To read the latest update (August 2021) to The Periodic Table of Data Privacy, click here. 

The Data Privacy Periodic Table continues to be well-received and widely shared and commented upon. Since our last update in January, data privacy has barely left the news.

Proposed fines have been awarded to some of the biggest brands, including British Airways (£183.4m) and Marriott Hotels (£99m – announced 24 hours after British Airways), AI and automation commentators continue to debate how to progress within the boundaries of Privacy by Design, and there have been constant updates to new local and national draft laws.

The British Airways fine in particular is interesting as it represents only 1.5% of BA’s turnover, far behind the maximum 4% that the GDPR permits. To the casual observer it therefore seems a light penalty, but in fact it is probably a carefully chosen figure – more than enough to provoke shock and awe across the industry and media, but not so high as to be easily challenged. It’s also a far cry from the £500,000 that the ICO’s powers used to permit, continuing the trend of Supervisory Authorities being willing and perhaps eager to use their powers to punish the most grievous and negligent offences.

And so to this update of the Data Privacy Periodic Table. While data privacy has largely been kept at the forefront of our minds by brash headline-grabbing fine announcements, the changes on this occasion are conversely driven more by the subtleties of the laws themselves.

The updates
Changing “Controller” and “Processor” to “Owner” and “Executor”

When we first launched this project in September 2018, we were determined to make sure it reflected the wider privacy world and was not just a Periodic Table of the GDPR. This is harder than it sounds, despite the principles of the GDPR appearing to be reflected in almost all national privacy laws drafted since.

As new laws have been drafted since, it has become clear that the terminology of “Controller” and “Processor” (elements #40 and #41) has become too specific, though not unique, to the GDPR. The roles and demarcation are very common, but the names are not consistent.

For instance, the draft Indian privacy bill describes a role that is ostensibly the same as that of a GDPR Controller, and names it “data fiduciary”. Hong Kong uses the term “user” (which has created enormous confusion in client engagements when discussing collecting the data of website visitors or SaaS platform customers!), and the CCPA refers to “service providers”.

We therefore felt that “Controller” was becoming too GDPR-centric and have changed it instead to “Owner”.

For some, this will be appear to be unwise wording. After all, the central ethos of data privacy is that the data subject is the ultimate owner of their personal information, and not a brand who simply holds a record of it. However, we wanted to use a term that conveys an obligation to oversee the treatment and physical safety of the data – in other words, they are not the owner of the data (that will always be the data subject), but the owner of the responsibility.

Meanwhile, for the same reasons of GDPR-centricity, we have changed “Processor” to “Executor”.

We considered “Agent” but it risked being too easily confused with “Controller” / “Owner” who is often said to have “agency over data”. Plus it suggests being in the direct and total control of the Controller, which is not accurate.

We considered “Proxy”, but we felt it implied too much control over the decision-making.

And we considered “Intermediary”, but it didn’t feel quite representative of all types of data exchanges between the two parties.

“Executor” meanwhile is a sufficiently recognised legal term to be understood, while striking the right balance between performing a role that is instructed at a high level, but that also allows suggests enough freedom in the performance of the role to bear some responsibility.

Data Protection Impact Assessments vs Privacy Impact Assessments
A big conversation currently is the difference between a Data Privacy Impact Assessment and just a Privacy Impact Assessment. GDPR requires DPIAs, while the industry has always been accustomed to PIAs, and has mistakenly conflated the two.

So, what’s the difference?

We could spend thousands of words on this, but in brief terms, a PIA is a process that privacy teams use to assess how changes to the business affect the overall privacy strategy, impact Privacy by Design, and whether they create new risks.

Meanwhile a DPIA is more targeted, both at an individual process, and on the impact on the data subject. The two processes certainly overlap, but they also have different aims. They should both be performed, in tandem, with any change to the business – but by no means should one replace the other. Accordingly, we have split them out in the table, as elements #27 and #28.

To make room, we combined “Suppliers” and Partners” in the bottom half of the Central Components of Data Privacy section, where various types of data subject are listed, to create a new element, “Third Parties”.

