In our fast-paced, interconnected world, data security and privacy have emerged as critical concerns for individuals and organizations alike. Among those navigating the complexities of safeguarding sensitive data are Internet Service Providers (ISPs). As more and more ISPs migrate services to the cloud, their customers’ data goes with it, which creates multiple new risks to customer privacy and – ultimately – their security. In recent discussions with our valued customers and potential prospects around the world, they have expressed “privacy” concerns about how we process and store the data associated with their customers’ routers and other home network equipment, and additional concerns about their own legal obligations to protect that data, such as those described in the “GDPR” style regulations.  

In Europe for instance, some ISPs express reservations they may run afoul of the provisions set forth in the EU GDPR. First, we should state clearly that we adhere to best practices when it comes to data security – how we process it and store it – in the name of consumer privacy. This principle lies at the core of the design and implementation of our cybersecurity products and solutions. 

Furthermore, a thorough analysis by our legal counsel has determined that SAM’s work on behalf of its ISP customers in the EU is protected by certain provisions of the GDPR, namely Article 6(1): 

1. Article 6(1)(b): Contractual Obligations. Our cybersecurity solution operates within the framework of GDPR Article 6(1)(b) – the processing of personal data is necessary for the performance of a contract. As ISPs provide our solution to their end-users as part of their service package, the processing of personal data is integral to the delivery and fulfillment of this contract. Therefore, end-customers’ consent is not required under this provision.
2. Article 6(1)(d): Vital Interests. In certain cases, the processing of personal data is justified under GDPR Article 6(1)(d) – the processing is necessary to protect the vital interests of the data subject or another natural person. In the context of our cybersecurity solution, the protection of end-users’ network and devices is crucial to safeguard their vital interests, such as preventing potential harm from cyber threats and ensuring their online security. As such, end-customer consent is not mandatory under this provision.
3. Article 6(1)(e): Public Interest. Our cybersecurity solution also falls under the scope of GDPR Article 6(1)(e) – the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Internet Service Providers operate in the public interest by providing essential communication services to their customers. Implementing our solution to enhance network security and protect end-users’ devices aligns with this public interest, and therefore, end-customer consent is not required under this provision.
4. Article 6(1)(f): Legitimate Interests. Additionally, our solution is aligned with GDPR Article 6(1)(f) – the processing is necessary for the purposes of legitimate interests pursued by the data controller or a third party. In this case, the legitimate interest is the safeguarding of network security and the protection of end-users’ devices from potential cyber threats. ISPs have a genuine interest in ensuring the security and stability of their network infrastructure and the devices connected to it. Given that our solution contributes directly to these objectives, end-customer consent is not mandatory under this provision either.   

At SAM, we believe in simplifying data security and ensuring compliance without compromising on innovation and excellence. Feel free to reach out if you need further clarification or assistance in addressing GDPR-related inquiries from potential clients. Let’s dive into the world of data security, GDPR, and how our solutions empower ISPs to navigate these challenges confidently.

We invite you to learn more in our related podcast episode: The Privacy-Security Paradox: Protecting Customer Data in the Cloud. 

And if you’re attending MWC this year, our team will be there to provide you with even more actionable insights for becoming the trusted guardians of your customers’ digital well-being.