Enterprises are shaking up their approach to data privacy and governance, new research shows, largely due to added risk factors created by AI adoption.

According to Cisco's 2026 Data and Privacy Benchmark Study, nearly all companies are expanding privacy programs and governance frameworks to protect their data.

AI is the main reason for 90%, with 93% saying they planned further investment to keep up with the complexity of AI systems and the expectations of customers and regulators.

The survey found that 38% spent at least $5 million on their privacy programs in the past year – marking a dramatic increase from just 14% who spent over that threshold in 2024.

Notably, these programs appear to be working well. An overwhelming 96% of organizations reported that robust privacy frameworks were helping unlock AI agility and innovation, and 95% said privacy was essential for building customer trust in AI-powered services.

One interesting change spotted by the researchers is that trust is no longer just a question of meeting regulatory requirements.

Data governance is now seen as a strategic business enabler, with 99% of organizations reporting at least one tangible benefit from their privacy initiatives, such as enhanced agility, innovation, and greater customer loyalty.

Almost half said that clear communication about how data is collected and used is the most effective way to build customer confidence.

As a result, governance is evolving – although many organizations are still working to define and establish the structures they need to manage AI responsibly.

While three-quarters report having a dedicated AI governance body in place, only 12% describe it as mature. Meanwhile, 65% of organizations struggle to access relevant, high-quality data efficiently.

"AI is forcing a fundamental shift in the data landscape, calling for holistic governance of all data – both personal and non-personal,” said Jen Yokoyama, senior vice president, legal innovation and strategy, at Cisco.

“Organizations must deeply understand and structure their data to ensure every automated decision is explainable. It’s not just for compliance, but a necessary scaling engine for AI innovation.”

Data requirements are causing headaches

While 72% of respondents were generally positive about data privacy laws, there is a growing push to streamline and update data requirements, Cisco found.

Just over eight-in-ten organizations surveyed face heightened demand for data localization and global data complexity - and 85% said this adds cost, complexity, and risk to cross-border service delivery. #

Similarly, 77% report these requirements limit their ability to offer seamless 24/7 service across markets.

On top of this, the assumption that locally stored data is inherently more secure is gradually eroding, from 90% in 2025 to 86% in 2026.

“To capture the potential of AI, organizations (83%) are advocating for a shift toward harmonized international standards,” said Harvey Jang, Cisco vice president and chief privacy officer.

“They recognize that global consistency is an economic necessity to ensure data can flow securely while maintaining the high standards of protection required for trust.”

Cisco said enterprises should invest in robust data infrastructure, prioritizing transparency, and embedding security and privacy throughout AI initiatives.

Elsewhere, they should make sure they're making informed decisions about data localization, establish strong AI governance, and kit out their teams with comprehensive training and safeguards.

FOLLOW US ON SOCIAL MEDIA

Fears over unverified AI-generated data are pushing organizations to implement a zero trust posture for stronger data governance.

Large language models (LLMs) are typically trained on web-scraped data, and as the use of generative AI grows these sources increasingly contain AI-generated content.

This is set to accelerate in the coming years, according to Gartner. Analysis from the consultancy found 84% of respondents expect their organization to increase funding for generative AI in 2026 – meaning that the volume of AI-generated data will continue to rise.

As a result, future generations of LLMs will increasingly be trained on outputs from previous models – outputs that may be inaccurate or biased. This means an ever-heightening risk of “model collapse,” where AI tools’ responses may no longer accurately reflect reality.

"Organizations can no longer implicitly trust data or assume it was human-generated,” said Wan Fui Chan, managing VP at Gartner.

“As AI-generated data becomes pervasive and indistinguishable from human-created data, a zero trust posture establishing authentication and verification measures is essential to safeguard business and financial outcomes.”

By 2028, Gartner found the proliferation of unverified AI-generated data is set to have prompted 50% of organizations to have implemented a zero trust posture for data governance.

Active metadata management practices will become a key differentiator for firms, the consultancy said, and organizations should consider taking several strategic actions.

How to approach a zero trust data governance strategy

According to Gartner, IT leaders should appoint a dedicated AI governance leader, responsible for AI governance, including zero trust policies, AI risk management, and compliance operations.

This person should work closely with data and analytics (D&A) teams to make sure that both AI-ready data and systems are capable of handling AI-generated content.

Cross-functional teams should also be established, including cybersecurity, D&A, and other relevant stakeholders.

These teams will carry out comprehensive data risk assessments to identify business risks related to AI-generated data - and decide which activities need new strategies.

Elsewhere, building on current D&A governance frameworks will be crucial to tackling the issue, according to Gartner. The creation of new or updated frameworks will focus primarily on updating security, metadata management, and ethics-related policies to address new risks arising from AI-generated data.

Regulatory compliance challenges are afoot

As AI-generated content becomes more prevalent, Chan warned that regulatory requirements for verifying ‘AI-free’ data are likely to intensify.

Crucially, these could differ significantly across geographies, posing serious compliance challenges.

“In this evolving regulatory environment, all organizations will need the ability to identify and tag AI-generated data," he warned.

"Success will depend on having the right tools and a workforce skilled in information and knowledge management, as well as metadata management solutions that are essential for data cataloguing.”

FOLLOW US ON SOCIAL MEDIA

Chief data officers (CDOs) might not be the most important executives in the C-suite right now, but they’ll rank among the most influential figures in no time.

That’s according to Deloitte's Chief Data Office (CDO) report, which found 54% of CDOs believe they have less influence on the business than their C-suite colleagues, but 44% believe that CDOs will become of equal influence by the turn of the decade.

"While over half of CDOs currently feel less influential than other C-suite leaders, there's a powerful shift on the horizon," said Andy Whitton, data, privacy and analytics partner at Deloitte.

The survey found that 57% of CDOs now report to a CIO or COO, up from 39% last year. Beyond the C-suite, nearly two-thirds of CDOs predict their teams will add employees over the next year, growing by an average 27%.

Budgets are also on the rise, with 43% saying they've seen a boost over the last year and 56% reporting an increase in data spend.

"Organizations are clearly doubling down on data, rapidly increasing their data maturity and literacy to gain crucial competitive advantage," said Whitton.

"This is positioning the CDO role as a pivotal and increasingly influential force across the C-suite, helping to drive sustained growth."

Chief data officers are riding the AI wave

The rise in influence for CDOs is perhaps no surprise given the sharp enterprise focus on AI and the key role they play in driving adoption of the technology.

Half of CDOs polled said they were accountable or responsible for AI or generative AI in their organizations, for example. Indeed, three-quarters of those surveyed revealed they have AI deployments or experiments operational right now.

Data governance and AI were by far the top priorities for CDOs, though their importance differed by sector. AI was deemed the top priority for CDOs in financial services, highlighted by two-thirds of respondents in that industry.

Meanwhile, 50% of corporate CDOs and 70% of public sector CDOs said data governance was their key focus.

Whitton said this highlights a “nuanced approach” taken by CDOs, with those operating across different sectors tailoring their priorities based on individual needs.

"For example, AI and GenAI are top of the agenda for 66% of financial services CDOs, whereas corporates are homing in on data products, and the public sector is rightly prioritizing data governance,” he said.

Those CDOs who named AI as their core priority also tended to predict their organization will realize benefits more quickly than those who aren't prioritizing the technology – though perhaps the eye on AI payoffs like productivity gains are why they're choosing to focus on the technology in the first place.

It’s not all plain sailing for CDOs, however. Long-running finance-related issues were identified as key barriers to progress.

Nearly half of the CDOs said budget and resource limitations were the biggest hurdle to AI adoption, for example, followed by skills gap and ethical and regulatory concerns.

A separate report from earlier this year found that two-thirds of CDOs believed data quality was the biggest challenge to AI adoption, hampering them from maximizing the use of the technology.

MORE FROM ITPRO

• Why diversity is key to a successful AI strategy
• Data governance in the spotlight as UK firms ramp up AI adoption
• A quarter of firms still don’t have a formal data strategy

Leaders looking to implement AI should make AI governance and risk management their primary focus if they are to succeed in their adoption plans, according to a SAS executive.

Reggie Townsend, VP, Data Ethics at SAS, told assembled media at SAS Innovate 2025 that tech leaders need to consider the risks AI brings now, whether they’re ready for it or not.

To illustrate his point, Townsend said he had recently received two requests for AI use within SAS: one to use ChatGPT for account planning processes and another to use DeepSeek for internal workflow activities.

“Two separate requests, mind you, within two hours of one another, from two separate employees altogether,” Townsend noted.

“This is increasingly becoming a normal day for myself and for leaders like me around the world. So, if you just extrapolated that day over the course of a month, you’d have 40 different use cases for AI and those would only be the ones that we know about.”

While Townsend was quick to stress he has “zero desire” to know the details of every single use of AI around the company, he used the example to underline the clear need for every organization to set out internal AI policies.

To further illustrate his point, Townsend cited the IAPP’s AI Governance Profession Report 2025, which found 42% of organizations already rank AI governance as a top five strategic priority and 77% of organizations overall are working on AI governance measures.

While the report found 90% of organizations who said they have adopted AI are pursuing AI governance, it also found 30% of those without AI are already laying the groundwork for their eventual adoption by working on an AI governance strategy.

“[This] would suggest that they’re taking a governance first approach to this thing, which I actually applaud,” Townsend said. “I like to say that trustworthy AI begins before the first line of code.”

Townsend added that every large organization in the US is either buying AI or adopting it without knowing, via AI updates to products they already use. Employees, he added, are already using AI and leaders will need to consider this demand now, not later, to ensure they don’t expose themselves to risks or undermine their AI adoption roadmap.

“The organizations that thrive won't simply be those that deploy AI first but it'll be those that deploy AI most responsibly,” he said, adding that leading organizations will recognize the strategic imperative of governance and embrace its potential benefits for innovation.

Describing governance as a “catalyst” for technological innovation, Townsend also warned of the barriers that companies who push for AI without considering safe adoption will be hurt in the long term.

“Organizations without AI governance face not just potential regulatory penalties, depending on the markets they’re in, they face a potential competitive disadvantage because public trust has become the new currency for AI innovation.”

Clear roadmaps for AI governance

SAS is targeting reliable AI, having just announced new AI models for industry-specific use cases. Townsend explained that when it comes to AI that delivers predictable results, leaders should first establish a framework for measuring actual outcomes versus the expected outcomes, to which compliance and oversight teams can refer back.

“Now, this is a matter of oversight, for sure, this is a matter of operations, and this is a matter of organizational culture,” he said.

“All of these things combined are what represent this new world of AI governance, where there’s a duality, I like to say, that exists between these conveniently accessible productivity boosters that the team has been talking about this morning, intersecting with inaccuracies and inconsistency and potential intellectual property leakage.”

To address these issues, SAS has created the AI Governance Map, a resource for customers looking to weigh up their AI maturity across oversight, compliance, operations, and culture.

This helps organizations to assess their AI governance no matter where they are with AI implementation, rather than mandating they replace current AI systems with those specified by SAS.

In the near future, SAS has committed to releasing a new holistic AI governance solution, for monitoring models and agents, as well as completing AI orchestration and aggregation. No further details on the tool have been revealed but SAS has invited interested parties to sign up for a private preview later in 2025.

Townsend’s comments echo those of Vasu Jakkal, corporate vice president at Microsoft Security, who last week told RSAC Conference 2025 attendees that governance is an irreplaceable role and would be critical as organizations adopt more AI agents.

Just as SAS is stressing the importance of governance is a key concern, Jakkal took the position that human-led governance will stay relevant as organizations look to keep tabs on the decisions that AI agents make. Both are a pared back version of the future predicted by the likes of Marc Benioff, who in February made the claim that CEOs today will be the last with a fully human workforce.

The rapid growth of AI is outpacing effective governance, researchers have warned, with business leaders desperate for more clarity on regulation.

NTT Data’s Responsibility Gap Survey of C-suite executives concludes that there's an urgent need for stronger AI leadership, balancing innovation with responsibility.

Eight-in-ten said a lack of clear policies is preventing them from scaling generative AI initiatives​, and that unclear government regulations are hindering AI investment and implementation, leading to delayed adoption.

And while nine-in-ten executives said they worry about AI security risks, only a quarter of CISOs said they have a robust governance framework​.

"The enthusiasm for AI is undeniable, but our findings show that innovation without responsibility is a risk multiplier," said NTT Data CEO Abhijit Dubey.

"Organizations need leadership-driven AI governance strategies to close this gap — before progress stalls and trust erodes."

There's a big split amongst C-suite executives about the appropriate balance between safety and innovation. A third of executives believe responsibility matters more than innovation, one-third think the opposite, and one-third rates them equally.

