Kudos to the European Union (EU) for taking on personal data protection standards. However, defining just what “personal data” is and to whom it relates, brings up a maelstrom of issues needing definition. As one can imagine, most individuals have their own interpretation unique to their own values. Trying to apply those values to the EU is stirring a big pot of controversy, perhaps raising more questions than providing answers. And for the GDPR, it also affects those not necessarily doing business strictly within the boundaries of the EU either.
The General Data Protection Regulation (GDPR) came into effect in the EU on May 25 of this year. In preparation, every business and organization of any kind in the EU had to look inward and consider the type of information they collect on individuals. The key guideline for the GDPR involves the ability to identify an individual, either directly or indirectly through the information gathered. The GDPR defines it as “data which can be used to identify a living person.” That’s a very broad definition considering some information collected is more critical than others. Personal data runs the gamut from IP address and account numbers to what type of car one drives. If the way in which that data is collected and stored violates GDPR guidelines, sanctions and financial penalties are levied.
Yet another component of the GDPR is who exactly does it protect? According to definition, it protects any citizen of the EU, regardless of where in the world that individual is located. Any business gathering personal information on an EU citizen for transactions that occur within the EU are subject to these regulations.
The closest the U.S. has to offer its citizens along GDPR guidelines is HIPAA, protecting personal information gathered through the healthcare industry. However, data protection in the U.S. begins and ends with healthcare data. There are currently no other guidelines that U.S. companies must follow regarding personal data of its customers. GDPR compliance in the U.S. and other countries not in the EU is a regulation that has yet to be enforced.
The GDPR may be a giant step in protecting personal data of EU citizens, but other non-EU countries have yet to follow suit. For the U.S., applying HIPAA-like standards to businesses outside of healthcare may be the next step toward cyberdata security. The EU has clearly taken on a huge standard for individual electronic data collection the rest of the world can learn from.
Looking forward, whether non-EU countries decide to prioritize and standardize data collection of its citizens is a massive task yet to be considered by the U.S. Perhaps “wait and see” how GDPR regulations work down the road, including the problems it may yet have to face, is an approach worth taking for now. However, the GDPR is a concept the U.S. can’t afford to ignore any longer. It’s clear U.S. citizens need electronic data protection – taking a page from the GDPR playbook may be the best strategy for now.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
