Following news that Ancestry.com has been forced to change a controversial policy regarding their usage of customers DNA data; revoking a clause that said they could store it ‘in perpetuity’, Andy Waterhouse, EMEA Director at RSA commented below.
Andy Waterhouse, EMEA Director at RSA:
As technology continues to hurdle forward at breakneck speed, consumer rights have to evolve with it and give consumers greater control. In contrast to the previous Data Protection Act, GDPR enshrines rights to one’s genetic data as a core component of the legislation itself as the definition of Personally Identifiable Information (PII) data has expanded to include genetic data. Anything that can be used to identify a person is classified as PII Data, which EU citizens must now explicitly consent for companies to use – this moves beyond the traditional names, addresses and bank details into new areas like DNA, fingerprints, and eye scans – a fact that business must respect.
For companies handling genetic data, stories like this should act as a wake-up call that things need to change. To date, many will not have needed to comply with the Data Protection Act, but with GDPR coming round the corner, there will be big changes to be made as they will now need to foster a awareness and accountability for the data they store and how it’s used. This is why we advise customers to take a business-driven approach to GDPR; take a step back, understand your business risk, design processes, apply controls that make sense for your organisation and use technology to automate and improve. There isn’t a one size fits all approach, and no silver bullets.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.