“Data Protection Officer” now “Privacy Officer”
Just as with Controller and Processor above, we feel that the GDPR-centric title of Data Protection Officer “DPO” hasn’t become universal, or even as commonly used as anticipated.

Russia does use the term, as does the Indian privacy bill, but Brazil’s draft for example simply refers to “Privacy Officers” whose roles are arguably more akin to CISOs, especially given there’s no requirement to avoid conflicts of interest. The CCPA has no requirement for the role at all, although commentators are widely recommending that having one would be best practice regardless.

In essence, there is too much variety in nomenclature, and even in the exact requirements or necessity of the role itself, for us to continue to use DPO as it is commonly understood. We have therefore switched it to “Privacy Officer” (element #39), intending it to refer simply to an internal supervisory role where the rights (ethical as well as legal) are represented within the business. Whether an organisation is compelled to appoint one or not, it is surely prudent to have such oversight in place.

Replacing ICANN with US States
The ICANN saga (element #114 in the Future Developments section) appears to have reached something approximating a conclusion – for now at least. As of May, the WHOIS directory has been redacted and access is now controlled. And while conversations continue over whether this affects anti-terrorism efforts and the like, and a long term solution is still being sought, there is unlikely to be major change for some time.

We are replacing this with an area of far greater disorder and confusion – the various privacy laws of the US’ individual states. Three states – Nevada, Maine and California – have passed their local laws (though see our previous update as to why we are still keeping the CCPA in Future Developments rather than Core Legislation), and as many as 11 have bills in progress, and five have been toppled in some way, including Hawaii’s that was vetoed only a few days ago.

As many know, there is talk of whether these states’ bills will create enough pressure for a single federal bill to be introduced, but for now, and perhaps for quite a while yet, we suspect the states will have to continue to handle data subject protection themselves.

(As a side note, did anyone notice our deliberate use of USSs for this element, not be confused with USSS, the United States Secret Service – an ironic potential confusion for this topic!)

As always, let us know of any suggestions, disagreements or recommendations. This is an open and live project that actively seeks input and is regularly updated as things change.

From huge GDPR fines to alleged privacy trends for 2019, our roundup blog covers the top 5 stories about data privacy you may have missed this year so far.

They are not necessarily the articles with the biggest headlines, most surprising stats or even necessarily the most well-known. But taken together, these 5 stories paint the clearest picture of where the privacy world sits right now.

1- Data Privacy – will it be as in vogue as it was in 2018?

This article on TechRadar discusses that while privacy was simultaneously an exciting but also chaotic topic in 2018, this year, will we see a decline in interest or will it remain as high on the agenda?

The answer is most likely, “yes, it will remain on the agenda, but for different reasons”.

The main thrust of the privacy news cycle in 2018 was simple – GDPR’s arrival, the confusion it caused, especially in relation to Brexit, and the domino effect it had globally, as more and more countries adopt their own very similar legislation.

But in 2019, the emphasis shifts. Now we are talking about its enaction and extension.

Big brands are being hit with hefty fines, theoretically being held up as examples to all businesses of the seriousness with which Supervisory Authorities are dealing with transgressions. While this will be true for some, many smaller companies are thinking they can hide under the radar. This is just one of the many misperceptions that we highlight in our Tales from the GDPR Frontline – a collection of anecdotes of the mistakes and oversights that our Privacy team has noticed amongst our clients.

As for its extension, this article also highlights the change in privacy conversation from GDPR to ePrivacy i.e. the storage of data, the use of cookies and electronic communications. In codifying privacy rights and requirements, GDPR has created a foundation on which to build, and it seems the specifics of ePrivacy (see the long-running conversation over the Regulation’s timeline in particular) will be one of the first new building blocks.

2- Tech Tent: Facebook’s Planned Privacy Pivot

In this article and supporting Podcast, Rory Cellan-Jones, technology correspondent for the BBC, notes how times have changed. Gone are the days where people openly share every detail of their lives on social media, and in particular, on Facebook. Instead, consumers are increasingly concerned about where their data is being stored and how it’s being treated.

Facebook, over recent years, has been accused and found guilty of mishandling its customers’ data regularly, and has been late to the game in adapting to the changing mentality of “privacy-first”.