There are also concerns about sustainability, with three-quarters of leaders saying that their AI ambitions conflict with corporate sustainability goals, forcing them to rethink energy-intensive AI solutions.

Additionally, two-thirds of executives say their employees lack the skills to work effectively with AI, while 72% admit they don't have an AI policy in place to guide responsible use.

NTT Data recommends introducing Responsible by Design Principles, building AI responsibly from the ground up and, integrating security, compliance, and transparency into development from day one.

Leaders need a systematic approach to ethical AI standards, going beyond legal requirements, and organizations should upskill employees to work alongside AI and ensure teams understand AI’s risks and opportunities.

Meanwhile, there needs to be global collaboration on AI policy, with businesses, regulators, and industry leaders coming together to create clearer, actionable AI governance frameworks and establish global AI standards.

"AI’s trajectory is clear — its impact will only grow. But without decisive leadership, we risk a future where innovation outpaces responsibility, creating security gaps, ethical blind spots, and missed opportunities," said Dubey.

"The business community must act now. By embedding responsibility into AI’s foundation—through design, governance, workforce readiness, and ethical frameworks—we unlock AI’s full potential while ensuring it serves businesses, employees, and society at large equally."

MORE FROM ITPRO

• Everything you need to know about AI and data protection
• Why your business needs data protection policies
• A lack of AI guidance is causing serious GDPR headaches

Amazon Web Services (AWS) customers will soon be able to book time slots at physical locations to connect their storage devices and upload data to the cloud.

Data can be uploaded to any AWS endpoint, including Amazon S3, Amazon Elastic File System (Amazon EFS), or others, using a high throughput connection of up to up to 400Gbps.

Each AWS Data Transfer Terminal will house a patch panel, fiber optic cable and a PC for monitoring data transfer jobs, the hyperscaler revealed. Terminals will be charged by the hour, with no per GB charge for the data transfer if the data remains in the same continent.

The first two Data Transfer Terminals are already up and running in Los Angeles and New York, with plans to launch more globally.

So far, the company is only listing charges for US-to-US transfers - $300 per hour - and US-to-EU at $500.

"On your reserved date and time, visit the location and confirm access with the building reception. You’re escorted by building staff to the floor and your reserved room of the Data Transfer Terminal location," said Channy Yun, principal developer advocate for AWS Cloud.

"Don’t be surprised if there are no AWS signs in the building or room. This is for security reasons to keep your work location as secret as possible."

The company said the terminals will significantly cut the time it takes to upload large amounts of data, meaning ingested data can be processed within minutes.

Customers can then analyze large datasets using Amazon Athena, train and run machine learning models with ingested data using SageMaker, or build scalable applications using Amazon EC2.

"After the data is uploaded to AWS, you can use the extensive suite of AWS services to generate value from your data and accelerate innovation," Yun commented.

"You can also bring your AWS Snowball devices to the location for upload and retain the device for continued use and not rely on traditional shipping methods."

Suggested use cases include video production data for processing in the media and entertainment industry, training data for Advanced Driver Assistance Systems (ADAS) in the automotive industry, or migrating legacy data in the financial services industry.

The hyperscaler also noted the service could help support uploads of equipment sensor data in the industrial and agricultural sectors.

"You can upload large datasets from fleets of vehicles operating and collecting data in metro areas for training machine learning models, digital audio and video files from content creators for media processing workloads, and mapping or imagery data from local government organizations for geographic analysis," said Yun.

New data breach reporting rules introduced by the Securities and Exchange Commission (SEC) last week have been described as “worryingly vague” and may create a harmful operating environment for security professionals, according to (ISC)2. 

Tara Wisniewski, EVP for advocacy, global markets, and member engagement at the security non-profit, challenged the new scheme, warning that many aspects of the new framework are open to interpretation. 

While Wisniewski broadly welcomed the changes, she suggested that the announcement could create confusion for professionals in the industry.  

“While we support the fundamental principles of public disclosure to inform and protect shareholders, customers, and other constituents, the SEC ruling is worryingly vague. It poses more questions than answers, and may create ambiguity for cyber professionals.”

Under the new rules, public companies will be held to a higher standard of reporting, with firms required to disclose security incidents within four days. 

The ‘Form 8-K’ requirement means companies will have to report any security incident they deem ‘material’ within this timeframe and provide information on the timing of the attack, its scope, and the potential impact on the business and customers. 

However, the terminology used by the SEC is a point of serious contention for (ISC)2 and could be left “open to interpretation”. 

This, the organization said, could lead to over-reporting of security incidents, placing greater pressure on overworked staff. Similarly, (ISC)2 warned the framework could prompt a trend of under-reporting, which in the long term might leave cyber security practitioners personally liable for incidents. 

As such, the organization called for a clearer definition of what constitutes an incident under the new guidelines. 

“There are no concrete definitions for which cyber incidents must be disclosed, or what the SEC means by ‘material impact’. There are millions of attempts on businesses daily, some unsuccessful, others partially so,” said Wisniewski.

“Without clearer definitions, the rules are open to interpretation which could either lead to over-reporting, distracting cyber professionals from their main task of network protection, or under-reporting, which could expose cyber professionals to personal liability.”

Overburdened security professionals

Another point of contention raised by (ISC)2 centers around new board oversight requirements outlined in the SEC’s recent changes. Under the new rules, businesses will be required to disclose annual reports on their security risks, cyber strategy, and governance practices.

Annual 10-K reports will be required to outline specific measures taken by organizations to identify and mitigate security threats, as well as insights on executive oversight of company security practices. 

Wisniewski said that these new rules “do not go far enough”, adding that the guidelines are ambiguous and could lead to increased pressure on practitioners as executives rely on staff for advice and guidance. 

As a result, the non-profit has called for the establishment of a “more formal framework for board oversight responsibilities”. 

“The ambiguity only creates more burden for overworked and under-staffed cyber security professionals, as boards and corporate leaders will increasingly rely on them for interpretation of the guidance,” she said. 

“So while we support collaborative efforts to protect consumers, the importance of cyber threats and the complexity of management requires very clear guidelines with detailed definitions so cyber professionals do not inadvertently fall afoul of well-intentioned regulation,” Wisniewski added. 

“Cyber professionals are looking for clarity, and this ruling falls short in that regard.”

Google CEO Sundar Pichai has admitted that potential AI-related harms are a serious cause for concern and “keep him up at night”. 

Pichai’s comments came in an interview with CBS’ 60 Minutes program in which the broadcaster delved into the ongoing work to develop AI systems at the tech giant. 

Pichai said the rollout of generative AI systems will have a profound impact on society, noting that ‘knowledge workers’ such as software developers, accountants, and writers, could be among the most at-risk professions due to automation. 

“This is going to impact every product across every company,” he said. “So that’s why I think it’s a very profound technology. AI will impact everything.”

When asked about the risks AI poses to society, Pichai warned that the current pace of development does raise concerns. 

Google has been locked in a battle with Microsoft in recent months, with both tech giants rolling out generative AI systems to support core product offerings.

‘Bard’, Google’s generative AI system, launched in February and has been positioned as a key competitor to OpenAI’s ChatGPT system, which Microsoft has been integrating across a number of services, such as its Azure cloud division. 

“If deployed wrongly, it could be very harmful,” he said. “The technology is moving fast. Does that keep me up at night? Absolutely.”

Aligning AI regulation

Pichai insisted that the development of new systems must be matched by regulatory safeguards to mitigate adverse effects. 

He noted, however, that the future of AI development and regulation should not be placed in the hands of a singular organization or group. 

“It’s not for a company to decide,” he told the program. “This is why I think the development of this [AI] needs to include not just engineers, but social scientists, ethicists, philosophers, and so on."

“I think we have to be very thoughtful and I think these are all things society needs to move along.”

Pichai’s comments on AI regulation follow a controversial open letter published last month calling for an “immediate pause” to AI development. 

The letter, signed by an array of tech pioneers, was published amid concerns that adequate regulatory safeguards were not currently in place to ensure systems would not cause societal problems. 

It warned that AI development is “out of control” and demanded a six-month pause so international regulators can respond to the pace of innovation. 

Lawmakers on both sides of the Atlantic have been exploring potential approaches to AI regulation in recent months.

Last week, the US National Telecommunications and Information Administration (NTIA) announced plans to explore “accountability measures” for companies developing AI systems. 

The NTIA said it will launch a public consultation on AI products and services in a move that could help shape the Biden administration’s approach to federal regulations. 

OpenAI has revealed a privacy flaw in its popular chatbot ChatGPT temporarily allowed users to see the conversation titles of other users in their chat history.

Users on Reddit and Twitter started reporting the bug on 20 March and shared screenshots indicating that their ChatGPT web history contained titles they didn't recognise.

While the contents of the chats do not appear to have been accessible while shared in this fashion, OpenAI pulled the chat history altogether while the bug was addressed.

On the same day, major ChatGPT outages were reported and those with access noted inconsistent service. OpenAI noted the outages on its status page, and restored service within hours of the initial reports

Sam Altman, CEO at OpenAI, tweeted that while the issue was “significant”, it has now been resolved.

Altman did not provide the name of the open source library in question, nor provide an exact percentage of affected users.

With millions of daily visitors, a privacy flaw affecting even a small percentage could have resulted in widespread data sharing, and Altman’s promised “technical postmortem” should address these concerns.

Each ‘chat’ a user has with ChatGPT is saved as its own instance in a user’s history, with a title decided based on the contents of the conversation.

On Monday, users found that their history contained titles pertaining to unfamiliar topics or functions, as well as titles written in other languages indicating that the flaw was a worldwide issue.

OpenAI may have to carefully outline its data protection policies and procedures, and reassure users that its open source supply chain is secure and will not lead to similar issues down the line

Some on Reddit have reported seeing other types of information, but did not provide verifiable evidence to back up these claims.

“I see someone else's phone number as the phone number tied to my account. I'm concerned but not concerned enough to quit the app,” stated one user.

Another alleged that they had signed up for ChatGPT Plus, the $20 (£16) per month subscription plan for the platform, under another email that had become linked to their account and as a result were not granted access to the service.

The bug came at a crucial time for the AI firm, which has just released its GPT-4 model. Users who are subscribed to ChatGPT Plus have access to the GPT-4 variant of the chatbot already, with OpenAI having promised “human-level performance”.

AI competitor Google launched its own chatbot Bard in the UK and US this week, with users able to sign up for open access through a waiting list.

After reportedly upending internal teams to compete with ChatGPT, Google has expressed hope that Bard, which is powered by an optimised version of its 540 billion-parameter large language model (LLM), LaMDA, will be quickly improved through user feedback.

Onlookers are already drawing comparisons between Bard and ChatGPT, which along with Microsoft’s GPT-4-powered Bing chatbot have emerged as the standout competitors of the new AI era.

While Microsoft and OpenAI have collaborated, Google has relied on its market dominance to buoy Bard’s chances.

The search giant has also been outspoken about the shortcomings of generative AI. In February, Alphabet chairman John Hennessy warned that Google had been “hesitant” to release Bard as it was still in development, and the blog post that announced Bard described it as an “experiment”.

In ITPro’s internal testing, the chatbot has operated similarly to earlier versions of Bing Chat, with fast response times for text generation but a tendency to engage in false or fictional outputs known as ‘hallucination’.

Meta has filed a lawsuit against US company Voyager Labs as the social media giant looks to crack down on 'data scraping for hire'.

In a complaint filed on Thursday, the social media giant requested that California judges impose a permanent ban on Voyager and prevent the firm from accessing its family of sites.

Meta claimed that the firm used “proprietary software to launch scraping campaigns against Facebook and Instagram”, as well as websites such as Twitter, YouTube, LinkedIn, and Telegram.

The social media giant said Voyager used 38,000 fake accounts to collect data on around 600,000 Facebook users, which included posts, comments, friends lists and information pertaining to their involvement in specific groups and pages on the platform.

Meta uncovered Voyager’s data scraping campaign in July 2022 after an investigation into the issue, and claimed that the US-based firm deliberately hid its activities from the social media giant.

The complaint also alleged that Voyager sold data obtained in the data scraping campaign to clients.

“Voyager used a diverse system of computers and networks in different countries to hide its activity, including when Meta subjected the fake accounts to verification or checks,” said Jessica Romero, director of platform enforcement and litigation at Meta.

“Our lawsuit alleges that Voyager has violated our terms of service against fake accounts and unauthorised and automated scraping. We are seeking a permanent injunction against Voyager to protect people against scraping-for-hire services.”

Data profiling

Voyager provides investigative software designed to help law enforcement obtain information on potential suspects. The company currently operates in the US, United Kingdom, Israel, Singapore, and the United Arab Emirates.

