Shannon Yavorsky was quoted on March 28, 2018, in The Verge about how the General Data Protection Regulation (GDPR) will give companies a new set of rules for sharing data online.
The most important changes will be happening behind the scenes. The GDPR also sets rules for how companies share data after it's been collected, which means companies have to rethink how they approach analytics, logins, and, above all, advertising. A single site could easily have 20 ad-targeting partners, often invisible to the person whose data is being shared. But the GDPR adds complex new requirements for any company that gets user data second-hand, requiring a lot more transparency on what a company is doing with your data. As a result, all of those partners have to be brought into the open and their contracts have to be rewritten to comply with the GDPR. That means unearthing a notoriously messy system that’s been built on the idea that there's no cost to sharing data.
Ms. Yavorsky said that clients were particularly stymied by the question of who would be liable if data was breached from a sharing partner. "I get asked all the time, what’s the market standard?" Yavorsky said. "We just don't know. There haven’t been any penalties, so we don’t know what the enforcement is going to look like."