SAS study on the GDPR: Are companies ready for their customers?

Customers are becoming more confident, says SAS study on the GDPR introduced in 2018. (Image: despositphotos)The SAS study, or rather consumer survey by 3GEM, shows the first trends after the entry into force of the EU General Data Protection Regulation (EU GDPR). First conclusion: Consumers are more informed than some companies would like to be. Of the rights laid down in the basic regulation, a large proportion of respondents are aware of the option to have their data deleted by companies (44.6 percent). And 62.4 percent have already made use of their data protection rights or are at least considering doing so.

So the intriguing question is: Are companies ready for their customers? Some answers may be gleaned from SAS' early 2018 worldwide survey of companies The results of the survey show that companies are not yet fully compliant with the GDPR. For example, just a few months ago, companies found it most challenging to track down all sources in which personal data is stored. This is where the latent dilemma becomes clear. The current consumer survey showed that almost one in two (48.6 percent) are aware of their right to view stored data. It remains to be seen to what extent this delta can now be the undoing of companies. At the beginning of this year, at least, 93 percent of global companies said they were not fully compliant.

Strong consumer awareness

After all, 53 percent of European companies were confident that they would meet the deadline. But confidence is different from certainty. Worse still, they even said they simply had knowledge gaps when it came to GDPR compliance.

Consumers' strong awareness of their rights therefore means that there is a high probability that they will also exercise these rights. Especially because it has now been shown that consumers have become much more sensitive after the Facebook/Cambridge Analytica case. In the latest consumer survey, over half (54 percent) said they are now more careful about what personal data they provide to companies. And overall, respondents show very little tolerance for companies' lapses in the use of their personal data. When data is shared with third parties or consumers receive unsolicited emails, more than half of respondents each plan to insist on their right to delete it (51.8 and 58.4 percent, respectively). However, there is a chance to win back consumer trust. For as many as 48 percent, a promise from the companies that the data will be handled in accordance with the rules in the future will help.

Incidentally, social networks are right at the top of the list of companies that consumers distrust: 32.4 percent would like to see their data there, 36.6 percent would even have their data deleted. But trust in financial service providers (banks and insurance companies) is not unrestricted either: 30.6 percent and 28.2 percent of those surveyed can imagine asserting their right to see their data.

Conclusion

So the majority of consumers have already adapted to the new legal situation. And for companies, this means that they need a long-term GDPR and data protection strategy. If they want to be able to explain to their customers how and where they have used their data, it is important to look into the system and to be able to interpret the data systems correctly. After all, given consumers' right to challenge automated decisions and the need for transparency, companies need to know what algorithms and models were used on the basis of which decisions were made with consumer data. From an IT perspective, a central authority or platform through which data and data governance can be reliably monitored and controlled may be one solution. Such an end-to-end platform approach is used to bring together data from a wide variety of sources. Then all steps from data preparation and management to data evaluation are covered.

Among others, 500 consumers in Switzerland were surveyed for the study on behalf of SAS. Further results are available here download.