An investigation by The Guardian in 2021 revealed that the company previously partnered with the Los Angeles police department, and claimed that its software could be used to identify criminals and predict whether an individual may commit future offences.

Meta said Voyager provides scraping services to “anyone regardless of the users they target and for what purpose, including as a way to profile people for criminal behaviour”.

“This industry covertly collects information that people share with their community, family and friends, without oversight or accountability, and in a way that may implicate people’s civil rights,” Romero added.

Users affected by the data scraping campaign are believed to include employees at non-profit organisations, media companies, academic institutions and government agencies at both the state and federal level.

At present, it is unclear which Voyager clients benefited from the sale of user data.

The Voyager lawsuit follows similar data scraping complaints filed by the social media giant last year.

In July 2022, Meta filed separate actions against Octopus and defendant Ekrem Ateş for scraping data from Facebook and Instagram.

Octopus, which is a US subsidiary of a Chinese enterprise, was accused of building a cloud-based platform to provide customers with on-demand scraping software and services.

Similarly, an investigation revealed that Ekrem Ateş used automated Instagram accounts to scrape data belonging to more than 350,000 users.

Social media firms get tough on data scraping

The issue of data scraping on social media has been a long-running problem and one that recently saw Meta fined for failing to tackle.

Ireland’s Data Protection Commissioner (DPC) imposed a €265 million (£234 million) fine on the tech giant for failing to implement adequate safeguards after it was discovered that data belonging to 560 million users were exposed online.

Meta-owned social media platforms aren’t alone in contending with this issue, however.

In December, LinkedIn settled a lengthy court battle with US startup, hiQ, for conducting similar data scraping activities.

LinkedIn alleged that the firm scraped data from the professional networking site to gather data for its HR software.

'Confusion' over data scraping exacerbating issue

Caroline Carruthers, CEO and Co-Founder of data consultancy, Carruthers and Jackson, told IT Pro that the Meta lawsuit presents challenging regulatory considerations on both sides of the Atlantic.

Differing approaches to data privacy in the EU and United States, she noted, highlight the need for improved regulatory alignment.

"The act of data scraping is legal in the US, however in Europe it falls foul of GDPR," she said. "This is because data scraping involves taking data straight for a third parties' website without asking whether the users wish for their data to be used in that manner."

"Confusion around what is acceptable there and what isn’t acceptable here, further highlights the need for regulatory bodies to take a far more holistic approach to regulation, rather than a more nationalistic approach.

"Currently a business in Europe can pay a company in the US to perform a data scrape of a business in the EU and then buy the dataset, that means user data just isn’t safe, which is why there needs to be a move towards an agreed set of international standards, not the siloed approach we currently have.”

Carruthers noted, however, that the Meta lawsuit could mark a change in how social media companies approach the problem long-term.

“This could show a shift in the tide for social media businesses in their attempt to tackle the problem, however, that doesn’t mean they’re doing it for the right reasons. Businesses like Meta and Twitter operate on a business model of personal data being used to provide a personal experience and selling that data to create more personalised ads."

Attitudes towards data governance have shifted in the last 12 months from something that’s nice to have to a must-have, as businesses look to better measure and monetise their data.

Getting it right has never been more important, with disparate data estates growing and risks around regulatory enforcement, private litigation and company reputation becoming more prominent.

With this in mind, Giovanni Cervellati, research manager, European intelligent analytics and data strategies research at IDC Europe, says the majority of organisations are concerned about data loss, compliance breaches and lost opportunities. This has made data governance a priority as businesses look to boost data resilience, ensure continuous compliance and mitigate risks.

“Almost 70% of organisations view data privacy and security as key investment areas and 54% view data sovereignty, privacy and governance as factors to be addressed,” he notes.

Benefits of strong data governance

Good data governance helps organisations of all kinds to achieve their ideal business outcomes, ensure robust audit trails and improve decision-making. Saul Judah, VP analyst at Gartner, highlights a prime example.

“[One organisation] built business support by showing that its data and analytics transformation would enable the rapid calculation of crucial, cross-functional business KPIs,” says Judah. “The COVID-19 crisis showed the wisdom of this approach, and consequently, its data and analytics team was able to pull together crucial data to inform executive decision-making about the crisis in a short time.”

If an organisation isn’t implementing basic principles around data governance, then it’s hard to see how they can run an efficient business model and build and retain customer trust adds David Mason, information and fundraising compliance manager at the Salvation Army.

“If you’re not keeping accurate records, it is hard to see how you can effectively communicate with your customers,” he cautions, adding if you don’t tell people how you’re going to use their personal data, it shouldn’t be a surprise if they no longer want to hear from your organisation. As far as data protection goes, organisations should consider the priorities of the data subject first, and the business second.

“Most data governance is happening behind the scenes; we’ve got a strong framework in place for assessing and managing risk and recording processing activities,” he continues. “Our data protection officer (DPO) acts as the conduit between the business and the data protection regulator. Proof that our supporter-first approach is working can be highlighted by the fact that we receive very few complaints about our direct marketing activities – none about emails sent in 2021/22, and only 30-odd from over four million addressed mail packs in the same period.”

What’s in store for data governance in 2023?

In 2023, data governance strategies will be shaped around the growth of data volumes, cyber security threats, and the need to build digital trust.

Awareness around data governance is heightened

The pandemic accelerated a shift in attitudes, with data governance becoming a boardroom priority. The rise of hybrid working, for example, meant organisations needed to become more aware of data storage, data usage and data processing. This greater awareness is also essential to all businesses undergoing digital transformation projects.

Indeed, a digital or cloud transformation is all underpinned by data, says Waseem Ali, CEO of data recruitment agency Rockborne, and former head of data strategy at Lloyd’s of London. “Companies that don’t draw out the end-to-end flow of data across their systems and understand what’s happening to that data at different stages of its journey will struggle to make informed decisions,” he says.

More of the organisation is involved

According to Forrester’s 2022 data and analytics survey, 75% of organisations are expanding data literacy training, while 36% plan to have an executive in the role of head of data governance. With this in mind, “we predict that we will see more data governance discussions in organisations of all industries and sizes,” says Kim Herrington, a senior analyst at Forrester.

Gartner’s Judah reports seeing several major trends that support the move from data and analytics governance as a centralised, IT-led, asset-centric approach to a multi-style, business context-specific capability. These are adaptive governance, business outcome-focused governance, trust-based decision rights models, collaborative governance teams and platform-enabled governance.

“Allowed to materialise, these trends will enable data and analytics governance to become an effective change agent for transforming the organisation into a market-responsive composable enterprise,” Judah notes.

Keeping a watchful eye on legislation

A range of further legislative changes, meanwhile, are going to continue to add complexity to the governance landscape this year, says Will Richmond-Coggan, a data protection expert at law firm Freeths.

“These changes, together with wider-ranging enforcement activity and an ever-increasing public awareness of the rights individuals enjoy in connection with their data, will all continue to contribute to this taking a central position in the metrics by which a business’s success is judged,” he says.

Pitfalls to avoid in your data governance strategy

It’s important to remember there’s no “one size fits all” when it comes to data governance – an overly complex programme that’s a mismatch of risk and resource simply won’t work.

It’s also crucial to recognise that everyone in the organisation has a role to play and equip them accordingly. The key, though, is remembering this isn’t something that needs to be approached with suspicion or fear.

Good governance can lead to all sorts of improvements in terms of efficiency, better visibility of assets and processes, and increased confidence that when risks arise – either internally or externally – the business’s systems and processes are robust enough to withstand them says Richmond-Coggan.

“Approaching governance from that perspective will help to ensure that the work entailed is actually beneficial for the business and results in a governance regime which is living, supportive of the business’s wider strategic goals, and consequently more readily adopted as part of the organisation’s culture,” he concludes.

The Federal Communications Commission (FCC) has proposed an overhaul of 15-year-old legislation which could drastically shorten the amount of time telecoms firms have to report data breaches to customers and authorities.

Current laws require telcos to report breaches within a maximum of seven days after discovery to the relevant authorities, and customers can be notified as soon as possible after this period. Authorities that receive the breach reports include the United States Secret Service (Secret Service) and the Federal Bureau of Investigation (FBI).

However, this rule may be eliminated and reporting guidance changed to "as soon as practicable".

At present, customers can only be notified after this seven-day period and in the absence of any Secret Service or FBI objection. In the proposal, the FCC also suggests that customers should be made aware of a data breach “without unreasonable delay”, unless law enforcement has requested otherwise.

The definition of 'breach' would also be expanded under the proposed changes, to include “inadvertent access, use, or disclosures of customer information”. Since 2007, the FCC has only considered data breaches that have come about as a result of intentional access to data without or exceeding authorisation.

If the proposals are passed, this updated definition would impact companies who have suffered a breach as the result of negligence rather than a cyber attack, pulling them into scope, and could motivate US telcos to protect customer data more judiciously.

“The law requires carriers to protect sensitive consumer information but, given the increase in frequency, sophistication, and scale of data leaks, we must update our rules to protect consumers and strengthen reporting requirements,” said FCC Chairwoman Jessica Rosenworcel.

“This new proceeding will take a much-needed, fresh look at our data breach reporting rules to better protect consumers, increase security, and reduce the impact of future breaches.”

The agency has sought comment on the published proposals for 30 days. Specific insight was requested for changes such as the timeframe for reporting, and a precise definition of when a firm has “reasonably determined” that a data breach has occurred.

It also seeks to determine whether the contents of data breach notifications are sufficient, or whether there is additional information that carriers could provide.

The FCC cited other legislation such as rules set out by the Cybersecurity and Infrastructure Security Agency (CISA) requiring critical infrastructure owners to report cyber attacks within 72 hours, as well as GDPR which requires data breaches to be reported in the same timeframe.

As part of the comment period, the FCC has also openly questioned whether a numerical threshold for the number of customers affected by a breach before it needs to be reported might be beneficial.

It noted that smaller incidents may not constitute coordinated attacks on consumer data, and that such a threshold could free up the resources of both telcos and regulators currently strained by over-reporting of small breaches.

Australia is one country which has felt the brunt of the increased frequency and sophistication in cyber attacks during the past year,

Data breaches at Australian telcos have dominated headlines in recent months. Optus' incident in October was one such major case which led to ‘systemic ID problems’ for 10 million customers.

December also saw Australia’s largest telco Telstra suffer a major data breach as the result of an IT error, following an attack on a third party in October that leaked the data of 30,000 former and current company employees.

Reacting to the increased targeting of telcos in the region, the Australian government has increased the maximum fine for a breach from $2.2 million (£1.25 million) to $50 million (AUD) (£28.5 million), or the greater of the benefits obtained through the breach or 30% of company turnover across a specific period.

UK organisations are set to be able to share personal data with the Republic of Korea (ROK) by the end of the year, a year after the EU secured a data deal with the country.

The government said that sharing data without restrictions will help businesses in each country to operate and grow. The legislation, expected to come into force on 19 December, is estimated to reduce the administrative friction associated with cross-border data transfers and ease financial burdens for UK businesses by £11 million per year.

Additonally, the deal is also projected to increase exports to South Korea by £3.8 million a year, the government said.

Since the UK left the EU, it’s now independently able to strike data adequacy agreements with international partners, with this legislation representing its first decision to recognise an adequate “priority country” since then.

Other priority countries undergoing data adequacy assessments include the US, Australia, Singapore, the Dubai International Finance Centre, and Colombia. The government said it’s making "excellent progress" in assessing these countries.

With the legislation set to come into force on 19 December, it means it will be implemented a year after the EU and South Korea made a data adequacy agreement on 17 December 2021. Personal data has been able to travel between the EU and the ROK since then, without any need for further authorisations.

However, the UK government said that its adequacy decision with South Korea is broader than the EU’s deal. The biggest difference is that UK organisations will be able to share personal data related to credit information to help identify customers and verify payments.

The government said this will help businesses with a presence in the ROK to boost lending, insurance, and credit operations in the region.

“Before the end of the year, businesses will be able to share data freely with the ROK - safe in the knowledge it will be protected to the high privacy standards we expect in the UK,” said Julia Lopez, minister of state for media, data, and digital infrastructure. “Removing unnecessary burdens on businesses will help unleash innovation, drive growth, and improve lives across both our countries.”

The UK and the ROK agreed to a data adequacy agreement in principle in July 2022, and now the UK government has carried out an assessment of the ROK's personal data laws.

It concluded that the Asian country has strong privacy laws which will protect data transfers to South Korea. At the same time, it will also uphold the rights and protections of British citizens.

The government said that the legislation will open up opportunities for small and medium-sized businesses, who before may have avoided international data transfers to the country since they needed to have contractual safeguards in place, like data protection clauses.

Research and innovation are also expected to be boosted as experts can collaborate on vital research since barriers to data transfers have been removed.

