A recent PwC pulse survey asked C-suite executives from large American multinationals about the state of their plans for Europe’s landmark General Data Protection Regulation (GDPR). The “pulse” revealed five surprising results:
The EU reached agreement on the GDPR in December 2015, and in the last 12 months preparing for the new law’s obligations have jumped to the top of corporate agendas. Of the 200 survey respondents, 54% reported that GDPR readiness is the highest priority on their data-privacy and security agenda. Another 38% said GDPR is one of several top priorities, with only 7% said it isn’t a top priority.
Much of the discussion about the GDPR has focused on the law’s privacy-centric requirements, such as mandatory record keeping, the right to be forgotten and data portability. The GDPR’s relatively generic information-security obligations, however, figure prominently in GDPR plans of US companies.
Securing a $1 million budget for data privacy has been more an exception than a rule for many American corporations. The GDPR’s potential 4% fine of global revenues, however, has changed budget appetites for mitigating this GDPR risk. While 24% of respondents plan to spend under $1 million for GDPR preparations, 68% said they will invest between $1 million and $10 million. Another 9% expect to spend over $10 million to address GDPR obligations.
The survey asked executives which EU cross-border data-transfer mechanism they planned to use for processing EU personal data outside of Europe. After the invalidation of the Safe Harbor agreement in October 2015, most Safe Harbor members implemented so-called model contractual clauses as a stop-gap measure.
Many observers, especially those in the legal community, thought model clauses would become the new norm. While 58% of respondents reported that future strategies would include model contracts, a stunning 75% said they will pursue binding corporate rules (BCRs), while 77% plan to self-certify to the EU-US Privacy Shield agreement. The uncertain future of both model contracts and the Privacy Shield may drive US multinationals to adopt two or even all three of these options to hedge their risks.
US corporations that are heavily invested in Europe will probably stay the course in the near term. Indeed, 64% of executives reported that their top strategy for reducing GDPR exposure is centralization of data centers in Europe. Just over half (54%) said they plan to de-identify European personal data to reduce exposure. The threats of high fines and impactful injunctions, however, clearly have many others reconsidering the importance of the European market. In fact, 32% of respondents plan to reduce their presence in Europe, while 26% intend to exit the EU market altogether.
American multinationals that have not taken significant steps to prepare for GDPR are already behind their peers. The typical large US corporation is currently moving through a data-discovery and assessment phase toward a multi-million-dollar remediation initiative that includes shoring up standard data-privacy and security capabilities in US operations. As European regulators in 2017 further clarify how they interpret the GDPR, more American companies are likely to re-evaluate the return-on-investment of their European initiatives.