The Evolving Global Privacy Framework

GDPR Graphic showing EU flag

André Thompson, Privacy and Ethics Counsel at Trūata discusses the growing complications of global privacy frameworks, especially during the current COVID era, and how we need to adapt as businesses.

There are few certainties in 2020 given the global geo-political, social and economic landscape. What in January looked like an already complicated year changed immeasurably as Covid-19 spread around the globe. The global response by nation-states to the pandemic, unprecedented in the modern era, brought the privacy of citizens to the fore yet again as governments sought to use smart devices to track the spread of the virus by collecting and processing data about the user’s movements and behaviour. It is timely to reflect on the impact of the GDPR on the increasing spread and impact of privacy laws globally therefore, as the GDPR reaches its second anniversary with mixed reviews. Although the GDPR has received headlines, it is crucial for organisations to realise that it is not the only law that impacts data-driven businesses. The increased awareness in the public and the media about privacy as a result of Covid-19 contact tracing measures means that the global privacy framework is likely to become even more complicated. Therefore, as the volume of these laws is ever-increasing, it is difficult for businesses to keep on top of compliance requirements from one market to the next.

To put this in context, as of February 2020, 11 US States have privacy Acts or developing Bills in place, with a number of other states having privacy task forces in place. A US federal privacy law has been proposed. It is still some time away, but the momentum is growing. Brazil, South Africa and India’s new data protection laws are passed or are at an advanced stage in the legislative process, joining countries that already have modernised data protection and privacy laws, such as Canada, Russia, Japan, Singapore, South Korea, Malaysia and Nigeria – and many others which are on that journey. Although Covid-19 has delayed the legislative processes, with Brazil, South Africa and India’s laws being postponed, more than 60 counties have now introduced privacy laws in response to their citizens desire for control over their privacy and data protection rights. In increasingly globalised markets and with the ever-increasing adoption of cloud computing and PaaS, IaaS and SaaS services, few large organisations can ignore what we can call the ‘global privacy framework’.

With this evolving global privacy framework, the compliance burden is considerable. Some jurisdictions, such as Russia, have data localisation laws. Others differ in subtle but significant ways from GDPR, the law which most companies seek to align to. Brazil’s LGPD has ten lawful bases of processing, compared to GDPR’s six. South Africa’s POPIA protects the data of natural (i.e. living) persons and juristic persons (i.e. corporations). When companies start to dig into the requirements of these differing laws, they realise the difficulty of a ‘one size fits all’ approach. This poses significant Boardroom-level risk. Forrester are predicting a 300% increase in privacy class actions. With so many different flavours and approaches to data protection, managing and analysing data while maintaining customer trust is becoming increasingly difficult for companies with global footprints.

So how can companies address the ‘compliance overhead’ associated with the global privacy framework? How do they manage, stay on top of and adhere to global regulations? There is one constant regardless of the jurisdiction: privacy laws are based on the protection of ‘personal data’. If the data is not ‘personal’ then privacy laws don’t apply. Therefore, turning to genuine anonymisation of personal data is a way of assisting with compliance and building customer trust, regardless of the jurisdiction, and allows organisations to unlock the value in their data and reduce exposure to global privacy laws. The overarching themes of data privacy regulations are that the rights to use personal data are narrowing and the rights of data subjects are expanding. In this environment the risk of fines, negative brand image and drop in revenue are very real. The question isn’t how to comply with the global privacy framework, but how to avoid it altogether. There is every reason to believe that anonymisation is a tool that will become essential for data-driven organisations in the next few years. It brings to mind the maxim, “fail to plan, plan to fail”: Organisations need to start thinking now how they will comply now in one, two, five or ten years as the impact of current events could change the way we do business using personal data. The compliance burden will only get harder and forward-thinking is essential.


Andre Thompson

Andre Thompson is Privacy and Ethics Counsel at Trūata. Andre is a qualified solicitor admitted in Ireland, England, and Wales. He has over 20 years' experience in a commercial legal environment, working in-house, in private commercial practice, and in private consultancy.

Data-Sharing Done Right: Finding the Best Business Approach

Bart Koek • 20th November 2024

To ensure data is not only available, but also accessible to those that need it, businesses recognise that it is vital to focus on collecting, sorting and governing all the data in their organisation. But what happens when data also needs to be accessed and shared across the business? That is where organisations discover a...

Nova: The Ultimate AI-Powered Martech Solution for Boosting Sales, Marketing...

Erin Lanahan • 19th November 2024

Discover how Nova, the AI-powered engine behind Launched, revolutionises Martech by automating sales and marketing tasks, enhancing personalisation, and delivering unmatched ROI. With advanced intent data integration, revenue attribution, and real-time insights, Nova empowers businesses to scale, streamline operations, and outperform competitors like 6Sense and 11x.ai. Experience the future of Martech with Nova’s transformative AI...

How E-commerce Marketers Can Win Black Friday

Sue Azari • 11th November 2024

As new global eCommerce players expand their influence across both European and US markets, traditional brands are navigating a rapidly shifting landscape. These fast-growing Asian platforms have gained traction by offering ultra-low prices, rapid product turnarounds, heavy investment in paid user acquisition, and leveraging viral social media trends to create demand almost in real-time. This...

Why microgrids are big news

Craig Tropea • 31st October 2024

As the world continues its march towards a greener future, businesses, communities, and individuals alike are all increasingly turning towards renewable energy sources to power their operations. What is most interesting, though, is how many of them are taking the pro-active position of researching, selecting, and implementing their preferred solutions without the assistance of traditional...

Is automation the silver bullet for customer retention?

Carter Busse • 22nd October 2024

CX innovation has accelerated rapidly since 2020, as business and consumer expectations evolved dramatically during the Covid-19 pandemic. Now, finding the best way to engage and respond to customers has become a top business priority and a key business challenge. Not only do customers expect the highest standard, but companies are prioritising superb CX to...

Automated Testing Tools and Their Impact on Software Quality

Natalia Yanchii • 09th October 2024

Test automation refers to using specialized software tools and frameworks to automate the execution of test cases, thereby reducing the time and effort required for manual testing. This approach ensures that automation tests run quickly and consistently, allowing development teams to identify and resolve defects more effectively. Test automation provides greater accuracy by eliminating human...