The data integration tools market is seeing renewed momentum driven by requirements for multi-cloud and hybrid data integration and data fabric design patterns. Data and analytics leaders should use this research to evaluate suitable vendors for their existing and upcoming data integration use cases.

This whitepaper evaluates the core capabilities and functional requirements of current data integration tool vendors, ensuring they can offer organisations consistent access and delivery of data across a variety of data sources.

Download now to learn how the vendors measure up and why IBM is considered a leader in this field.

Provided by

Few things are more important than having quality data that is easy to use, but simultaneously secure and compliant. Being unable to fulfil this need can result in erroneous insights and reduced customer trust.

This whitepaper analyses several topics related to data governance and privacy such as scalability, establishing and implementing organisation-wide standards, and data lineage and traceability. Building blocks like data cataloguing, automated metadata generation, and reporting are also covered alongside a discussion of how governance and privacy are related to a data fabric.

Download now to learn more from real-world examples featuring ING.

Provided by

Organisations deploy a master data management (MDM) strategy to gain a single, trusted source of reliable information to deliver business value. Until recently, those seeking an MDM solution had to choose between a fullfeatured on-premises master data management platform or a more limited cloud-based solution.

For the agility to deliver results at the speed of innovation, you need an all-in-one MDM solution with the robust capabilities to meet all your end to-end requirements in the cloud.

This eBook describes why organizations are increasingly looking to move their MDM strategy to the cloud, and what to look for in a cloud based solution that can successfully support your MDM strategy.

Provided by

Data quality has traditionally been mandated to fulfill compliance and governance requirements and to reduce operational risks and costs. It's a competitive advantage that data and analytics (D&A) leaders must continuously engage with in order to achieve those goals.

The data quality management practice has been maturing in recent years and the vendor landscape is focused on addressing many of the market requirements. It covers much more than just technology. It includes workflow, roles, collaboration and processes (such as those for monitoring, reporting and remediating data quality issues).

Download this paper to learn why evaluating and selecting data quality solutions is much less of a specialized IT task than it was formerly. It now requires greater collaboration with business leaders and users.

Provided by

If you’re reading this, you’ve recognised that it’s time for data governance. The challenges that brought you here could be anything from compliance and customer centricity initiatives to productivity improvements and decision support, to name a few. Whatever your driver, one truth should be self-evident: you can’t lead data-driven digital transformation without end-to-end enterprise data governance.

But governing data across the entire enterprise is hard work. It’s a huge responsibility and it demands the involvement of many stakeholders. That’s why “just enough” data governance could be the right move for you.

Download this asset to discover why it’s all about reducing the scale of the data governance challenge by doing enough to earn early credibility that builds to critical mass.

Provided by

Governor of California Gavin Newsom signed a new bill into law on Thursday, that will work to bind social media firms to a series of data protection agreements pertaining to minors.

The bipartisan bill, titled AB2273, will bring into effect the California Age Appropriate Design Code Act (CAADCA). This legislates against the collection, selling or retaining of children’s personal information without the company attempting to do so having provided a persuasive reason that said activity is in the best interests of the children involved.

Social media firms will also be required to provide children on their platforms with accounts set to the highest available privacy level, in order to provide children with data protection by design. Additionally, terms of service, privacy policies and other such notices will be required to be provided in what the bill defines as “clear language suited to the age of children likely to access that online service, product, or feature.”

Tech companies will have until July 1 2024 to ensure that they are compliant with the bill’s data protection requirements, and will be required in advance to conduct a data protection impact assessment (DPIA) for any service that a child can access. Those that negligently violate the legislation could face a fine of up to $2,500 per affected child, or up to $7,500 per affected child in the case of intentional violation.

Unlike the EU and UK, which have legislation such as General Data Protection Regulation (GDPR) and the Data Protection Act (DPA) respectively, the USA lacks federal data protection laws. As a result, the privacy legislation and precedent that firms must follow varies state-by-state.

However, given the importance of California within the US as a tech hub, as well as the relative strictness of its privacy and consumer protection laws, it is often regarded as a data protection beacon that other states follow. In 2020, the California Consumer Privacy Act (CCPA) was brought into effect, giving Californian consumers the right to know what data is being collected about them, and to opt out of data collection and request deletion at any time.

The CCPA also sets out a broad definition of personal information, including data that can uniquely identify an individual, biometric information, geolocation, or any “inferences” drawn from data within the definition to create a profile on a consumer’s individual needs or behaviour. The final category impacts upon AdTech practice most directly.

The CAADCA will also force social media firms to explain the necessity and safety of systems such as their recommendation algorithms, stating that DPIAs undertaken by firms in line with the legislation need to question “whether algorithms used by the online product, service, or feature could harm children.” Some legislators in the UK have been similarly concerned, and earlier this year a group of watchdogs assessing algorithms were announced.

The UK government’s proposed Online Safety Bill includes several clauses that address the use of algorithms, both in regards to their use in spreading disinformation and the risks that they present to children’s safety. However, this bill is currently ‘on ice’, and has not been re-introduced to parliament since new PM Liz Truss announced plans to amend the bill to prioritise free speech.

“We’re taking aggressive action in California to protect the health and wellbeing of our kids,” said Newsom, in a statement to the press.

“As a father of four, I’m familiar with the real issues our children are experiencing online, and I’m thankful to Assembly members Wicks and Cunningham and the tech industry for pushing these protections and putting the wellbeing of our kids first.”

Oracle has entered into an agreement with TikTok to receive the entirety of the social media firm's US user data, as well as perform data management and auditing services for the company.

Under the arrangement, first reported on by Axios, all US TikTok data will be sent through Oracle’s cloud infrastructure, with an eventual goal for TikTok to delete US user data from all its servers and fully migrate this to Oracle cloud servers.

Oracle will also be given access to TikTok’s content algorithms, as well as conduct audits on both manual and automated content moderation systems. With over 80 million users in the US, the deal represents a serious undertaking for Oracle.

Oracle regularly audits data, but governance on this scale is unusual. TikTok’s stated goal to hand all US data to Oracle’s servers and continually work with the cloud giant to improve its data signals a willingness by the company to more firmly situate itself in the US tech sector, and move away from its central hosting in Singapore.

The deal comes almost two years after TikTok was forced to enter discussions with Oracle after former President Trump mandated the company to consider divestment options or face a total ban in the US over national security concerns.

TikTok and its parent company ByteDance have been the subject of controversy in recent months. In June, the FCC commissioner publicly urged Apple and Google to delist the app from app stores, citing concerns over TikTok’s access to sensitive data, while in July Buzzfeed News alleged that China-based ByteDance employees have accessed US tiktok user data.

TikTok reasserted its dedication to transparency in July, with the announcement of a new API for researchers.

There had initially been discussions over Oracle buying US operations of TikTok outright, alongside a proposal by Microsoft for a similar acquisition. In June, TikTok made a blog post addressing its governance strategy with regards to user data and the agreement with Oracle.

“For more than a year, we've been working with Oracle on several measures as part of our commercial relationship to better safeguard our app, systems, and the security of US user data,” the company stated.

“In addition, we're working closely with Oracle to develop data management protocols that Oracle will audit and manage to give users even more peace of mind.”

IT Pro has approached Oracle for comment.

Oracle is set to launch new sovereign cloud regions in the European Union (EU) in 2023, aiming to help customers meet data requirements policies.

The first two sovereign cloud regions for the EU will be located in Germany and Spain, with operations and support restricted to EU residents and specific EU legal entities. The new regions will also be logically and physically separate from the existing public Oracle Cloud Infrastructure (OCI) regions in the EU. Currently, OCI operates six of these regions in the EU: Amsterdam, Frankfurt, Paris, Marseille, Milan, and Stockholm.

Oracle plans to offer all of its OCI services through the regions as well as the European Union Restricted Access (EURA) application services. Pricing for OCI services will be the same in existing OCI regions, and EURA pricing will remain unchanged, with the same levels of support and financially backed SLAs. Customers will be able to use Oracle Universal Credits to purchase services and participate in OCI programmes too.

The company said that both private companies and public sector organisations across the EU will be able to use the new Oracle Cloud Infrastructure (OCI) sovereign cloud regions to host data and applications that are sensitive, regulated, or of strategic regional importance.

“Having cloud services with data centres that are located in the EU, and operated, updated and supported by EU residents, while maintaining isolation from non-EU cloud regions is an important part of our cloud adoption,” said Jarkko Levasma, government CIO, director of the General Ministry of Finance of Finland. “This will open up possibilities to adopt Infrastructure, platform and software as a service in Finland for the government.”

OCI’s sovereign cloud will restrict operations and customer support responsibilities to EU residents, building on its already general policy of not moving customer content from regions customers select for workloads. The sovereign clouds have been designed to help customers align with relevant EU regulations and guidance, said the cloud giant.

Oracle plans to migrate customers using Oracle Fusion Cloud Applications within the existing EU Restricted Access cloud service to the new OCI sovereign cloud regions.

The cloud giant said it is aiming to introduce the new regions as countries are placing more requirements on data within their borders, with organisations asking their global cloud providers for more transparency and control over how and where their data is stored, handled, and secured.

“Our customers tell us they want the benefits of cloud but have requirements for where data is located, the regulations they must meet, and the personnel operating the underlying infrastructure,” said Scott Twaddle, vice president of Oracle Cloud Infrastructure Product and Industries.

Twaddle added that the company already operates government regions in the UK and North America and has deployed its first OCI Dedicated Region, serving highly-regulated companies and governments around the globe.

Oracle isn’t the only company with plans to launch a sovereign cloud, as Microsoft won a contract to develop one for Singapore in February earlier this year. Singapore’s Home Team Science and Technology Agency (HTX) chose the tech giant for the job, saying the sovereign cloud would help play a key role in helping domestic services to deliver improved safety and security to all citizens.

The European Parliament has voted to approve the new Digital Markets Act (DMA), a new landmark piece of antitrust legislation designed to keep big tech giants from suppressing market competition.

Approved by an overwhelming majority, the DMA sets out a new framework of obligations for large online platforms that act as “gatekeepers” – or platforms that are difficult for consumers to avoid due to the size of their presence and reach.

The EU said the aim is to ensure a “fairer business environment” with more competition, as well as greater choice for consumers.

Reigning in big tech

To quell what it deems unfair business practices, the DMA now requires tech companies to allow third parties to inter-operate with their own services. This will allow smaller platforms to request that dominant messaging services enable their users to communicate with each other – ultimately avoiding being “locked-in” to one app.

Tech behemoths such as Apple, Google, Amazon, Facebook, and Microsoft will also now be required to allow business users access to the data they generate to promote their own offers and conclude contracts with customers outside of the host platform, the EU said.

Crucially, it means gatekeeping platforms will no longer be able to give preferential treatment to their own products by automatically ranking them above third parties – a move the EU has been edging towards for some time.

Neither will they be allowed to prevent users from easily uninstalling preloaded software or using third-party applications and app stores.

That means the likes of Apple, who are particularly renowned for locking consumers into their ecosystem, could be forced to allow users to install alternative app stores in the EU – although some critics have already suggested this move could lead to an increase in malware and cyber-attacks.

Additionally, tech companies will not be permitted to process users’ personal data for targeted advertising unless they have explicit consent to do so.

The DMA has already drawn criticism from some quarters. Back in March, an Apple spokesperson told IT Pro that the company was concerned that some provisions will “create unnecessary privacy and security vulnerabilities for our users” while others would prohibit the company from “charging for intellectual property in which we invest a great deal."

Implementing the DMA

The DMA will be formally adopted in the EU later this month and will start to apply six months from its implementation. Gatekeeping platforms will have a maximum of six months after they have been designated to comply with the new rules. Those that violate the new rules will face fines of up to 10% of their annual global turnover.

Andreas Schwab, rapporteur for the Digital Markets Act, said the legislation’s successful implementation will help create a better pool of companies based on the quality of the product, rather than their financial strength.

“We no longer accept the "survival of the financially strongest". The purpose of the digital single market is that Europe gets the best companies and not just the biggest,” he said. “This is why we need to focus on the legislation’s implementation.”

To do so, the European Commission has set up a task force which is expected to consist of about 80 officials and last month put out a 12 million euro ($12.3 million) tender to acquire experts to help with compliance over a four-year period. There will also be a new European Centre for Algorithmic Transparency to help attract data science, experts and algorithm scientists.

“We need proper supervision to make sure that the regulatory dialogue works,” Schwab added. “It is only once we have a dialogue of equals that we will be able to get the respect the EU deserves; and this, we owe to our citizens and businesses.”

What is the Digital Services Act (DSA)?

Alongside the DMA, the European Parliament also voted in the Digital Services Act (DSA), which seeks to combat the spread of illegal content, online disinformation, and other societal risks.

It means that from September, social media and marketplace platforms will be required to be more rigorous in the battle against such threats, incorporating new obligations to respond faster, strengthen marketplace checks, increase transparency, and ban misleading practices.

Businesses that fall foul of the DSA will face fines of up to 6% of annual global turnover.

Auditing is an independent consulting activity, intended to help organisations improve their operations, as it evaluates ways to improve risk management. However within the technology industry, auditors are being replaced by automation, and with CFOs looking to reduce spending, the function of audit and compliance could become obsolete.

The audit process needs to change for the better, and with emerging technology, there’s great potential for auditing to adapt and drive real value in relation to data analytics and risk management monitoring.

Download this whitepaper to learn where audit technology is headed, and what it means for your organisation.

Provided by

Key risk indicators (KRIs) can help predict adverse events that may impact your organisation and are widely considered an essential part of good governance. These indicators link to a range of operational risk-management activities and processes, making them especially beneficial as metrics of changes in a company’s risk profile.

Here, you’ll learn how to implement, manage and maintain KRIs within your IT department:

• Choosing appropriate KRIs can benefit your organisation
• Examples of effective KRIs
• KRIs/KRI selection worksheet
• Implementing automated reporting

Provided by

Google is introducing new options to reject tracking cookies in Europe after EU regulators found its existing pop-ups to be in violation of its data laws.

The new cookie banners will give 'clear' and 'balanced' choices, the tech giant said, though most Google users might not notice the change.

For anyone using Google Search or YouTube in Europe (while signed out or within the incognito mode), there will be "equal" choices with 'reject all' and 'accept all' buttons on the first screen. Users can also select a "more options" button to customised their level of consent. The buttons have been launched in France and will soon be seen across the rest of the European Economic Area - including the UK and Switzerland.

The use of cookies banners, in general, is far from ideal as it still remains a muddled and frustrating experience for most web users. For Google specifically, many users simply won't see the updated popup as it will only work if they are logged out of Google accounts, as they'll most likely have their settings already stored. In essence, this new banner is largely going to be used by those without a Google account.

The move follows a €150 million fine from the French data protection agency (CNIL), which found Google's cookie banners to have confusing language. Google previously allowed users to accept all tracking cookies with a single click, but it would then direct users through extra steps to "reject all". CNIL said this was unlawful as it forced users into accepting cookies for the benefit of Google's advertising business.

"Based on these conversations and specific direction from France's Commission Nationale de l'Informatique et des Libertés (CNIL), we have now completed a full redesign of our approach, including changes to the infrastructure we use to handle cookies," Google's product manager of privacy, safety and security, Sammit Adhya said in a blog post.

Research into the UK public’s perception of artificial intelligence (AI) has revealed that people still view the technology as “scary and futuristic”, while feeling comfortable about some of its most basic applications in current use.

The UK government’s Centre for Data Ethics and Innovation (CDEI) published its findings after surveying a broad selection of the public on matters concerning data use, data security, and AI.

The report showed that a third (32%) of people expressed discomfort with the idea that AI is used to recommend web pages in Internet search results. Respondents were also near-equally split on their perception of AI use in the job market to decide which candidate should get an interview, with 45% of people saying they’re comfortable with the idea.

Digital familiarity played a role in the findings, with lower technological understanding broadly correlating to increased feelings of worry and fear related to AI.

The report highlighted media coverage of AI and other data-related issues as a key driver in the public’s negative perception of the technologies and the potential for innovation using them. The government came only second to social media companies when looking at the organisations that the public least trust with their data.

Highlighting some of the top stories in the latter half of 2021, like the NHS’ plan for wider data sharing and various facial recognition stories, the CDEI said the sentiment in the news was more frequently negative than positive.

In the case of NHS’ push to implement the General Practice Data for Planning and Research (GPDPR), the media echoed wider calls from healthcare and privacy experts to halt the initiative. More than a million opted out of the program, which was ultimately shelved as a result.

The most-read data-related stories included various data breaches from the likes of the Labour Party, the government’s New Year Honours list, the Afghan interpreter breach, T-Mobile, and British Airways.

AI was represented more positively than data sharing, for the most part, with stories about it helping dementia diagnoses and advanced debating capabilities among the most popular for the year.

Data has been more of a focal point in society in recent years and the Cambridge Analytica scandal shone a light on the dangers involved in mishandling personal data at a corporate level.

Since then, the UK has seen numerous data protection initiatives and legislation installed in a bid to win over public trust and alleviate concerns about how personal data can be used to provide better products and services to end-users.

Despite the strengthened efforts to uphold data security in the UK, the public remains uncertain about how data is used and the CDEI said these concerns must be addressed “for the full potential of data to be realised”.

“People report feelings of uncertainty about current data practices and fairly limited knowledge regarding how data about them is used and collected in their day-to-day lives, demonstrating the opportunity and importance of meaningful transparency about data use by organisations,” the report read.

“This uncertainty, alongside perceived risks around data security, data control and data accountability are barriers that must be overcome to build confidence in data use.”

Most people (52%) said they don’t have a strong understanding of how their data is being used or how it’s collected in the normal course of living their digital life, despite 93% of all respondents indicating they use the Internet either most days or every day.

Data security is seen as the most pressing issue, but despite their confused outlook on data use in society, people are broadly happy with their data being used in a variety of contexts, particularly for personal benefit or to improve the lives of others, according to the report.

The use of data in the government’s COVID-19 response was one of the most positive applications of wide data sharing, the survey showed, though concerns were raised around how the current level of data sharing and collection that exists today benefits all areas of society.

Almost a third of people (31%) said they thought data would adversely impact all groups in society and 28% said they felt AI was having a negative effect on ethnic minority groups.

AI has been known to show biases of many types and has led to the likes of Twitter opening up its algorithm in the hope that increased scrutiny would help stamp these out.

AI is a technology that’s also used alongside machine learning and machine vision to power facial recognition, a beleaguered technology plagued with stories of racial bias across worldwide law enforcement and government applications.

IT teams are tasked with ensuring their organisation has the right infrastructure to support its business applications, while developers develop and support these apps. These two areas often collaborate in order to achieve business targets, but this collaboration doesn’t come without its challenges.

DevOps can alleviate these issues by bringing together development methods, extensive testing, governance and automation, for continuous integration and delivery. However legacy IT infrastructure can hinder its agility unless IT teams are committed to its evolution.

Download this whitepaper to learn why investment in the modernisation of legacy storage infrastructure results in greater DevOps efficiencies.

Provided by

More than half of public sector leaders believe that their organisation’s data is stored on infrastructure that is not fit for purpose.

A survey of 200 UK public sector decision makers across central and local government, health and social care, emergency services, education, and defence organisations, commissioned by NetApp, found that cloud growth will accelerate and investment in skills will increase over the next 12 months.

While 56% of leaders think their data infrastructure isn’t fit for purpose, 47% of respondents believe that building a platform to implement more ambitious data strategies and deliver digital services will require additional investment.

However, 75% of public sector leaders believe that the National Data Strategy, which aims to consolidate the country’s position as a global digital leader through data, is imperative to the UK’s future economic growth. 73% of respondents said that it will help the UK cement its position as a global digital leader.

79% of public sector leaders also said that their organisation has a policy for how it uses data that is aligned to the data strategy. 87% also said that they will maintain or grow their expenditure in the cloud, with 53% expecting to increase usage in the next 12 months.

NetApp said the study shows that cloud and data strategies are maturing across the public sector. Although 79% of organisations currently store data in the cloud, only 30% consciously adopt a cloud-first approach. When modernising their infrastructure, leadership remain pragmatic in their selection criteria to ensure their choices deliver the best performance at the lowest cost, said NetApp.

Public sector organisations also acknowledged the need to adapt culturally and to upskill employees to deliver on the National Data Strategy’s aims. 69% said their organisation must change its culture to transform digitally, while 63% think further employee training and support from senior management is required to meet digital objectives in 2022.

What's more, 65% of leaders also believe digitally upskilling existing employees will help their organisation overcome shortages in technical skills across the UK.

“Public sector organisations experienced tremendous digital acceleration in response to Covid-19, and continuing the progress made by increasing their capabilities to use and share data will be fundamental to shaping the UK’s recovery over the next 12 months,” said Tim Skinner, UKI head of public sector at NetApp.

“Modernising infrastructure, continuing cloud migration, and equipping employees with sufficient digital skills will enable this, but the National Data Strategy is an essential piece of the puzzle, providing clear direction for creating a truly digital society.”

The government’s existing data strategy was insufficient to maintain the momentum built during the COVID-19 pandemic with regards to how local authorities use data to transform public services, warned the Centre for Data Ethics and Innovation (CDEI) a year ago. Despite that the pandemic had led to substantial positive developments when it came to the way local government uses data, it risked being undermined by a narrowly-focused set of measures that won’t guarantee any long-term positive changes as we move beyond the pandemic.

Texas, Indiana, Washington State, and the District of Columbia sued Google on Monday, claiming the company’s location tracking practices invade users’ privacy.

The bipartisan coalition of attorneys general said that Google deceptively led consumers to gain access to their location data, including making it nearly impossible for users to stop their location from being tracked.

Ken Racine, attorney general for the District of Columbia, said that Google has systematically deceived consumers about how their locations are tracked and used since 2014, and has misled consumers who believe they can control what information the tech giant collects about them.

Racine underlined that, in reality, there is no way for consumers to prevent Google from collecting, storing, and profiting from their location data. With the lawsuit, the attorney general is aiming to stop Google’s alleged deceptive and unlawful practices, ensure the company cannot undermine consumers’ ability to protect their privacy and seek penalties for the violations.

“I’m proud to lead this bipartisan group of attorneys general that will hold Google accountable for its deception,” said attorney general Racine. “Through this lawsuit, we will hold Google accountable, and in the process, educate consumers on how their personal data—particularly sensitive data about their physical location—is collected, stored, and monetised. This result of our collective action is that consumers, not Google, will determine how their data is or is not used.”

Racine added that Google’s business model relies on the constant surveillance of its users, with the company collecting and analysing personal and behavioural data from billions of users. He said that Google then builds detailed user profiles and sells highly targeted advertising. Location data is a key part of this business, said Racine, and is among the most sensitive and valuable information the company collects.

"The Attorneys General are bringing a case based on inaccurate claims and outdated assertions about our settings,” a Google spokesperson told IT Pro.

“We have always built privacy features into our products and provided robust controls for location data. We will vigorously defend ourselves and set the record straight.”

This isn’t the first time Google has faced a lawsuit over its location tracking, as in May 2020 the attorney general of Arizona also sued the company. The lawsuit alleged that the tech giant illegally tracked Android users’ locations without their consent, even if they had manually disabled their device’s tracking features.

The attorney general claimed that the company broke the state’s consumer-protection laws as it built its software in a way that deceived device owners and ultimately led to the endowment of its advertising empire.

DataOps is the key to leveraging data for competitive advantage, but success depends on the establishment of a strong functional infrastructure.

The foundation for DataOps requires an integrated storage and data management platform to unify the capture, storage, movement, classification, ingestion, and protection of data to make it available for high-value data engineering and data leverage purposes.

Download this resource to understand how to tackle the challenges presented by data growth and how to overcome them for greater agility.

Provided by

The EU's proposed Data Governance Act (DGA) has been provisionally agreed by the European Council and European Parliament which could bring an innovation boost to the Bloc's data economy.

The DGA promotes the sharing of protected public-sector data between companies in the EU and aims to provide a trustworthy environment through which innovative products and research can be produced.

It will introduce robust mechanisms such as digital platforms which can be used to purchase data for 'altruistic projects', the Bloc said on Tuesday.

It’s thought such data can be bought and re-used at a faster rate by EU member states to accelerate the development of projects for the common good, like medical research.

There is also a belief in the EU that the potential for artificial intelligence (AI) development cannot be unlocked without data sharing.

"The Data Governance Act is a major milestone that will boost the data-driven economy in Europe in the years to come," said Boštjan Koritnik, Slovenian minister for public administration, and president of the European Council. "By enabling control and creating trust, it will help unlock the potential of vast amounts of data generated by businesses and individuals.

"This is indispensable for the development of artificial intelligence applications and critical for the EU’s global competitiveness in this area. Data-powered innovations will help us address a range of societal challenges and drive economic growth, which is so important for the post-COVID recovery."

Data made available on these digital platforms will be subject to the rights of others and includes categories such as trade secrets, personal data and data protected by intellectual property rights.

The EU said individuals and companies whose data will be made available on these platforms, known as data intermediation services, will have full control over their data and share it only with clients they trust.

Data intermediation services will also have to be listed on an official register to be able to operate - a measure the EU hopes will foster greater trust in the initiative.

