Securiti Launches Industry’s First Solution To Automate Compliance
View
Listen to the content
With the increase in digitalization and its impacts on the globe, a new wave of data privacy laws has emerged. Countries all across the world are increasingly acknowledging the need for the protection of personal information in the digital space and formulating their laws based on the framework set up by the European Union’s General Data Protection Regulation (GDPR).
The GDPR in its current form serves as a beacon of hope, providing many rights to individuals with respect to the protection of their personal data and imposing realistic obligations upon corporations that collect and process their data. While the GDPR is a commendable effort by the European Commission, it has to be read together with the Directive 2002/58/EC on privacy and electronic communications that predates the GDPR by 14 years; the e-Privacy Directive (e-PD).
Both e-PD and GDPR reflect the principle of the protection of personal information as an individual’s basic right as enshrined under the EU Charter of Fundamental Rights. Together with the e-PD and the GDPR, the European Union offers the strongest data protection legal framework currently in the world. With the e-PD being changed to reflect the problems of the modern-day, it is very important to understand its history and what changes are being contemplated.
The e-PD applies to “the processing of personal data in connection with the provision of publicly available electronic communications services in public communication networks in the community”. This means that the e-PD regulates all publicly available electronic communications services and telecommunication services irrespective of the technologies used.
Under the Directive, service providers are required to take appropriate technical and organizational measures to ensure confidentiality of communications, safeguard the security of their services and inform the subscribers of any special risks arising out of the breach of security of the network.
The objective of both the GDPR and the e-PD is to ensure an appropriate level of security and confidentiality of data and communications of European Union residents. However, the matters that fall under the subject matter domain of one regime are outside the scope of the other. This is clarified in Recital 173 and Article 95 of the GDPR, according to which, the GDPR does not apply where there are already existing e-Privacy rules.
Despite having two separate applicability areas, there may be some overlap and, in that situation, both GDPR and e-PD must be read together.
Corporations that send electronic marketing including email advertising in the European Union must comply with the requirements of both GDPR and e-PD. The e-PD requires service providers to obtain the consent of data subjects before processing their data for marketing. This includes an obligation upon corporations to provide full and accurate information to data subjects about the types of processing they intend to perform, their rights to not give consent and withdraw consent. The e-PD also grants subscribers protection against unsolicited communications for direct marketing purposes.
Similarly, the GDPR provides data subjects the right to object to data being processed for direct marketing purposes including an objection to profiling. The GDPR clarifies that in the context of the use of information society services, i.e. services delivered over the internet, the data subject may exercise his or her right to object by automated means using technical specifications, notwithstanding anything contained in the e-PD.
The e-PD was originally known as the “cookie law” because it provides specific rules on cookies, unlike the GDPR. As per the e-PD, organizations must provide clear and comprehensive information to users in relation to the processing of cookies and must acquire informed consent of users before tracking with cookies. The two exceptions to this are “where technical storage or access is for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user”. Under the e-PD, users must have the opportunity and the right to refuse to have a cookie stored on their terminal equipment.
Although the GDPR does not specifically mention cookies, it classifies cookie identifiers as a type of “online identifier” meaning that it may be considered personal data under certain circumstances. The GDPR further requires controllers and processors to demonstrate that the data subjects have consented to the processing of their information and that there must be some lawful basis for the processing of data subjects’ personal information.
The e-PD will soon be replaced by the e-Privacy Regulation (e-PR) that is currently in its draft stage and under review by the European Union. The e-PR is expected to complement the GDPR just like the e-PD but will be an updated version which will be more in line with the industry-wide technological changes that have taken place in the last few years.
The proposed e-PR will not only provide protection to the content of European Union residents’ electronic communications but it will also stop the transfer and use of metadata associated with that communication. Therefore, e-PR is expected to update e-PD by ensuring confidentiality in all current and future means of communications including telecommunication services over the internet, emails, internet phone calls, personal messaging services through social media, voice services and other interpersonal communication services.
Having revised rules on cookies, the e-PR will allow users to refuse the tracking of cookies by being in control of the privacy settings. Furthermore, no consent shall be required for “non-privacy intrusive cookies”. The e-PR provides protection against any form of unsolicited electronic communications including spam.
This new law will have potentially significant effects on corporations especially those that use metadata or tracking tools to monitor online behavior. The e-PR has adopted the same standard of “consent” as that of the GDPR. Similarly, it has adopted identical penalties as that of the GDPR. Any violation of the regime will be subject to the same upper limit administrative fine, i.e. 20 million euros or four percent of the company’s total worldwide annual revenue, whichever is greater.
