Number of words: 372

The GDPR is different from many government regulations. Most of the time, a regulation tells a company what it cannot do. For example, don’t include misleading statements in your advertisements. Or don’t put asbestos in your buildings. The fundamental philosophy of a free market economy encourages business innovation, with regulation putting certain conduct off-limits but otherwise leaving companies broad freedom to experiment.

One of the biggest features in the GDPR is in effect a privacy bill of rights. By giving consumers certain rights, it requires that companies not just avoid certain practices but create new business processes. For example, companies with personal information are required to enable consumers to access it. Customers have a right to know what information a company has about them. They have a right to change the information if it’s inaccurate. They have a right to delete it under a variety of circumstances. And they have a right to move their information to another provider if they prefer.

In important ways, the GDPR is akin to a Magna Carta for data. It represents a critical second wave of European privacy protection. The first wave came in 1995, with a privacy directive that required that websites notify consumers and get their consent before collecting and using their data. But as the internet exploded, people were inundated with privacy notices and had little time to read them. Recognizing this, Europe’s GDPR required that companies give consumers the practical ability to go online to view and control all the data that had been collected from them.

It’s not surprising that its implications for technology are so sweeping. Start with the proposition that any company with millions of customers—or even thousands of customers—needs a defined business process to manage these new customer rights. Otherwise it will be swamped with inefficient and almost certainly incomplete work by employees to track down a customer’s data. But more than that, the process needs to be automated. To comply quickly and inexpensively with the GDPR, companies need to access a customer’s data in a unified way across a variety of data silos. And this requires changes to technology.

Excerpted from pages 139 to 140 of ‘Tools and Weapons’ by Brad Smith and Carol Browne