"The law will be used to structure data sharing between organisations and member states in a more open and controlled way than is currently possible," said Peter Galdies, senior consultant at DQM GRC.

"Importantly, the obligation to meet the requirements of pre-existing data legislation still exists. It does not attempt to run roughshod over laws like the GDPR, but instead more clearly allocates responsibilities and measures that may have to be met to allow such sharing to take place."

The core principles of the General Data Protection Regulation (GDPR) will be at the heart of each data transaction on these digital platforms. Data intermediaries will not be able to share or sell data for any other purposes outside of what's agreed by the original stakeholders but will be allowed to charge for each transaction.

Public sector bodies will be prohibited from creating exclusive rights for the re-use of certain data and exclusive agreements will have to be limited to a maximum of 12 months, or two-and-a-half years for existing agreements.

"We are at the beginning of the age of AI and Europe will require more and more data," said lead MEP Angelika Niebler. "This agreement should make it easy and safe to tap into the rich data silos spread all over the EU.

"The data revolution will not wait for Europe. We need to act now if European digital companies want to have a place among the world’s top digital innovators."

The UK government has developed an algorithmic transparency standard that aims to eliminate biases in artificial intelligence (AI) applications.

The standard was built by the Cabinet Office's Central Digital and Data Office (CDDO), along with the Centre for Data Ethics and Innovation (CDEI), and will now go through a pilot scheme to identify weaknesses to improve it further.

The government said the UK is now one of the first countries in the world to build such a standard which aims to make it easier to scrutinise AI models' algorithmic decision-making and ultimately build public trust in the technology.

For years, there have been calls from many corners of the technology industry for transparency in AI's algorithmic decision-making including from the likes of the Alan Turing Institute and Ada Lovelace Institute.

The news has been warmly welcomed and there are hopes the standard may influence AI in the private sector too.

"Organisations are increasingly turning to algorithms to automate or support decision-making," said Adrian Weller, programme director for AI at The Alan Turing Institute and member of the Centre for Data Ethics and Innovation’s Advisory Board. "We have a window of opportunity to put the right governance mechanisms in place as adoption increases.

"This is why I’m delighted to see the UK government publish one of the world’s first national algorithmic transparency standards," he added. "This is a pioneering move by the UK government, which will not only help to build appropriate trust in the use of algorithmic decision-making by the public sector, but will also act as a lever to raise transparency standards in the private sector."

The development of the standard follows a CDEI review into biases in algorithmic decision-making which recommended the UK government to mandate a transparency obligation on public sector organisations with respect to decisions made on individuals.

Several government departments will be involved in the pilot scheme over the coming months before the CDDO asks for formal endorsement from the Data Standards Authority later in 2022.

This move delivers on commitments made in the National AI Strategy and National Data Strategy, the government said, and it believes the move will strengthen the UK's global leadership on AI governance and trustworthy AI.

The government will be publishing data from pilot for the public and experts to engage with, hoping additional oversight will increase external scrutiny and lead to greater transparency.

"We need democratic standards and good governance for new technologies, such as AI, that will enhance the way we work and benefit society," said Sir Patrick Vallance, chief scientific adviser and national technology adviser at the UK government.

"The launch of this new standard demonstrates this government’s commitment to building public trust and understanding of the application of these technologies, including exploring increased transparency in public sector use of algorithms."

Last year the Home Office scrapped an AI tool it used in the immigration process after it was accused of being racially biased, creating a "hostile environment" in the visa application process.

Algorithmic bias infamously came to the fore in the private sector when Apple announced its Apple Card in 2019 when a number of users claimed they were unfairly offered lower credit limits than others.

A third (32%) of UK workers are now being monitored at work using technology like tracking software and remotely controlled webcams.

The issue has worsened over the past six months, when workers being monitored stood at a quarter (24%) of those polled by Prospect.

The sharp increase comes amid a huge jump in webcam monitoring, with 13% of homeworkers currently being surveilled by their employer through their work-issued device. The figures have more than doubled in the past six months as just 5% of workers were monitored via video in April 2021.

The vast majority of those questioned thought the use of webcam monitoring by employers should either be banned (52%) or regulated (28%). Just 8% of employees reported feeling that employers should be able to monitor their webcam's image at will.

Younger workers are thought to be particularly at risk of higher rates of monitoring by employers. Defined by an 18-34 age bracket, 48% of younger workers are believed to be monitored at home by employers, including 20% of those being monitored using a camera.

The latest findings have prompted Prospect to launch a campaign to help drive unionisation in the tech sector as it is affected by the recent upward home surveillance trend due to high levels of remote working and low levels of trade union membership.

Home surveillance will be investigated alongside other issues affecting the industry such as a culture of working long hours, workplace discrimination, and pay.

"We are used to the idea of employers checking up on workers, but when people are working in their own homes this assumes a whole new dimension," said Mike Clancy, general secretary at Prospect. "New technology allows employers to have a constant window into their employees homes, and the use of the technology is largely unregulated by government.

"We think that we need to upgrade the law to protect the privacy of workers and set reasonable limits on the use of this snooping technology, and the public overwhelmingly agree with us. Prospect’s new tech workers sector will be campaigning on this issue and other issues affecting tech workers, and I encourage any workers who are worried about monitoring to join Prospect and support our campaign."

The Information Commissioner's Office (ICO) is currently reviewing guidance for employers on the use of technologies such as employee monitoring.

“People expect that they can keep their personal lives private and that they are also entitled to a degree of privacy in the workplace," said an ICO spokesperson to IT Pro. "If organisations wish to monitor their employees, they should be clear about its purpose and that it brings real benefits. Organisations also need to make employees aware of the nature, extent and reasons for any monitoring.

“We are currently working on updating our employment practices guidance to address the changes in data protection law and to reflect the new ways employers use technology and interact with staff.”

Workplace monitoring saw a steep rise over the course of the pandemic which saw the nations' workforce largely adopt a work from home policy.

Some business managers report using the technology to 'feel closer to their workforce' and have reported using the tools for good, offering bonuses and promotions for demonstrably good work.

Questions around the privacy and ethical issues of the technology's use remain, however. Jim Killock, executive director at Open Rights Group, said to IT Pro: "employers think they have a free pass to monitor as they like, but they do not. They have to consider and consult about the impacts on workers, whose dignity and interests must be preserved. Employers are required to be transparent and accountable.

“The government plans to scrap such restraints in their current GDPR consultation, but people should get on and use their rights," he added.

The sentiment is echoed by Chi Onwurah, MP and shadow digital minister, who said: “This deeply worrying research shows just how anxious many people are about the use of invasive surveillance whilst they work. Ministers must urgently provide better regulatory oversight of online surveillance software to ensure people have the right to privacy whether in their workplace or home.

“The bottom line is that workers should not be subject to digital surveillance without their informed consent, and there should be clear rules, rights and expectations for both businesses and workers,” she added.

Hundreds of football players have threatened to take legal action against companies that use their performance data, claiming this practice is in violation of GDPR.

850 players, led by former Leyton Orient manager Russell Slade, have demanded compensation for the trading of their data over the past six years, according to the BBC.

The data is a mixture of statistics, such as goals-per-game and physical information like a player's height, all of which is being harvested and used by 17 unnamed data collection, betting and entertainment firms, according to letters sent by Slade and the players.

Slade has previously expressed concern around the collection of performance data, and his legal team said the fact players do not receive payment for the unlicensed use of their data is actually in violation of GDPR. This could fall under Article 4 of the legislation where "personal data" refers to a range of identifiable information, such as physical attributes, location data or physiological information.

Although the letter has been sent to an initial 17 firms, Slade's Global Sports Data and Technology Group has actually highlighted more than 150 companies it believes have misused this type of data. If legal action is taken and the group is successful, it could herald sweeping changes for a multi-billion pound industry.

Slade's work here seems mostly for the benefit of lower league players - those outside of the lucrative Premier League - with the practice potentially affecting both the men's and women's game.

"It's incredible where it's used," Slade said to the BBC. "On one player, and I'm not talking about a Premier League player or even a Championship player, there were some 7,000 pieces of information on one individual player at a lower league football club.

"There are companies that are taking that data and processing that data without the individual consent of that player. A big part of our journey has been looking at that ecosystem and plotting out where that data starts, who are processing it, where it finishes and that's a real global thing. It's making football - and all sports - aware of the implications and what needs to change."

Regardless of any legal action, footballers should invest in cyber security insurance with additional layers of data protection, according to Niamh Muldoon, global data protection officer at OneLogin.

"In reality, no footballer should be operating without it," Muldoon told IT Pro. "Along with employing a personal cyber security/data protection advisor who will alert them of the latest threats while they keep focused on playing football. This will help protect their data, as well as digital identity from misuse or abuse.

"A core component of this is having cyber security and data protection terms outlined in all contracts that their agent puts in front of them, allowing them to see transparently how their data is being collected, protected and used. This will aid them in making informed risk-based decisions when entering into contractual agreements."

This case raises interesting questions over what is personal data and to what extent can the individual protect it, according to Frank Jennings, a lawyer who specialises in cloud and GDPR-related cases.

"When a player in an organised club scores (or doesn't score), that becomes a statistic and is logged in the annals of the club and, for the more prominent clubs and players, is often reported as news," Jennings explained to IT Pro. "The fact a goal was scored is not of itself personal data, but it is when attributed to the player who scored. Organised clubs are usually played in front of fans and usually anyone can watch a match when they buy a ticket. Just because that personal data is in the public domain doesn't mean that GDPR doesn't apply. But player consent is not the only basis on which data may be processed. It may be possible to rely upon another ground such as legitimate interest or the exception of public interest. Players can usually prevent unauthorised exploitation of their image.

"We await to see whether they can protect statistical information too," Jennings added.

DataCamp has begun to offer free data literacy courses to all Degreed users.

DataCamp and Degreed develop comprehensive learning programs tailored to enterprises’ needs. Extending their partnership, DataCamp is offering free access to three interactive online courses: Data Science for Everyone, Machine Learning for Everyone, and Data Engineering for Everyone.

The courses require no prior coding experience, making them an ideal choice for organizations undergoing or planning an enterprise-wide digital transformation. Essentially, the courses are suitable for all skill levels and roles.

Degreed clients with Edit Settings permission can access DataCamp’s free courses through the Provider's tab or by contacting their Client Experience partner. There’s also the option to upgrade for full DataCamp access.

The “Data Science for Everyone” course includes 15 videos and 48 exercises on data science, data collection and storage, time series analysis, and A/B testing.

“Machine Learning for Everyone” lets users discover intelligent technologies behind self-driving cars and always-on customer experience tools.

Lastly, “Data Engineering for Everyone” explains data engineers’ core responsibilities via Spotflix, a fictional music-streaming firm. Each course takes two hours to complete.

DataCamp CEO and co-founder Jonathan Cornelissen said, "There is incredible power in data—but only if you know what to do with it. All departments and roles must have the skills to analyze that data to extract meaningful insights. Through our renewed partnership with Degreed, we are proud to provide their clients with free access to the powerful data skills they need to make better decisions, better serve their customers, and drive business growth."

"Data is core to every organization and that means everyone must have a baseline understanding of data. We're excited to offer all Degreed clients the DataCamp training, to empower their people ready for the data-driven future and ensure everyone knows how to use data effectively in their work," commented Rob Wellington, director of experience partnerships at Degreed.

The UK government is seeking expert advice on data maturity models as it looks to implement a single system across its departments.

The 'Data Quality Hub' is currently working with the Data Standards Authority to develop a system that can be easily understood and used by ministers and civil servants.

Data maturity models refer to tools and procedures that help organisations measure and monitor their data capabilities - how they collect, store and use it - and provide methodologies for ways to progress these abilities and move the business forward.

Some companies, for example, might find that they create vast amounts of data but only use a small percentage of it. A maturity model could help highlight what systems they could use or how they could use current ones more efficiently.

The government is now looking to consult with business leaders and IT decision-makers about what should be included in such a model, what challenges there are with establishing one, how it should be assessed, and which person in an organisation is best placed to manage this process.

The consultation is open to all, but the government is specifically interested in hearing from certain specialists. These include 'data leads in departments', or the people responsible for parts of a company's data ecosystem, such as data governance or security. It's also hoping to hear from 'senior leaders', even if they do not necessarily consider themselves a 'data person', and also 'technical experts', who work directly with data and are most likely to answer questions about how data management is conducted within an organisation.

To take part in the research, the government is requesting people email DQHub@one.go.uk with their name, job title, and the reason for their interest. Successful applicants will be contacted for a follow-up call.

The Reserve Bank of India (RBI) has banned Mastercard from taking on new customers from 22 July following a dispute over the company's failure to abide by data storage policies.

