Effects of GDPR

Effects of GDPR

With the General Data Protection Regulation (GDPR) set to come into effect from the 25 May, questions as to the ability of financial service organisations to meet compliance deadlines have intensified. The regulation is designed to safeguard data protection for all EU citizens by emphasising obligations in relation to personal data consent as well as access to or erasure of data (the so-called ‘right to be forgotten’).

In practice, this means that companies, and individual brokers, will be obliged to specify how they use collected data to their customers and to ensure that it isn’t shared with third-party vendors without prior permission; to enshrine concepts of accountability in terms of the ‘flow’ and external access to data and to report any breeches within 72 hours. In addition, they will need to ‘pseudonymise’ data in order to ‘cloak’ identities and to undertake regular Privacy Impact Assessments.

Given the sheer volume of customer data collected and processed within the financial industry, however, there is every likelihood that regulators will choose to maintain especially stringent standards when enforcing GDPR compliance at this level, meaning that companies are having to overhaul existing systems or create new automated privacy mechanisms from scratch to suit regulatory requirements.

Nevertheless, the depth of investment and expertise needed to implement these structures has led to many companies experiencing severe delays and difficulties in trying to meet the compliance deadline. Indeed, recent research published by IT company Claranet, has revealed that 69% of financial services are currently struggling to secure customer data information effectively, while 57% have highlighted security as their biggest IT challenge, with the teams responsible finding it increasingly difficult to acquire the necessary skills to confront the challenge of evolving cyber-threats.

For brokers the requirements and challenges are just the same and simply relying on lenders and software providers to give you a solution won’t be sufficient. Within each business someone needs to be responsible for GDPR and getting it wrong carries serious penalties. There is an excellent interactive “data protection self assessment” on the Information Commissioners Office website – ico.org.uk. If you are late to the GDPR party it will really help.

Whilst on-going compliance problems raise obvious concerns, the financial industry simply cannot afford to lose sight of the inherent benefits that GDPR affords- that in an increasingly data-driven landscape, the ability to re-structure and enhance security measures can only increase public faith in the wider sector as well as to reduce costs and risks. Moreover, if anything can be done to prevent cold-callers or claims management companies from bombarding us, and our clients, with their unsolicited gibberish then so much the better…..

www.promisemoney.co.uk

01902 585052