AVIAPRO CONSULTING BLOG

 

The Challenges of Data Protection in 2023

2 April 2023

Airlines are facing difficulties when it comes to the collection and use of personal data. This is partly due to the shifting legal and regulatory environments which continue to have an impact on technological innovation, data commercialization, and the offering of digital services. As airlines and their partners in the aviation landscape try to balance controlling their legal, reputational, and operational risks alongside their commercial and strategic objectives, airlines may find themselves circling back between various internal stakeholders and control functions. Given these challenges, AviaPro Consulting Inc. has recruited expertise in this area and has added privacy and data protection services to our list of offerings.

There are extensive data security laws in place everywhere in the world. Although there are many different jurisdictions that have adopted data security laws, they all have a shared interest in addressing and mitigating data security risks. The efforts of legislators have increased over the last two years, resulting in the adoption and passage of numerous initiatives for data protection legislation. This pattern continued through 2023, with states in the US and the Middle East passing new data privacy and protection laws or amending old ones.

Below is a snapshot of Data Protection updates in 2023:

I. United Kingdom (UK) Data Protection

It is anticipated that changes will be made to the Data Protection and Digital Information Bill, which is part of the UK Data Protection Act 2018 (UK GDPR). This law was implemented when the UK exited the European Union, and one was required. There were timing restrictions for implementation at the time. After many years, the UK’s objective in this regard is to evaluate and modify data transfer sufficiency while growing data potential for business.

II. European Union (EU) Data Protection

The new Data Act may include more provisions than the European Union GDPR. This law governs the information produced by the internet of things. Data from online-connected devices is the core of the Internet of Things. This information may come from refrigerators, smart TVs, or electric autos. Below are legislative changes happening in 2023:

• The Artificial Intelligence (AI) Act, monitoring risky AI applications. The EU Council adopted its common stance (or "general approach"). Its goal is to guarantee that artificial intelligence (AI) systems used in the Union and sold on the EU market are secure, adhere to current fundamental rights legislation, and uphold Union values.
• The new EU Standard Contractual Clauses (SCC) took effect in 2022. These are the sole clauses that can be used in any contract agreements as of December 2022. SCCs are uniform words used when personal data is transferred from the EU to a nation beyond the EU's boundaries in the absence of an adequate determination.
• Businesses striving for simpler EU-US data flows are hopeful that the recently announced EU-US Data Privacy Framework will be completed by mid-2023 as anticipated.

III. Transnational Data Transfer

A truly international system for data transport and sharing is anticipated to be the subject of discussions in 2023. Currently, all of this is just conjecture, but it may result in international cooperation where data flow between states becomes simpler. If this were to occur, regulations would be put in place, and nations without a current data protection law wouldn't be able to participate.

IV. New and recent Data Protection laws in the MENA region and the US

In the next ten to twenty years, the Middle Eastern nations have ambitious goals for urban development, economic growth, and the introduction of new technologies. This ambitious goal is led by the United Arab Emirates (UAE). Smaller still, but resource-rich, Bahrain, Qatar, and Oman want to expand to keep up with a changing world. With bold plans for urbanization and economic diversification, Saudi Arabia is a sleeping colossus. With a successful track record of technology exports, the country is highly esteemed for technology, security, unicorn companies, and start-ups.  These nations are all adopting new data security laws, improving current regulations, or extending the reach of technology. These legislative changes aim to strengthen public confidence in emerging technologies, safeguard individual rights, and expand regional and global data movements. Because the Middle East invests heavily in data, technology, automation, smart cities, and scientific innovation, data security is a hot topic right now.  

In a similar manner, state-governed laws (rather than federal laws) are being introduced in the U.S. A map of American states with modern data protection laws is shown below. 

Source: IAPP: International Associations of Privacy Professionals (10/03/2023)

 

Please note more states will have legislation in place by 2023 such as Colorado Privacy Act (CPA, effective 01JUL 2023), Utah Consumer Privacy Act (UCPA, effective 31DEC 2023), Virginia Consumer Privacy Act (VCPA, effective 01JAN2023)

• The EU GDPR changed the game for data protection laws in 2018. The first statute to offer data protection for current uses of personal data was this one. For instance, using mobile technology, filming videos, utilizing AI, and utilizing technologies such as facial recognition, finger printing, etc. Countries watched how GDPR was received internationally, and now other nations are enacting rules very similar to GDPR. Unquestionably, new data privacy rules are affecting the aviation industry, both domestically and internationally. International airlines today must adapt to a broad range of regulations, many of which have unique requirements and limitations. Some of the data protection regulations coming into effect in 2023 in addition to USA states are UAE, KSA, China, Switzerland, Canada, New Zealand, Brazil, and Singapore.
• It's tempting to see compliance as nothing more than a hassle, a bothersome regulatory issue that hinders company operations. But this way of thinking is at best foolish and at worst hazardous. Customers in the modern world need to feel confident about doing business with an organization. This implies that as customers become more demanding about data privacy, being able to demonstrate compliance may be a competitive differentiator.

At AviaPro, we are keen to protect your Personal Data based on our solid framework shown below.  Using our Data Protection Framework, AviaPro ensures your compliance to data protection regulation challenges and requirements. For more information, reach out to Ali at ali.kassir@aviaproconsulting.com for an initial assessment of your company’s data privacy status and proposed recommendations.

 

Read more on the AviaPro Blog