In April 2018, the RBI released a Storage of Payment System Data notice which stipulated that payment system providers should store payment data in India to ensure “better monitoring”. This includes the full end-to-end transaction details and information collected or carried as part of the message or payment instruction.

However, for the “foreign leg” of the transaction, the data can also be stored in the foreign country if required.

Payment system providers were given six months to implement this change, which should have been completed by 15 October 2018, and report compliance to the RBI, as well as submitting an audit report to the bank by December. Mastercard is said to be still in breach of these terms, according to the RBI.

“Notwithstanding lapse of considerable time and adequate opportunities being given, [Mastercard] has been found to be non-compliant with the directions on Storage of Payment System Data,” said Yogesh Dayal, chief general manager at the RBI.

The RBI has now placed a freeze on the onboarding of new Mastercard customers across the country, and Mastercard must advise all card-issuing banks and non-banks to conform to these directions.

A spokesperson from Mastercard said it is "fully committed" to its legal and regulatory obligations in the markets it operates in.

"Since the issuance of the 2018 directive requiring on-soil storage of domestic payment transaction data, we have worked closely with the RBI to ensure that we comply with the requirements," said the spokesperson. "While we are disappointed with the stance taken by the RBI today (July 14), we will continue to work with them and provide any additional details needed to resolve their concerns."

The 2018 policy change emerged following a recognition that the payment ecosystem in India had expanded “considerably” with the emergence of new payment systems, players, and platforms.

“Ensuring the safety and security of payment systems data by adoption of the best global standards and their continuous monitoring and surveillance is essential to reduce the risks from data breaches while maintaining a healthy pace of growth in digital payments,” the bank stated.

In order to have “unfettered access” to all payment data for “supervisory purposes”, the RBI decided that all payment system operators had to ensure that data related to payment systems operated by them should be stored only inside the country.

The Irish Council for Civil Liberties (ICCL) has filed a lawsuit in a German court on Wednesday against the world's online advertising industry.

The legal action takes aim at tech giants such as Google, Amazon, Facebook and Twitter, as well as the Interactive Advertising Bureau (IAB), and challenges the industry's rules.

It's been brought by Dr Johnny Ryan, a senior fellow at the ICCL, who believes that the Data Protection Commission in Ireland, along with other regulators within the EU, have failed to act on formal complaints the ICCL has submitted over the last three years.

Part of the lawsuit focuses on the online advertising industry's rulebook for building profiles - or "secret dossiers" - of individuals, as well as the data shared between ad brokers and other firms while ad space is being auctioned as a website loads.

This is called the real-time bidding (RTB) system, which is a core part of today's online advertising industry used by thousands of companies through the IAB. It collects people's browsing history and auctions it to hundreds of thousands of third parties so they can bid on advertising space.

"These secret dossiers about you - based on what you think is private - could prompt an algorithm to remove you from the shortlist for your dream job," Ryan claimed in a statement. "A retailer might use the data to single you out for a higher price online. A political group might micro-target you with personalised disinformation."

Ryan also suggests, incorrectly, that the use of the system is a "daily data breach" and hits out General Data Protection Regulation (GDPR) regulations for a lack of action on this issue. He has also previously accused the UK's Information Commissioner's Office of failing to regulate real-time bidding.

"In September 2018 we brought evidence of the unlawful behaviour of the ad industry to regulators," said solicitor Ravi Naik, a Partner at law firm AWO. "Owing to regulatory inertia, years later, we have no resolution to that conduct. Instead, the Irish Council for Civil Liberties have had to stand up for all of our rights."

The ICCL has claimed to have hundreds of pages of evidence ready to submit to a court in Hamburg that highlights personal data harvested from real-time bidding systems.

IT Pro has approached Google and Facebook for comment.

The US Supreme Court has given LinkedIn permission to try and stop a rival website from harvesting personal data from its platform.

The move essentially throws out a lower court ruling that previously barred the company from preventing hiQ Labs from accessing information that LinkedIn members had made public on the business platform.

In 2019, the Circuit Court of Appeals let stand a 2017 preliminary injunction that required LinkedIn to give hiQ Labs access to user accounts that were publicly available, with Circuit Judge Marsha Berzon stating that hiQ showed it faced irreparable harm and might go out of business without access.

The issue centres around whether companies can use a US federal anti-hacking law called the Computer Fraud and Abuse Act, which prohibits accessing a computer without authorisation, to block competitors from scraping vast amounts of customer data from public-facing parts of a website.

It underscores the increasing importance and value of personal data on the internet and raises complex questions about who can control it, who can use it, and for what purpose. In the case of hiQ, it uses LinkedIn data to analyse employee skill sets and alert employers when they might be available for work. During the initial court case in 2017, hiQ accused LinkedIn of anti-competitive conduct by suggesting it issued its threats around the same time as it launched a similar service.

As part of its defence, LinkedIn told the Supreme Court that hiQ uses software 'bots' that can harvest data on a massive scale, far beyond the capabilities of a single person viewing public profiles, which undermines its own service. In April, the business platform also suggested that some of the publicly viewable data of its users had been scraped and posted for sale.

IT Pro has approached both LinkedIn and hiQ for comment.

The Canadian police force broke the law when using Clearview AI facial recognition software, the country's privacy regulator has ruled.

The Royal Canadian Mounted Police's (RCMP) use of the technology to conduct hundreds of searches of a database compiled illegally by a commercial company was deemed a violation of the Privacy Act, a report from the Office of the Privacy Commissioner (OPC) of Canada found.

Clearview AI was found to have violated Canada's federal private sector privacy law by creating a database of over three billion images scraped from internet websites without users' consent. Clearview users, like the RCMP, could match photographs of people against photographs in the database.

"The use of FRT [facial recognition technology] by the RCMP to search through massive repositories of Canadians who are innocent of any suspicion of crime presents a serious violation of privacy," commissioner Daniel Therrien said. "A government institution cannot collect personal information from a third party agent if that third party agent collected the information unlawfully."

The RCMP had initially stated that it was not using Clearview AI, only to later admit that it had used the company's technology "in a limited way", primarily for identifying, locating, and rescuing children who were victims of online sexual abuse.

However, OPC found that only 6% of the RCMP's searches using the technology appeared to be related to victim identification, with a further 9% attributed to other justifiable law enforcement activities. However, the police force was unable to provide adequate justification for the vast majority (85%) of the searches it conducted, based on Clearview records.

In a statement, the RCMP said it publicly acknowledged its use of the technology in February 2020, and ceased using Clearview AI in July 2020, when the company ended its operations in Canada.

"We acknowledge that there is always room for improvement and we continually seek opportunities to strengthen our policies, procedures and training," said a police spokesperson. "The RCMP has accepted all of the recommendations of the OPC and has already begun efforts towards their implementation."

In May, Privacy International and several other European digital privacy campaigners launched legal action against the controversial US facial recognition firm, Clearview AI. The group claimed that the company's methods for collecting images are in violation of European privacy laws.

Following a cyber attack against Clearview AI in February 2020, it was reportedly revealed that a number of high-profile public agencies, including the FBI, were on the company's client list.

The company gained notoriety after the New York Times ran a feature about its work with law enforcement agencies and how its facial recognition models were trained on three billion images, harvested from social media sites.

Labour has urged the NHS and Matt Hancock to halt plans to share medical records with third parties and offer more consultation into how the idea would work, over fears it will undermine patient trust.

The plans aim to pool pseudonymised medical records on a database that can be shared with academic and commercial third parties for use in future planning and research.

The shadow public health minister, Alex Norris, said he shared the concerns of some doctors groups in a series of tweets, posted on Friday. These concerns have been formalised in a letter the MP has sent to both the head of NHS Digital and the health secretary, according to The Guardian.

Norris called for a "coordinated" and "consistent" message and more details as to which third-party organisations will have access to patient data and whether they will be made public or used for marketing purposes. Norris has also called for safeguards to be put in place to protect confidential patient data and a right for patients to remove their historical data from any future collection.

"I share concerns raised by patients, GPs and the health sector about the changes to data sharing," the MP for Nottingham North posted on Twitter. "The response to COVID has shown the benefits of collaborative planning and research as we have all bound together to tackle the challenges it has posed.

"However, for data sharing to work, it must be built on trust. I share concerns about the lack of communication with patients on this issue, and on the lack of consultation. Without consultation and clear communication with patients, trust in this process is undermined."

These concerns are shared by the Royal College of General Practitioners, which urged NHS Digital to explain the plans more clearly to the general public and outline how people could opt-out. Patients can reportedly opt out, but only if they do so before 23 June.

The British Medical Association and the Doctors Association also said it was worried that the data-sharing agreement would "erode the doctor/patient relationship, leaving patients reluctant to share their problems due to fears of where their data will be shared", according to The Guardian.

The European Union is expected to unveil plans for a bloc-wide digital wallet on Wednesday, following requests from member states to provide citizens with a safe way to access online services.

The digital wallet would allow citizens from all 27 member states to securely store payment details and passwords, according to The Financial Times, which cites sources with "direct knowledge" of the plans.

The proposed app, which will have biometric authentication, such as fingerprint and retina scanners, will also serve as a digital vault where users can store official documentation, like driver's licences.

App users will benefit from an "extra-secure" digital ecosystem that is said to be "ideal" for post-pandemic life, according to the source, although it isn't clear whether this will include any form of vaccination verification. Its use is also not thought to be compulsory.

The EU's digital policy commissioner, Thierry Breton, alluded to the plans earlier in the year, suggesting a new digital ID would give every European the keys to their "digital twin". Brussels is said to be currently engaged in discussions with all member states on a set of guidelines for the technical standards needed to roll out the digital wallet, which could be fully operational by 2022.

A type of digital wallet is already in use across 19 member states, but not all of these are compatible with one another. EU officials hope that increased digital literacy and the use of digital tools during the pandemic will help the new system find more traction.

The use cases for uniformed digital wallets vary between industries, but they include being able to remotely hire a car and using an app as an electronic key. Through the app, the user can immediately pick up the vehicle without the need for waiting in line at the airport.

This recorded webinar breaks down how organisations can realise operational resiliency goals as part of a digital transformation.

While an increasingly digital world comes with a plethora of benefits, it also comes with more complexity and malicious intent that can compromise a business’ resiliency. To both cope with the challenges and reap the rewards of this world, businesses need to consider embracing digital transformation.

Watch the video to learn:

• How market forces impact the acceleration of digital transformation
• How massive amounts of data and the growth of ransomware attacks puts organisations at risk
• Why data and infrastructure insights is essential for your DX goals and how Veritas can help

Fill out the form below to access the free resource.

Australia’s Parliamentary Joint Committee on Intelligence and Security (PJCIS) has recommended passing a bill that would allow the country to share communications data with other countries, but only after its 24 report recommendations are enacted first.

If the bill passes, it would allow Australia to obtain an agreement with the US under its Clarifying Lawful Overseas Use of Data Act (CLOUD).

The Telecommunications Legislation Amendment (International Production Orders) Bill 2020, introduced on 5 March, seeks to address Australia’s evolving technological landscape where data previously held in the country is now stored overseas.

Its Explanatory Memorandum states that Australian law enforcement and national security agencies need access to electronic and communications data from foreign communications providers for criminal investigations. Currently, the country has relied on mutual legal assistance from overseas jurisdictions, which it calls a “lengthy process”.

For requests received from foreign governments with a designated international agreement, the bill would remove the blocking provisions that prevent domestic communication providers and tech companies from cooperating with a request from a foreign government, when the request complies with the conditions of the designated international agreement.

However, the committee has outlined 24 recommendations which it thinks should be implemented before the IPO Bill can go ahead.

One recommendation is that designated international agreements must be published and tabled in the regulations, and are subject to parliamentary scrutiny, as well as to a period of disallowance.

Another recommendation is that the agreement must not be used by a foreign government to target an Australian citizen. Information cannot be obtained to provide to the Australian government or a third-party government, the recommendations state.

Any country wishing to seek this kind of agreement must demonstrate respect for the rule of law, equality and non-discrimination, respect for international human rights, and have clear legal procedures and restrictions governing the use of electronic surveillance investigatory powers.

Furthermore, as some countries still practice the death penalty, including the US, the PCJIS said a minister should receive a written assurance from the government of a foreign country relating to the non-use of Australian-sourced information obtained through the agreement “in connection with any proceeding for a death penalty offence in the country or territory”.

The committee’s last recommendation was that “following implementation of the recommendations in this report, the Bill be passed by Parliament".

The NHS app will soon also act as a digital COVID-19 vaccine passport for travelling abroad, transport secretary Grant Shapps has confirmed.

The MP confirmed long-standing predictions that international movement could soon be regulated by whether or not an individual has received a COVID-19 vaccine.

