Managing Data Privacy

In May 2023, one of the largest fines ever imposed for violations of the European Union's General Data Protection Regulation (GDPR) came to light. A historic penalty of 1.2 billion euros was levied against the United States technology giant Meta (Data Privacy Manager, 2023). Known for its popular platforms, including Facebook, Instagram, and WhatsApp, the technology giant failed to adequately protect the data of EU citizens during a transfer from the EU to the US. The initial enforcement action was taken by the Irish Data Protection Commission (DPC), which alleged that Meta, in relying on Standard Contractual Clauses (SCC) and additional administrative controls, did not comprehensively address the risks to data subjects' rights and freedoms. The management of privacy is more of an art than a science, characterized by ambiguous and challenging-to-implement controls, largely because of undocumented and overlooked scientific approaches.In 2020, the European Court of Justice invalidated the EU-US data flows agreement known as Privacy Shield, citing concerns over the use and potential abuse of US intelligence activities (Data Privacy Manager, 2023). This ruling led to significant changes in the use of Standard Contractual Clauses (SCCs), making their use more stringent. However, despite these changes, Meta and many other US-based companies continued to rely on SCCs without implementing additional compensating controls. The imposed fine requires Meta Ireland to cease data transfers to the US and bring processing operations into compliance with Chapter 5 of the GDPR. This specific chapter of the GDPR focuses on ending the unlawful processing and storage of personal data of EU/EEA users in the US (Data Privacy Manager, 2023).Controls are typically categorized as technical, administrative, and physical, and they can be implemented in various preventive, detective, and corrective measures. Meta's fine highlights failures in both administrative and technical controls. The administrative failure is attributed to non-compliance with the stricter use of SCCs. Implementing additional technical controls could have offered sufficient compensating measures and potentially reduced the fine resulting from the improper use of administrative controls. However, this scenario raises questions about the availability and effective utilization of privacy controls for adequate protection.Several privacy frameworks support the implementation of individual controls. In October 2022, President Joe Biden recently signed an executive order titled 'Enhancing Safeguards for United States Signals Intelligence Activities' to address the EU's concerns about unrestricted US intelligence activities. This executive order is a step towards establishing an EU-US Data Privacy Framework that will define the requirements for data transfers between the two continents (European Data Protection Board, 2023). During the development of this framework, the National Institute of Standards and Technology (NIST) has produced a framework that can be used to map specific controls within it. Other notable frameworks include the Generally Accepted Privacy Principles, Organization for Economic Cooperation and Development Privacy Principles, and the Nymity Privacy Framework, among others. This paper will examine the relationship between choosing a privacy framework and implementing privacy controls.