewaterhouseCoopers) implores businesses to look seriously at blockchain while all but dismissing cryptocurrencies. They're bothered by the state of cryptocurrency regulation: Regulation may be one of the main showstoppers in cryptocurrency. While blockchain-based startups and crypto-related companies are in their heyday, it's hard for government agencies to keep up with their speed, and some countries are taking a conservative approach. Let's look at crypto regulation today, the risks and what can be done about them. Cryptocurrency regulation around the world More countries now realize cryptocurrencies are an inevitable part of their financial system. So they're starting to regulate rather than restrict. Europe The European Union is on the progressive side in regulation, but the regulations in Europe also vary among member countries. In 2015 the European Court of Justice ruled cryptocurrency exchanges exempt from value-added tax. When it comes to anti-money laundering and safety, all European countries follow the 2019 Financial Action Task Force standards. These say crypto sites must comply with 'know your customer' and anti-money laundering rules, and share data with the regulator. USA In the US, cryptocurrencies are not integrated into the country's financial structure, mostly thanks to their Securities and Exchange Commission regulation and suspension of crypto trading in 2020. While federal and state governments have engaged with the issue, there's been little formal rulemaking. Regulation is different state to state. For example, Wyoming passed a bill exempting cryptocurrencies from property tax, and New York brought in restrictive rules that saw many crypto-related companies leaving the state. Russia While Russians, in general, are rather crypto-friendly, the Russian government hasn't yet decided what Bitcoin and cryptocurrencies are and seem mostly hostile toward them. In July 2020, Russian authorities accepted a bill, On Digital Financial Assets, expected to be adopted in early 2021. It legitimizes cryptocurrency trading but bans cryptocurrencies as a payment method. India In 2020 the Indian crypto community won a two-year-long battle with the Reserve Bank of India. Cryptocurrency exchanges in India rushed to re-integrate banking solutions supporting the Indian Rupee. A few months later, the government's focus changed. India now plans to introduce a law banning cryptocurrency trading. What are the risks of working with cryptocurrencies? When working with crypto, the biggest risk is the unknown. Many gray zones could be harmful to crypto companies, especially those providing coin and wallet exchanging services or accounts for storing them. Entrepreneurs in crypto have a hard task to ensure customer funds and data are secure, prevent fraud and meet all legal requirements, but it doesn't stop thousands of companies operating in the crypto field. For example, Google Pay enables crypto payments. Aside from extra attention to constantly changing legislation, many risks are covered by know-your-customer procedures and multi-factor authentication. On fraud prevention, risks are like those every fintech company faces. Stolen or hacked cards, wallets and accounts are the most popular tidbit for scammers. In the crypto field, it's especially dangerous because blockchain transactions are irreversible. Crypto exchanges are also obliged to detect transactions that could be high risk, such as forex, gambling and unregulated pharmacies. The crypto field should focus mainly on preventing fraudulent or suspicious operations — such precedents can cost companies operating licenses in the blink of an eye. How could regulation around cryptocurrency help? Business often sees regulation negatively, but it can work. Having a certified, coordinated system, although it may reduce efficiency, is easier than running a business in total uncertainty. Regulation would probably also speed mass adoption of crypto assets by traditional financial institutions, legitimizing cryptocurrencies for many. Although it's a global currency, global regulation is unlikely. Even if there were something that glues all countries together, the currency might not handle it. Today, crypto assets don't even have a clear definition. Their legal status is up for discussion in many countries. It would be simpler for companies and clients to have one comprehensive regulation. The EU's requirements make it relatively easy to operate in its 27 countries. Ironically, enthusiasts believed blockchain would bring global accessibility and decentralization, but one of its main impediments is what they fought against. Crypto businesses can encourage regulation that will bring greater security for users without being overly restrictive. The main safety concern with cryptocurrency is how well users understand it before entering the market. Some platforms in the crypto field give misleading or confusing information, or use gambling, forex business models or scams. These practices cast a shadow over legitimate companies, forcing regulators to implement restrictions for investor safety. It's far from the prevailing wisdom among crypto enthusiasts to promote a "safety first" approach over reduced responsibility for crypto-related companies. But safety doesn't have to mean restrictions. Every reputable company should play their part in creating a safer crypto world.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries