If your email inbox looks like mine, this past week you probably noticed a flood of emails from businesses outlining privacy policy changes in response to GDPR, a new legislation designed to protect the data privacy of European Union (EU) citizens. The implications of this new legislation are far-reaching, especially as it relates to the choice between cloud and on-premise options for real-time video communication.
Furthermore, as recently seen in Mark Zuckerberg's testimony before the United States congress, other countries are beginning to take the issues of data ownership and privacy much more seriously than ever before. Go ahead and jump straight down to my thoughts about the implications of this further below, but first, here is a bit of background on the new EU legislation that may likely influence future rule-makers in the United States.
The General Data Protection Regulation(GDPR) is a new data privacy regulation that came into effect on May 25, 2018 that aims to protect European Union citizens from privacy issues and data breaches. It is an important update to the now outdated Data Protection Directive 95/46/EC of 1995.
The GDPR is unique in that it doesn't just apply to organizations located within the EU. If a business or organization is offering goods or services to EU residents, regardless of whether payment by the data subject is required, they are affected. It is important to stress that organizations cannot simply avoid GDPR obligations because they are outside the jurisdiction of the EU. If an organization fails to comply, they could face the same consequences as an organization located in the EU.
The penalty for noncompliance is steep and is issued in a tiered approach. The maximum fine for serious infringements is up to 4% of an organizations worldwide annual revenue for the prior financial year or €20 Million, whichever is higher. These rules apply to both controllers and processors -- meaning clouds will not be exempt from GDPR enforcement.
Virtually all data pertaining to individuals residing in the EU will be protected under the GDPR. This not only includes sensitive information such as credit card and social security numbers, but also things like names, photos, email addresses, social network posts, medical information, and IP addresses. Basically, anything that can be used both directly or indirectly to identify a person is covered.
More specifically, these are a few of the key items stipulated in the legislation:
To fully understand the implications of the GDPR, especially as it relates to cloud computing, you must first grasp the difference between two key roles defined in the regulation -- data processors and data controllers.
Now, given the example above, if a breach were to occur that compromised the data of citizens in the EU, Company X, the data controller, would be considered the primary party responsible. However, that does not mean that Company Y, the data processor, is off the hook. Under the GDPR, data processors will now be subject to penalties and civil claims if a breach or privacy issue were to occur. This is one of the key differences in the new legislation.
There will always be some inherent uncertainty if your organization chooses to use a cloud provider for real-time video services. Determining the extent and location of cloud data storage can prove difficult. In cloud computing, data can be distributed over a number of geographical regions and determining the location of that data is rarely straightforward and relies solely on disclosure of your provider. Often the location of the cloud computing company headquarters is different from the data centres where your data lives -- often not even in the same country. Data does not simply stay stagnant either. It can be moved from one location to another regularly or it may reside in multiple locations at once.
Under historical rules, the physical location of the data determines which jurisdictional privacy rules apply. However, under GDPR the physical location of the data subject is the decisive factor. The challenge for organizations working with cloud service providers is determining whether their data is remaining GDPR compliant throughout all geographical regions it may reside in. Under the GDPR companies are required to know where there data is, who is able to access it, and how it is being protected at all times.
The uncertainty resulting from cloud-computing options can be eliminated if an organization chooses a strategy in which they control all aspects of their transmitted and stored data. Self-hosted systems help mitigate GDPR risk by giving you oversight and control over all aspects of your client's data. When you deploy your real-time video solution to a self-hosted cloud, you own the cloud infrastructure and you alone have the ability to access the data. In addition, you can also choose the geographical location of your server, further ensuring GDPR compliance.
Similarly, you can choose to deploy an on-premise solution internally within your own network on your own hardware. This option has historically been attractive to hospital systems concerned with HIPAA compliance, however, this option is also becoming popular again with organizations in the EU that want the same level of control over their client’s data.
It can be difficult to find a real-time communication solution that gives you the flexibility to choose how your data is handled. With LiveSwitch Inc's SDKs, you can choose to self-host on cloud infrastructure of your choice (e.g: AWS, Microsoft Azure, Oracle) or deploy on your own on-premise hardware. Not only does this help to ensure GDPR compliance and customer security but it is also often more cost effective than pay-per-minute platform-as-a-service (PaaS) cloud providers.
Overall, there are several routes an organization can take when creating a GDPR compliant real-time communication application - do your research and find the one that gives you the best flexibility and control over your data.