New European data privacy regulation will create many opportunities for cybersecurity companies. The European Union is to introduce new regulation on data security and consumer data privacy. This General Data Protection Regulation (GDPR) is to replace the outdated Data Protection Directive, and will go into effect in May 2018. Companies will need help to comply.
As technology progresses, enterprises and consumers use and provide more digital services. As we continue to move to the Mobile Internet and increasingly use cloud services, it becomes harder for consumers to control where their data are stored, and who can access and control that data.
Due to new technologies, such as cloud computing, social media and Big Data (i.e. advanced data analytics), more consumer data is stored in systems around the world, to be processed and analyzed. As these systems are typically available online, we also see more attempts to steal that data, through hacking attacks and security breaches.
General Data Protection Regulation is new EU legislation that wants to enable EU citizens to have better control over their personal data, including where their personal data is being stored, the purpose, and the ability to erase that data. While this is a European law, it will apply to organizations anywhere in the world that do business with anyone in the EU, and will therefore have broad-reaching impacts globally. It requires organizations to categorize, record and specify how long an individual’s data has been held and when it will be erased (‘the right to be forgotten’).
Consumer trust is key. Companies need to find a balance between utilizing data and maintaining consumer trust in the longer term. However, the attitudes towards sharing data and trust in a company differ per age group. For example, millennials appear to be more accepting of the idea that they ‘pay’ for the free services that are provided by the large Internet platforms with their data, and that a lack of privacy on the Internet is part of modern life.
A Veritas study published earlier this year showed that while 31% of companies thought they were already GDPR compliant, once pressed further, only roughly 2% were actually prepared. This is concerning given the severe penalties for non-compliance (up to EUR 20 million or 4% of the company’s global annual revenues, whichever is greater). Even more alarming is that Gartner predicts that by the time the legislation comes into effect, only 50% of organizations will truly be compliant. We think this presents an opportunity for security software companies, as many organizations will likely need to modernize their existing infrastructure, or consider a cloud-based alternative.
GDPR does not give a specific formula or checklist of technical capabilities required to be in compliance. The three critical items we think could translate into more security spending are: (1) a requirement to be ‘state of the art’; (2) the need to be able to disclose breaches in less than 72 hours; (3) the potential reputational damage from breaches. State of the art is of course subjective, but it could prompt companies who have run security appliances past their useful life to refresh in order to be perceived as compliant. The need to disclose breaches in less than 72 hours could prompt companies to invest in a higher security operations headcount (in-sourced or out-sourced), and related tools such as data security compliance, threat analytics or intrusion prevention. Perhaps the item that could be most impactful is the potential reputational damage as a result of a breach. This could drive security spending to reduce the probability of a breach happening.
GDPR represents an additional investment burden for businesses and creates opportunities for vendors including software providers that help customers comply with these new rules. Many organizations will likely need to modernize their infrastructure, or consider a cloud-based alternative. According to International Data Corporation, the total spending opportunity related to GDPR will be USD 2.3 billion in 2017 and USD 3.3 billion in 2018, with continued spending at similar levels through 2021. However, given the magnitude and scope of the regulation, we think that actual spending may be much higher.
We consider GDPR’s impact on our portfolios in two ways. We have exposure to the providers of cybersecurity. We also maintain an open dialogue with companies affected by GDPR to understand how they are preparing for the new regulation. This is an extension of a dialogue we’ve been having with ICT companies on data privacy since 2016. Key topics in the discussion include the type of information companies collect, how this information is used and stored and how the company mitigates the risk and severity of data breaches.
Please read this important information before proceeding further. It contains legal and regulatory notices relevant to the information contained on this website.
The information contained in the Website is NOT FOR RETAIL CLIENTS - The information contained in the Website is solely intended for professional investors, defined as investors which (1) qualify as professional clients within the meaning of the Markets in Financial Instruments Directive (MiFID), (2) have requested to be treated as professional clients within the meaning of the MiFID or (3) are authorized to receive such information under any other applicable laws. The value of the investments may fluctuate. Past performance is no guarantee of future results. Investors may not get back the amount originally invested. Neither Robeco Institutional Asset Management B.V. nor any of its affiliates guarantees the performance or the future returns of any investments. If the currency in which the past performance is displayed differs from the currency of the country in which you reside, then you should be aware that due to exchange rate fluctuations the performance shown may increase or decrease if converted into your local currency.
In the UK, Robeco Institutional Asset Management B.V. (“ROBECO”) only markets its funds to institutional clients and professional investors. Private investors seeking information about ROBECO should visit our corporate website www.robeco.com or contact their financial adviser. ROBECO will not be liable for any damages or losses suffered by private investors accessing these areas.
In the UK, ROBECO Funds has marketing approval for the funds listed on this website, all of which are UCITS funds. ROBECO is authorized by the AFM and subject to limited regulation by the Financial Conduct Authority. Details about the extent of our regulation by the Financial Conduct Authority are available from us on request.
Many of the protections provided by the United Kingdom regulatory framework may not apply to investments in ROBECO Funds, including access to the Financial Services Compensation Scheme and the Financial Ombudsman Service. No representation, warranty or undertaking is given as to the accuracy or completeness of the information on this website.
If you are not an institutional client or professional investor you should therefore not proceed. By proceeding please note that we will be treating you as a professional client for regulatory purposes and you agree to be bound by our terms and conditions.