Impact of Gaming Content

INSIGHTS
The PSD2 makes Strong Customer Authentication (SCA) mandatory to protect both clients and financial institutions such as banks.
The GDPR are EU regulations that set new frameworks for the protection and handling of personal data relating to EU-based residents.
According to the California Civil Code s.1798.29(a) and s.1798.82(a), businesses and state agencies should notify residents in case there has been a breach of data security.

Second Payment Services Directive or PSD2 uses Biometric authentication and also enables encryption for data-at-rest with zero impact on performance. General Data Protection Regulation (GDPR) used laws such as "accountability principle" and "privacy by design" and encourages organizations to take more responsibility for protecting the personal data they handle. State Privacy Laws opted for a different approach to data protection (in the US) like the Health Insurance Portability and Accountability Act (HIPAA), NIST 800-171, The Gramm-Leach-Bliley Act and Federal Information Security Management Act.

HOW REGULATORY BODIES ARE DRIVING THE ADOPTION OF ‘STRONG AUTHENTICATION’

SECOND PAYMENT SERVICES DIRECTIVE (PSD2)
The EU PSD2 is an update of the PSD1. It was mandatory for all the EU member states including the UK to ensure its implementation into law by January 13, 2018. The PSD2 was specifically designed by EU countries and covers various fields including the information that can be seen when making payments and safeguarding online payments.

Additionally, individuals will have control of their data and firms will need to have both operational and technical security matters when processing data in their possession.

Strong Authentication Adoption of Secure Data Protection Platform (SDP2)

SDP2 facilitates the encryption of data-at-rest with minimal impact on performance. It has therefore replaced traditional NAS data storage with a drop-in solution that is easy to maintain and implement. As such, this has eliminated the complexity that arises from using multiple tools through the creation of a secure, unified and simple data protection solution.

According to MasterCard, PSD2 will increase the volume of consumer biometrics since it will result in an increase in online transactions from the present 1%-2% to as much as 25% by next autumn.

As such, MasterCard stated that it will provide authentication for European online shoppers from April 2019 to meet the SCA requirements. Additionally, BioCatch recently pitched behavioral biometrics as one of the best strategies to meet the PSD2 authentication requirements, while eliminating risks that arise between financial institutions and third-party payment providers.

The PSD2 also makes Strong Customer Authentication (SCA) mandatory to protect both clients and various banks. As such, to ensure compliance, banks need at least two of three elements including something material the client owns, details they know such as their PIN code or password and biometric details such as voice, face or fingerprints. One device that has played a key role in increasing the use of fingerprints is the iPhone.

These regulations are beneficial to banks since they increase their security, which leads to more trust from customers.

GENERAL DATA PROTECTION REGULATION (GDPR)
The GDPR are EU regulations that set new frameworks for the protection and handling of personal data relating to EU-based residents. It was effective from May 25, 2018.

Strong Authentication Adoption

The GDPR data protection laws are applied across all the EU states. Some penalties for mishandling data include 20 million Euros or 4% of the organization's global revenue, depending on which is greater. Additionally, this protection is also applicable to data controllers such as banks and data processing platforms such as banks, third party providers and payment service providers.

One of the key objectives of GDPR is to update the data privacy laws in the EU to match the vast technological changes in the last two decades. Some of these principles include privacy by design and accountability. As such, organizations are expected to be more responsible with regard to the data they handle.

There are several obligations that companies have under GDPR:


1. Firms must realize that they have legal obligations under GDPR.

2. All providers used by the organization should also be keen on data protection, understand the GDPR obligations and ensure they are adhered to.

3. The law does not prevent the transmission of data outside of the EU. However, data can be shared but using secure means and recognized standards such as the EU-US Privacy Shield.

STATE PRIVACY LAWS
The US has a different approach with regard to data protection. Unlike other countries that have adopted an all-encompassing regulation such as the GDPR, the US has implemented sector-specific data protection regulations and laws. As such, these work together with state-level legislation to protect data in the US. Examples of these include:

The Health Insurance Portability and Accountability Act (HIPAA): These are standards created to ensure the security of protected health information (PHI) by facilitating the regulation of healthcare providers.

 NIST 800-171: This is a special publication by the National Institute of Standards and Technology with the aim of offering protection to Controlled Unclassified Information (CUI) in non-federal information systems.

The Gramm-Leach-Billey Act (GLBA or GLB Act). This is also referred to as the Financial Modernization Act of 1999. The main objective of this legislation is to offer protection to the personal information of consumers that is stored in various financial institutions.

The Federal Information Security Management Act (FISMA), which is part of the E-Government Act of 2002. This legislation made it mandatory for federal agencies to facilitate the development, documentation and implementation of information security and protection programs.

Additionally, various states have specific regulations regarding the privacy of data. An example is California which implemented a breach notification law in 2002. According to the California Civil Code s.1798.29(a) and s.1798.82(a), businesses and state agencies should notify residents in cases where there has been a breach of data security. This regulation is applicable to all residents, consumers and employees within the state of California.