The e-PR is expected to update the existing outdated regime of the e-PD into a modernized one. It protects end-user’s privacy by ensuring their consent to the storage and access to stored data in their terminal equipment to avoid unwanted tracking cookies. It is in fact, a part of the comprehensive reform process of the European Union in relation to data protection and privacy laws.
Unlike its predecessor e-PD, the e-PR will automatically be applied to all member states across the European Union since it is self-executing and would not be requiring local domestic regulations by member states to be passed for its implementation.
securiti.ai is an innovator of AI-Powered cybersecurity and data protection solutions. Its product is the world’s first PrivacyOps platform that helps automate all major functions needed for privacy compliance in one place.
The securiti.ai’s Data Subject Rights Module is an automated system that drastically simplifies the process of fully complying with data subject rights requests.
The Data Mapping Automation Solution helps customers transition smoothly from their existing manual processes to a modern automated framework with minimal disruption and tracks personal data in structured and unstructured data stores to connect it to users. It enables companies to demonstrate compliance with privacy regulations.
The securiti.ai’s Consent Management Tool automates the consent lifecycle, enabling organizations to keep trust with individual customers in the processing of personal information.
The Assessments Module enables the evaluation of the readiness of a company's internal departments and divisions and measures the organization’s strengths against data privacy regulations.
The Vendor Assessments applies powerful automation to privacy assessment collection from third-parties and power analytics to yield deep insight into third-party compliance with privacy regulations.
securiti.ai helps businesses discover data over a web of internal and external systems, stitch a data graph to link personal data with each individual, conduct an automated internal assessment of policies as well as third-party vendors, manage consent and do a lot more.
Ask for a DEMO today to understand how securiti.ai can help you comply with GDPR, e-Privacy Directive, and a whole host of other global privacy laws and regulations, such as the CCPA, with ease.
ePrivacy, short for electronic privacy, refers to protecting individuals' privacy rights and personal data in the context of electronic communications, including online activities, emails, and instant messaging.
Privacy and Electronic Communications Directive 2002/58/EC on Privacy and Electronic Communications, commonly referred to as ePrivacy Directive, is a European Union directive that protects the privacy and personal data in electronic communications. It sets rules for issues like cookies, marketing communications, and the confidentiality of communications.
The ePrivacy Regulation, also known as the ePrivacy Regulation (EU) 2019/216, is a proposed regulation intended to replace the ePrivacy Directive. It aims to strengthen and update privacy rules for electronic communications in the EU, including regulations on cookies, direct marketing, and confidentiality.
No, the ePrivacy Directive has not come into effect yet.
While both GDPR (General Data Protection Regulation) and the ePrivacy Directive focus on privacy and data protection, GDPR is a comprehensive regulation that applies to personal data processing across various sectors, while the ePrivacy Directive specifically addresses privacy in electronic communications, including issues like cookies and electronic marketing.
The ePrivacy Directive applies to individuals, organizations, and service providers involved in electronic communications within the European Union (EU). This includes internet service providers, email providers, website operators, and more.
The purpose of the ePrivacy Regulation is to modernize and strengthen privacy protections for electronic communications in the EU. It aims to ensure the confidentiality of communications, protect individuals' online privacy, and regulate issues like cookies, tracking, and unsolicited electronic marketing.
The scope of ePrivacy Regulation encompasses traditional telecommunications services like internet access, mobile telephony, and SMS services. It also includes interpersonal communication services, such as over-the-top services like Messenger, VoIP services like WhatsApp and Skype, and email services like Gmail. Additionally, ePrivacy Regulation covers machine-to-machine transmission services.
Get all the latest information, law updates and more delivered to your inbox
November 1, 2023 post
China has passed its data protection law named the Personal Information Protection Law (PIPL) that came into effect on November 1, 2021. The PIPL...
September 11, 2023 post
Securiti has just been recognized as a Leader in the “IDC MarketScape: Worldwide Data Privacy Compliance Software 2023 Vendor Assessment” report. This makes us...
May 10, 2023 post
Privacy-by-design and privacy-by-default are two cornerstone concepts of data protection regulatory frameworks. Thus, compliance thereof is an essential legal prerequisite for any entity which...
At Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.
Copyright © 2024 Securiti · Sitemap · XML Sitemap
info@securiti.ai
Securiti, Inc.
300 Santana Row
Suite 450
San Jose, CA 95128
