Online safety regulation: how to address the data challenge

Tens of thou­sands of busi­ness­es will be affect­ed by one of the most sig­nif­i­cant changes to data reg­u­la­tions in years. The new Online Safe­ty Bill, which has been tabled by the UK gov­ern­ment and could come into force, could drag many com­pa­nies that wouldn’t ordi­nar­i­ly expect to be sub­ject to its over­sight into the crosshairs. By one esti­mate, around 25,000 com­pa­nies could come under its con­trol.

All of which adds up to a headache. With near­ly 200 claus­es and 12 sep­a­rate parts, keep­ing onside of the law can be a full-time job. And with poten­tial­ly enor­mous pun­ish­ments for breach­ing it, includ­ing per­son­al respon­si­bil­i­ty for exec­u­tives of the com­pa­nies involved, it’s an issue that needs to be con­sid­ered care­ful­ly from all per­spec­tives – includ­ing data. 

But before get­ting too wor­ried, it’s worth putting the require­ments of the upcom­ing law into per­spec­tive.

Business as usual

“It’s not too dis­sim­i­lar from the leg­is­la­tion that was thrust upon finan­cial ser­vices in 2008 off the back of an absolute­ly cat­a­stroph­ic event that left a lot of peo­ple with­out homes and los­ing their liveli­hoods,” says Dael Williamson, EMEA field CTO at Data­bricks. In the after­math of the finan­cial crash, which some believe was brought about by mis­man­age­ment in banks and oth­er finan­cial ser­vices com­pa­nies, the gov­ern­ment insti­gat­ed strin­gent new rules around com­pli­ance.

Those rules were nec­es­sary then, and these ones are nec­es­sary now, believes Williamson. “It’s an impor­tant mea­sure that’s come in place,” he says. “I don’t think it should impart fear.” The finan­cial reg­u­la­tions put into place in the after­math of the finan­cial cri­sis cre­at­ed “a huge amount more resilience in our finan­cial mar­kets,” says Williamson, and he has no rea­son to think the Online Safe­ty Bill would do any­thing dif­fer­ent. Any organ­i­sa­tions that choose to per­ceive it neg­a­tive­ly would also like­ly fall foul of pub­lic per­cep­tion: four in every five UK adults say that more action is need­ed to keep tech com­pa­nies in check, show­ing broad sup­port for the bill as cur­rent­ly devised. 

There are wrin­kles for any busi­ness to bear in mind about the leg­is­la­tion, cau­tions Alan Wood­ward, pro­fes­sor of cyber­se­cu­ri­ty at the Uni­ver­si­ty of Sur­rey. “It’s a tricky one this because the busi­ness impli­ca­tions are not obvi­ous,” he says. “Much will depend on how it inter­acts with GDPR. Wood­ward points out that there is the poten­tial for a busi­ness to become “vic­ar­i­ous­ly liable” if they han­dle data that comes under the aus­pices of the Online Safe­ty Bill. He says that could cov­er hard­ware such as cor­po­rate-issued devices or shared dri­ves. But it’s not yet clear. “I think so much is up in the air because so many of the terms of the bill are vague and yet to be inter­pret­ed,” he says.

Empowering users

The bill as cur­rent­ly draft­ed would put pow­er back in the hands of every­day users to dic­tate what they see and how they’re pre­sent­ed with infor­ma­tion, says Robin Sutara, field CTO at Data­bricks. “Putting con­trol back in the hands of peo­ple so algo­rithms are deter­min­ing what con­tent they do or don’t want to see is no bad thing,” she says. Instead, she sees this as a log­i­cal next step in the world of tech as con­sumers become savvi­er, know­ing that they are the prod­uct as well as the user. “This is just the next step in the evo­lu­tion of ‘how do we get more pow­er to the con­sumer to be able to con­trol what they do?’,” she says.

The changes do mean that busi­ness­es need to adapt to keep abreast of evolv­ing reg­u­la­tions, how­ev­er. That will require cre­ativ­i­ty, says Williamson. “What I mean by that is some data will need to be more guard­ed than oth­er data,” he explains. It’s sim­i­lar to how banks were forced to insti­gate a regime of red data and green data in the after­math of their reg­u­la­to­ry crack­down post-finan­cial cri­sis. More gov­er­nance was added around sen­si­tive data need­ing care­ful over­sight com­pared to every­day infor­ma­tion that can be shared and han­dled more freely. 

Tak­ing such an approach requires data pro­duc­ers and those han­dling it to decide which buck­et their data falls into, and to take the req­ui­site approach­es to it depend­ing on that, says Williamson. At first, that may seem daunt­ing, but needn’t be. 

The case for continuity

“It’s kind of a healthy con­straint, and it’s just putting enough fric­tion in place to make sure that they’re adher­ing to the rules,” he says. In that sense, it’s best to approach the Online Safe­ty Bill as a Goldilocks law, gen­tly encour­ag­ing those already fol­low­ing the rules to dou­ble-check their work­ing and jus­ti­fy their deci­sions, rather than requir­ing an entire­ly new team of indi­vid­u­als to work twice as hard on imple­ment­ing its changes and meet­ing its new require­ments.

For well-run organ­i­sa­tions, this will be a small, addi­tion­al task, rather than an over­haul of how they han­dle data. “It’s just a next step in the evo­lu­tion of a process around gov­er­nance and struc­ture, and iden­ti­fi­ca­tion of the datasets that are more at risk ver­sus less at risk,” says Sutara. “The hope would be they’ve already thought about those things as they’re set­ting up their data ecosys­tems.”

And often, says Williamson, com­pa­nies already have in place the kinds of struc­tures that will be required from the Online Safe­ty Bill as part of their reg­u­lar data com­pli­ance checks – they just don’t realise it. “The most impor­tant mes­sage is, you should­n’t be scared of this if you’re doing these oth­er things that we’ve spo­ken about,” says Williamson. “Actu­al­ly, it’s just anoth­er oppor­tu­ni­ty to build trust with your cus­tomers and your con­sumers.”

Tens of thousands of businesses will be affected by one of the most significant changes to data regulations in years. The new Online Safety Bill, which has been tabled by the UK government and could come into force, could drag many companies that wouldn’t ordinarily expect to be subject to its oversight into the crosshairs. By one estimate, around 25,000 companies could come under its control.

All of which adds up to a headache. With nearly 200 clauses and 12 separate parts, keeping onside of the law can be a full-time job. And with potentially enormous punishments for breaching it, including personal responsibility for executives of the companies involved, it’s an issue that needs to be considered carefully from all perspectives – including data. 

But before getting too worried, it’s worth putting the requirements of the upcoming law into perspective.