Shapps specified that the app that will double as a vaccine passport is set to be the standard NHS app, rather than the NHS COVID-19 contact-tracing app that is currently used for checking into venues.

"It will be the NHS app that is used for people when they book appointments with the NHS and so on, to be able to show you've had a vaccine or that you've had testing," he told Sky News.

Shapps added that he is “working internationally with partners across the world to make sure that system can be internationally recognised”.

However, digital privacy expert Attila Tomaschek has warned that while Shapps’s confirmation will likely to be “welcome news for pandemic-weary consumers itching to finally go on holiday”, the proposed vaccine passports “pose major privacy and civil liberties risks”.

Tomaschek said that there’s “a major concern that the data collected by the vaccine passport scheme may be used beyond the scope and timeline of the pandemic by the government or even other third-party agencies”.

The opinion was echoed last year by other privacy experts who warned that implementing so-called immunity passports could lead to widespread discrimination and the exploitation of data by malicious third parties.

Data security and privacy expert Zulfikar Ramzan said that, due to the sensitive nature of medical data, it “will be highly sought after by threat actors”.

“Anyone attempting to build a data lake for immunity passports will assuredly have a giant target on their back. More so, given the tremendous pressure to put a solution in place swiftly, it is almost certain that the designers and implementers of an immunity passport solution will make significant errors,” he told IT Pro in June last year.

“Another core issue is data governance. In that vein, one must consider who will have access to the data, how mechanisms for controlling access will be enforced, and how to mitigate the risk of this data being abused. An immunity passport system involves the creation of a larger-scale surveillance infrastructure that will collect data beyond the purposes of determining people who are potentially immune to COVID-19.

"Some people may be willing to contribute their personal data into the system to help address the current pandemic situation. However, they may not wish to have their data used for other purposes."

UK Research and Innovation (UKRI) has awarded over £700,000 of funding to radically update the foundation of the insecure digital computing infrastructure.

The money came from the Industrial Strategy Challenge Fund (ISCF) through the Digital Security by Design (DSbD) programme and will be given to ten SMEs in the UK.

“We are working hand in glove with our world-class cyber security sector to build back better from the pandemic and make sure the UK is the safest place to be online,” said Matt Warman, the Digital Infrastructure minister.

“Thanks to government support these projects can create pioneering and secure technologies that will give people and businesses further confidence in our digital economy and help combat cyber criminals.”

The aim is to provide these businesses with the opportunity to assess how ARM’s technology platform prototype, the Morello project, can help them.

Morello focuses on new ways of designing CPU architecture to make processors more robust and deter some types of security breaches. It is a five year research programme funded by UKRI and hopes to produce a “Morello board”, which could be implemented in future hardware.

Ten UK SMEs have been awarded funding for these projects:

• A feasibility study of a data security software product adopting DSbD technology: ANZEN Technology Systems Limited, London
• A TEE-aware compartmentalisation framework based on DSbD: Verifoxx, London
• assessing the viability of an open source DSbD desktop software ecosystem: Capabilities Limited, Carmarthenshire, Wales
• CHERI standards compliance (CHERI Stone): DRISQ Ltd, Worcestershire
• A data path development kit: Pytilia Limited, Northern Ireland
• A multi-compartment computation protocol based on DSbD: MindHug LTD, Stowmarket, Suffolk.
• A porting edge AI workflows to CHERI/Morello: OXON.Tech Ltd, Oxfordshire
• quantum-resistant DSbD security leveraging MicroTokenisation: Valid Datum Limited, London
• SecurlOT: IOETEC Limited, Sheffield
• Trusted ring security for Morello Devices: Metrarc Limited, Colchester and Canterbury.

Róisín Meehan, founder of Verifoxx, said in a post on LinkedIn: “This funding allows us to embed our privacy-first approach in our trusted execution environment by testing out pioneering technologies we will get exclusive access to.

“The results of our research will elevate the security of our identity verification to a new level while contributing to the wider transformation of the UK's digital computing infrastructure.”

At the end of January, at least two government services were knocked offline as a cyber attack hit UKRI, with the attackers managing to encrypt data belonging to the organisation too. The attack was thought to have been carried out through ransomware.

Last week it was reported that the UK government is looking to buy stakes in tech startups, spending as much as £375 million through its Future Fund. In mid-January, it also invested £28 million to trial innovative 5G use cases in nine nationwide projects.

The European Union (EU) is set to allow data to flow freely from its territories to the UK after finding that it has comparable data protection laws in place.

This decision, which has been drafted by the European Commission, should be approved imminently, according to the Financial Times (FT), and will prove a huge relief for businesses nervous about the potential disruption to data flows.

Withdrawal from the EU relegated the UK to ‘third country’ status, meaning that data transfers from the EU to the UK would be blocked by default. Only a formal adequacy agreement, which deems the UK as a secure third country, could restore flows.

As part of post-Brexit agreements, however, the EU and the UK arranged a six-month continuity period specifically to allow for time to consider the UK’s data adequacy status.

This agreement, expected to be announced this week, will be continuously reviewed by the EU and will be subject to legal challenges at the European Court of Justice, however.

This means that while the UK’s laws are deemed to be comparable to the EU’s at present, there are no guarantees it’ll retain this status in future should it tweak its laws and strike arrangements with other countries.

Global director of privacy at Veritas Technologies, Mark Keddie, branded this a welcome step for businesses looking to manage their data across the UK and Europe.

“However,” he continued, “we would advise organisations not to become complacent as this stay of execution could be short-lived.

“As with previous similar agreements, most recently the EU–US Privacy Shield and its predecessor Safe Harbor before, there is a distinct possibility that a Privacy NGO will in the near future bring a legal challenge in the European Court seeking to invalidate any UK data adequacy finding.

“Those businesses that stay focused on maintaining robust data privacy controls and good data hygiene practices will be best suited to manage any future data shocks as the EU-UK relationship develops.”

Keddie was referring to the primary data transfer mechanism between the EU and the US, dubbed Privacy Shield, which was invalidated last year by the European Court of Justice, which deemed it incompatible with GDPR.

Privacy Shield, which was a replacement for the invalidated Safe Harbour Principles, was introduced in 2016 to solve the problem of sending data from the EU to the US given the latter’s relatively invasive surveillance laws.

European figures have hinted that the UK may risk not being granted data adequacy, or losing this status once it has been attained, should it pursue data transfer arrangements with the US. Terms of any agreement between the two nations, subject to examination, may not be compatible with GDPR, the European Data Protection Board (EDPB) warned last year.

The EU’s data adequacy agreement will be reviewed every four years, according to the FT, to ensure it doesn’t compromise the privacy of EU citizens, and will also allow for data transfers on law enforcement matters.

The government’s existing data strategy isn’t enough to maintain the momentum built during the COVID-19 pandemic with regards to how local authorities use data to transform public services.

The pandemic has led to “substantial positive developments” in the way local government uses data, according to the Centre for Data Ethics and Innovation (CDEI), which has witnessed data-driven innovations in public health and service delivery.

Hackney council, for example, combined internal and external datasets for the first time to help them identify residents particularly vulnerable to COVID-19 as an illness. The VIPER tool was used in Essex, meanwhile, to enable emergency services to share data in real-time.

Much of this innovation has been driven exclusively by COVID-19, which has forced the hand of the public sector to innovate and experiment. This reflects a pattern in both the public and private sector, with the pandemic forcing organisations to adapt in order to continue delivering services that are essential to their end-users.

“Almost every aspect of local government has required at least temporary reform during the pandemic,” said board member for the CDEI, Edwina Dunn.

“Data and data-driven technologies have played an important part in enabling local councils to respond to the COVID-19 crisis, helping to inform public health measures, protect the most vulnerable in local communities, and keep public services running.

“With the right support, councils can retain and build on efforts to utilise data effectively, in a way that is in keeping with the expectations of their residents, to provide local services communities can rely on.”

Dramatic improvements

The CDEI hosted a forum with several public sector groups, including local authorities, to establish how data was being used at a local level, and how this could be improved in future.

The report also found that local authorities have had more success in changing how they deploy existing datasets than in acquiring or sharing data with others while concluding the scale of change was more vast with authorities with dedicated data teams.

The sharing of health data has also improved dramatically across the board. The government, for example, has granted councils access to the shielding patients database, which has allowed them to deliver support such as food parcels and pharmacy deliveries.

All progress that local authorities have made in 2020, however, is being undermined by a “narrowly-focused” set of measures that won’t guarantee any long-term positive change as we move beyond the pandemic.

The Local Government Association (LGA) recently published a guide on using predictive analytics for local councils, for instance, while the Ministry Ministry of Housing, Communities and Local Government (MHCLG) is running a COVID-19 Challenge Fund. As part of this latter scheme, 11 projects have been awarded a share of £800,000.

'Fragmented and rudderless'

Although these are positive steps, on their own, the CDEI concluded, these are “unlikely to move the needle in how local authorities use data”.

One widely-shared anxiety among local government leaders is that the emergency powers granted during COVID-19 will be rescinded once the pandemic has subsided.

There’s particular concern that local authorities will lose their appetite for experimentation once the emergency subsides and with it their willingness to experiment with untried data-driven interventions.

There is, however, some hope in the way that these schemes, in combination with the government’s new National Data Strategy, shows a desire to make more support available for fostering innovation at a local level.

Launched in September 2020, the strategy signals a growing conviction within government to innovate using data, the CDEI claims, promising to strengthen skills, improve standards and bring clarity to regulations.

This strategy, however, was described as "fragmented and rudderless" shortly after its launch by the influential Public Accounts Committee (PAC) of cross-party MPs.

Data can be a huge enabler of transformation and efficiency for every sector, and healthcare is no different. However, there can be some significant challenges in implementing a complete data strategy when it comes to health and medicine, particularly within the framework of the NHS.

This is why the Bradford Institute for Health Research established the Connected Yorkshire programme, in an effort to create a data-sharing platform to speed up research and improve community health throughout the region. This week, we're joined by Connected Yorkshire programme manager Kuldeep Sohal to find out more about Connected Yorkshire's work, the challenges involved with managing data at scale, and how a robust data strategy can help supercharge health and social care.

Footnotes

• What is data and big data mining? An easy guide
• What is big data analytics?
• What is the Information Commissioner’s Office (ICO)?
• What is GDPR? Everything you need to know, from requirements to fines
• Seven steps to GDPR compliance
• How to become a data scientist
• Organisations have been blind to GDPR “business opportunity”
• NHS to inject more robots into healthcare with UWE Bristol partnership
• Microsoft offers free cyber security protection to healthcare staff
• How technology is changing health care
• Microsoft launches public cloud service for health care
• Birmingham NHS trust passes medical data to Telefonica without patient consent

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

A tech sector lobby group has said that Joe Biden being elected president of the United States could have a positive effect on the global tech industry.

The Democratic candidate's openness to international collaboration, data privacy, and tougher digital taxation stand in stark contrast to Donald Trump's approach to date, according to Tech London Advocates (TLA).

Early projections indicate Biden is increasingly likely to win the presidential race, holding a slim but steady lead in a number of key battleground states. A Biden victory will have many businesses around the world wondering what they can expect from the 46th President of the United States, and none more so than the tech sector, according to TLA's founder, Russ Shaw.

"His approach to digital policy seems much more actively geared towards partnering with private industry and other governments to set the technology agenda," Shaw told IT Pro.

"For Big Tech companies, Biden still intends to impose stringent antitrust measures, as well as tough taxation and privacy regulations. However, with his history as the vice president of a Silicon Valley-friendly Obama Administration – and California-elected Kamala Harris on his ticket – a victory would likely be the outcome of choice compared to Trump's ongoing allegations of anti-conservative bias from social media giants."

Beyond Silicon Valley, Shaw thinks Biden will be more open to a "multilateral" approach to key issues such as the digital tax proposed by European countries. Trump has previously described higher taxation as "overly protectionist", but Shaw believes Biden will look to heal transatlantic divisions, mainly by ending retaliatory tariffs.

As for the UK, and its post-Brexit trade negotiations, a Democratic victory presents "something unknown", according to Shaw. Biden's views on topics such as data flows might be at odds with a Conservative government in the UK, but we do know that the presidential hopeful is a fan of GDPR-style privacy regulation.

"Ultimately, the UK and global tech sectors can be hopeful that a Biden victory will bring with it a more collaborative approach to international digital diplomacy, as the administration looks to rebuild relationships with allies around the world," Shaw added.

Relations between the US and China are currently strained due to the ongoing trade war, but Shaw feels there is more hope of these tensions easing under Biden. However, he isn't likely to ease restrictions on Huawei, with cyber security and IP theft still likely to be of high concern.