and it is a complex set of rules that organizations
that dictates that certain requirements and and organizations must dedicate as a result
quite a big amount of time and money to comply with it. And for users, that's maybe
also difficult to understand. It's a very German idea, by the way. German leadership pushed for the
strengthening of data protection in Europe and part of that has to do with its history.
A few general points about what the GDPR entails is that, according to the law, businesses
must be able to show that they've made efforts to comply with the law. That really shows proof
and one key principle is that they need to know what data they hold on their customers.
So if you're a business or even the data you hold on people, if you're a public organization
why you hold this data, for what purpose, because some companies keep data for a limited amount
of time or longer, they collect it for analytics to keep it as part of a mailing list or email
marketing. Another thing is that organizations need to show proof of consent from people that
they've allowed, the people have allowed them to use their data which is why you as a
user have to tick those boxes that that ask you if you've read the terms and conditions.
Another principle is that users should be able to opt out for their data to be collected.
The GDPR did raise the bar globally for data protection. It's not a fundamental
change at first glance compared to its predecessor the data protection directive
and laws are still drafted by humans. But now you have machine learning, AI systems, automated
decision making that are becoming a reality. So we'll come to that probably
later and because that also impacts technology. Major changes that the GDPR introduced are
fines, so non-compliance has serious consequences, and infringements could cost up to
20 million euros or four percent of the firm's global annual revenue, from the financial
year preceding, whichever is higher. So privacy and data protection are now taken much more
seriously by companies as you can imagine and just to briefly mention a couple of cases that our
audience might have heard of British Airways and Marriott's hotels chains were each fined
about 20 million euros or pounds something like that for insufficient measures like technical and
organizational measures to ensure information security. You also have Google's fine, which
was about 50 million euros because it's failed to provide enough information to users about
its content, data content policies etc. GDPR created what you can call artificial scarcity
of data and driven up its costs by limiting the access that companies have to that data.
Next to the regulatory costs of compliance you know having to hire lawyers, privacy lawyers
instead of maybe hiring engineers and maybe instead of investing in R&D, companies are buying
GDPR insurance, because they're afraid of sanctions and fines, so they want to really stay in the clear.
So I think this reallocation of investments from technologies, to making sure you're not
infringing more new laws, that could put EU businesses at a competitive advantage compared to
you know the United States and Asian
competitors