WINTER 202 0 TODAY’S GENER AL COUNSEL
Cybersecurity
Strengthen Digital Strategy in the Public Sector By Martin Schallbruch
B
36
eginning in May 2018, inboxes of EU citizens were bombarded with emails from companies asking for permission to use their data as the new General Data Protection Regulation (GDPR) took effect across the European Union. GDPR is a large and complex law applicable to any company or organization that processes the data of an EU citizen. Any company processing data without legal basis faces huge fines. It aims to give people more rights to the information about them that organizations possess. The implementation of this new regulation suggests that politics is beginning to successfully understand digitization and tackle an important area of digital risks. Although GDPR is a huge step forward in data protection, it isn’t as effective as it should be in ensuring the safety of the digital space for all. Data protection law has exploded, while data protection has suffered. In practice, the small-scale approach is no longer capable of protecting citizens effectively, comprehensively and transparently from the actual hazards of data processing. There are now so
digitally access our accounts, transfer money and check payments through our phones. However, the app developer, banks, smartphone manufacturer, mobile phone provider and operating system developer all have access to our data and are subject to different data protection regulations and supervisory authorities. This means that providing consumers with a complete description of all data processing operations, participating institutions and legal regulations is almost impossible. Data protection isn’t the only area of digitization where the public sector should be implementing strategies and regulation. Unfortunately, the public sector has generally been weak at implementing digital strategies and protecting its citizens in the digital space, with governments struggling to keep up with increased digitization. The public sector is struggling when it comes to the security of our everyday digital life. Households are now filled with a whole host of digital devices that are connected to the internet — mobile phones, laptops, smart TVs, e-books, even smart light bulbs. Data is stored on all of these de-
Global digital platforms create online communities, yet also spread illegal content and commit crimes. many different data regulations and guidelines that it is difficult to provide clear and detailed descriptions of them all. In fact, the abundance of data protection lulls people into a false sense of security and almost encourages them to handle their data carelessly. For example, banking has increasingly been made available through our smartphones via banking apps: we can
vices in the form of texts, photos, music, videos, emails, personal details — some of which may have been forgotten about or are no longer in use. Every program and digital device has vulnerabilities requiring regular maintenance, installation of data protection updates and configuration of security settings. There is no overarching approach to protecting the security of the networked home.
Governments’ digital capabilities make overcoming their digital weakness a complicated and difficult process. However, there are five basic approaches that governments could focus on to strengthen their digital strategies.
1
New Generalized Laws Governments need to outline a new, less detailed, and more generalized digital law — a civil code for the digital space. At present, digital law is focused on specific applications and phenomena of digital technology — for example, autonomous driving or tech fraud — but this cannot be applied to digitization in general. New laws must include basic rules for responsibility in the digital realm, such as a minimumsecurity obligation for manufacturers of networked devices, leading to the development of a more comprehensive, overarching digital law outlining responsibility in the digital space. This would replace the current model of multiple individual laws that need to be updated every few years as technology advances.
2
Increased State Responsibility Digital innovation in traditionally state-run sectors, such as education and healthcare, is being dominated by private companies and large tech firms. Now that almost all areas of our lives are digitized — healthcare, energy, arts, logistics — more is expected from our governments. However, poor progress is being made in digitizing government actions. The public sector is not leading digital innovation and has become reliant on private companies providing new and innovative technology. Using healthcare as an example, health apps have become far more widespread than digital offerings from public health services. Large platform providers com-