The world entered a “new age” of data privacy last month when the General Data Protection Regulation (\u201cGDPR\u201d) became law.<\/p>\n
Or did it?<\/p>\n
This question, among others, remains unanswered in the foggy aftermath of GDPR\u2019s long awaited arrival. \u00a0It\u2019s still unclear who the biggest winners are in the new GDPR reality. \u00a0Consumers with personal data? Consumers of personal data? \u00a0Or, the newly empowered European regulators, vowing to protect both?<\/p>\n
We also cannot yet see the specific grounds on which GDPR cases will be filed and if EU courts will succeed in overcoming the jurisdictional “long arm” hurdles required to enforce a 20MM or 4% of global revenue fine against U.S. companies.<\/p>\n
With all this yet to unfold, we invite you to gaze into our GDPR crystal ball.<\/p>\n
Ireland Becomes GDPR\u2019s Ground Zero<\/strong><\/p>\n As our crystal ball swirls, one name emerges from a green mist. \u00a0Helen Dixon.<\/p>\n Privacy law experts are already familiar with Ireland\u2019s chief Data Protection Commissioner.<\/a>\u00a0 She’s the official responsible for overseeing the data processing activities of U.S. tech giants operating overseas. \u00a0Apple, Facebook and Google all maintain offshore offices in Ireland for a variety reasons, including favorable tax status and a well-educated, tech-savvy Irish workforce.<\/p>\n Significant U.S. corporate presence will make the Emerald Isle the Ground Zero of GDPR. \u00a0Studies completed after the recent Irish recession<\/a>\u00a0show U.S. companies continued to invest in Ireland despite tough economic times, benefiting Ireland to the tune of almost $300 billion over the past two decades, and nearly 700 companies with names like Intel, Dell, Pfizer and Hewlett Packard.<\/p>\n Extremely deep coffers aside, the Irish DPA also enjoys a critical strategic advantage: suing companies with well-established physical<\/em> offices inside her country. \u00a0 This will help overcome the inevitable jurisdictional challenges to enforcing significant EU fines against those based across the Atlantic.<\/p>\n Claims of Fake and Forced Consent <\/strong><\/p>\n The early slew of GDPR cases will be based on the doctrines of “fake” or “forced” consent. \u00a0These have been recently articulated by the Austrian activist, Max Schrems, in his most recent cases filed on Day 1 of the GDPR<\/a>.<\/p>\n Schrems, and others, will go after what he calls the\u00a0\u201cNorth Korean\u201d style of internet consent options \u2013 tactics by tech companies that do not offer legitimate choice when it comes to processing personal data. \u00a0Calling out Facebook in this regard, Schrems observes \u201c\u2026in the end users had the choice to delete the account or hit the agree button \u2013 that\u2019s not a free choice.”<\/em><\/p>\n We are now seeing the lexicon upon which future GDPR cases will be built. \u00a0Schrems plans to fight \u201cfictitious\u201d consent, occurring when companies obtain consent for one data purpose, but process it for another<\/a>. \u00a0He is also going after \u201cbundling,\u201d or pushing people to consent as a requirement to a service.<\/p>\n Giants Weather the Storm <\/strong><\/p>\n As court battles wage, the intended targets of GDPR (hint: large U.S. tech companies) may, in fact, weather the storm.<\/p>\n To start, the Apples, Googles and Facebooks of the world have been hyper-focused on GDPR for two years. \u00a0They have already hired armies of legal experts and now C-Level \u201cData Protection Officers\u201d to avoid the penalties and political blow back of potential breaches.<\/p>\n More importantly, the largest tech giants operate closest to the end user. They are best positioned to establish the “lawful basis” required under GDPR for data processing: consent. \u00a0 They do this by\u00a0building out, or integrating with, consent-management-platforms (called \u201cCMPs\u201d) that procure user consent to processing. \u00a0There are also more advanced machine learning (or “MI”) systems that analyze log files and unstructured data sets to rapidly locate and delete personal information.<\/p>\n The irony of GDPR is shaping up to be that its end result is the strengthening of its intended targets. \u00a0Unintended targets, like SMEs, or those that require integration with larger players but cannot meet GDPR\u2019s high standards, will suffer or face “market exit.”<\/p>\n The United States Follows Suit <\/strong><\/p>\n Back in the U.S, we see more tech CEOs being hauled before Congress. \u00a0We also see U.S. Federal and State regulators learning more about the hazards of unregulated data collection and processing. In the aftermath of Cambridge Analytica, the U.S. follows the EU’s lead in enacting new legislation to protect consumers.<\/p>\n We are already seeing movement like this in states like California, which recently announced the California Consumer Privacy Act<\/a> ballot initiative. \u00a0If enacted, this new law would bring far reaching changes. \u00a0It would drastically increase liability for any company collecting data from Californians, require an explicit opt-out label (\u201cdo not sell my personal information\u201d) and prohibit businesses from offering different prices or services to those who opt-out.<\/p>\n The Lawyers Always Win! <\/strong><\/p>\n Before we put away our GDPR crystal ball, and return to the present, we ask one last question. Who are the ultimate winners and losers of GDPR?<\/p>\n To quote a favorite CFO friend of mine, “the lawyers always win.\u201d<\/p>\n Ian Connett, Esq. (@QuantumJurist<\/a>) is the Founder of\u00a0QuantumJurist, Inc.<\/a>,\u00a0a LegalTech consulting and technology venture dedicated to improving and creating efficiencies in the legal services industry.\u00a0 Ian is also a Contributing Editor to the\u00a0EvolveTheLaw.com Legal Innovation Center<\/a>\u00a0and Host of the\u00a0EvolveLaw Podcast<\/a>.\u00a0 \u00a0Ian resides in New York, where he has served as an in-house counsel to numerous technology companies.\u00a0 You can connect with Ian on\u00a0Twitter<\/a>\u00a0and\u00a0LinkedIn<\/a>\u00a0and you can reach him by email at ian@quantumjurist.com (for story ideas, personal correspondence, media inquires or speaking engagements).\u00a0\u00a0<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":" The world entered a “new age” of data privacy last month when GDPR became law. Or did it?<\/p>\n","protected":false},"author":71800,"featured_media":3127,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[3198,2376,655,11],"tags":[72],"class_list":["post-3572","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-gdpr","category-litigation","category-privacy","category-technology","tag-gdpr"],"acf":[],"yoast_head":"\n