After a number of scandals Facebook’s CEO, Mark Zuckerberg, has announced in a blog post that the company is changing the way it thinks about privacy and how it wants to implement stronger privacy controls, and make Facebook a “privacy-focused platform.” This in the face of its track record:

I understand that many people don’t think Facebook can or would even want to build this kind of privacy-focused platform — because frankly we don’t currently have a strong reputation for building privacy protective services. But we’ve repeatedly shown that we can evolve to build the services that people really want, including in private messaging and stories. 

But this BBC article was not chosen to show how Facebook has changed. The point is wider than that. The world view of privacy and acceptable use of data has changed dramatically, and for some, too quickly. Facebook and Google will not be the only ones to suffer from this. Businesses of all sizes, and even execs and department heads, that have grown accustomed to practices that are not strictly privacy-first will find this new world cumbersome, obstructive and frustrating, making the prudent and balanced introduction of Privacy by Design principles vital to their ongoing success.

3- Google GDPR fine shows ‘embarrassing’ extent of how firms misuse people’s data

Nearly a year on since GDPR came into effect, over 200,000 cases have been reported resulting in €56 million in issued fines. An article on this remarkable statistic is available here, and arguably this should have made the top five stories, but there is one fine that stands out the most.

In January, the most significant GDPR fine to date was issued to the technology giant, Google. CNIL, the French regulator, issued the €50 million (£44 million) fine after receiving and investigating reports on how Google handled people’s data.

They found that Google had “not sufficiently informed” people on how it collected their data and a “lack of transparency, inadequate information and lack of valid consent regarding ads personalisation”. Rather than go into the details here of what the decision teaches the privacy industry and wider business, check out the blog post written by our Director or Data Ethics and Privacy, Sophie Chase-Borthwick.

Moreover, it looks like this is the tip of the iceberg. Ron Moscona, a partner at international law firm Dorsey & Whitney, states “The penalty imposed on Google by the French regulator can be seen as a warning shot at the digital industry at large.”  And, with complaints filed against Amazon, Apple, Netflix and Spotify, we’re sure to expect to see some hefty fines hitting the headlines soon – notwithstanding the point made above: it won’t be just the big brands.

4- Consumer Data Privacy: Why We Need A (Single) Federal Law

Building on the point made in the first article, and the domino effect that GDPR had, this article argues that the United States needs to follow the EU’s footsteps and enforce a national data protection law that all businesses and organizations would need to adhere to.

When GDPR was enforced, it prompted numerous discussions of data privacy regulations across the US, resulting in California being the first state to act. The California Consumer Privacy Act (CCPA) was adopted in June 2018 and is set to become state law on January 1st 2020 (although there are proposals afoot that could impact that).

As it currently stands, this new law enables Californian residents to have the right to know what personal information businesses collect, from where they got the data from and how it will be used. It also makes it easier for consumers to file lawsuits against companies who suffer a data breach, prompting more organizations to start pre-emptively examining their data privacy and security processes.

Privacy is clearly a rising tide, but with more and more legislation likely to come to the fore, adherence for companies whose activities cross national borders, whether by virtue of employees, customer base or suppliers, will become increasingly confusing.  This is what triggered our Data Privacy Periodic Table project – an ongoing and regularly updated collection of the key points, or “elements”, of data privacy.

5- Data privacy doesn’t mean data security – Here’s how to protect your business

This article from Verdict raises one of the most important, but often forgotten, points of data privacy. The relationship between data privacy and infosecurity, and the equal importance of both.

The exact nature of it is constantly debated. Do they overlap? Are they symbiotic? Does one underpin the other? Or is one a sub-discipline of the other? Regardless of the outcome – which may vary from business to business anyway – one thing is clear: they are not the same.

We find that many of our clients, prior to working with us, considered robust infosecurity disciplines and infrastructure synonymous with privacy, or alternatively, they considered the two unrelated.

We take infosecurity’s role in privacy extremely seriously. In fact, our privacy teams comprise as much infosecurity experience as legal expertise. No matter what your personal views on the debate, one thing is certain: when it comes to the protection of data subjects’ data, both fields are equally important. So much so that breaches of any description will always point to failings in both fields.