CDSA

By Peter Worrall, co-founder and director of research and marketing, Fortium Technologies —

We all spent much of the summer obsessing about “Brexit,” the British electorate’s vote to leave the EU. The film and TV industry will undoubtedly be affected by this event, in a variety of ways.

No decisions on how the U.K. will exit the EU have yet been taken and we are all still guessing but there is a lot to consider. On the positive side, the U.K. government could pay the money it was paying into the EU film fund directly into U.K.-based film making. The improved exchange rate since Brexit makes it about 13 percent cheaper for international companies to film in the U.K. than before Brexit. The U.K. government could also offer bigger concessions for U.K. film productions because its hands won’t be tied by EU regulation. There could be greater flexibility about release patterns as the ‘Single Digital Market’ initiative was going to mean that films would have to be released in Europe all at once as one territory. With the U.K. outside the EU it could offer more flexibility for U.K. film makers.

On the other hand, the downside of Brexit is uncertainty, which could mean delays on decision making and postponement of projects. The EU’s ‘Creative Europe’ fund has a budget of €1.46 billion to help tens of thousands of professionals and organizations in film, TV, games, publishing, music, heritage and the performing and visual arts. It spends €100m on U.K. filmmaking and post-Brexit this will not continue. New legislation will most likely be needed because the tax treaties need to be renegotiated.

There could be fewer U.K. films shown in the EU, and vice versa, because member states have quotas to fill for the amount of EU content they show and there will be less appetite if these financial incentives are withdrawn. Passport restrictions on free passage for European film crews and actors working in the U.K. could prevent or limit these skill sets and negatively impact the talent working on film and TV productions. U.K. films crews and actors working in EU countries could end up with a lot of red tape and delay.

General Data Protection Regulation

While on the subject of the EU, a retrospective regulation emanated from the European Parliament called ‘GDPR’, The ‘General Data Protection Regulation’. It affects every organization that processes EU residents’ personally identifiable information. The rules surrounding GDPR will come into force in May 2018 and will not only impact companies in the EU, but companies globally that work with the EU. It seems that companies are only now slowly waking up to the potentially enormous task they need to prepare for.

The obvious area of GDPR that affects the film and TV industry is the data held on film crews, actors and everyone else associated with a production. Data on payments to individuals, tax information, distribution lists, emails and any electronic communication is what this is about.

The Sony hack that revealed, and continues to reveal, so much personal data is the obvious example of what the EU is trying to protect against. Networks and servers continue to be breached regularly as we often read in the headlines.

For those companies employing more than 250 people and processing data on individuals in the EU, the requirements for GDPR are rigorous. A specific data protection officer will need to be appointed and companies will need to report a data breach, concerning individuals whose data was lost, within 72 hours. Under the current directive there is no such obligation to inform an authority that a breach has occurred. Companies will need to track where personal data was used in the supply chain and if a data breach does occur, then the data leaked should have been scrambled and unintelligible to the receiving party and this will be checked by the regulators investigating the breach.

Organizations will need to do regular internal information audits. If personal data is put at risk, for example information relating to actors’ pay and contracts, then the organization will become liable and will have a duty to undertake further audits and correct the security procedures.

The interactive nature of the TV and film industry with the use of social media to promote and connect with fans means the effect of GDPR could be far reaching and expensive. The enforcement of GDPR will be Draconian. Fines will be imposed on those not complying, which could cost up to the greater of 4 percent of annual global turnover or €20m euros.

Implications for widespread data security

Could GDPR be a white elephant? Those of the grey pony tail brigade will remember the hiatus that occurred with Y2K, concerning fears of computer clocks not being able to adjust to the year 2000, which risked terabytes of lost data. Many expensive measures were put in place, such as the passing of the ‘Year 2000 Information and Readiness Disclosure Act’ in 1998, by order of the U.S. President, and the total cost of preventative work to adjust for Y2K ran into the billions.

Data security is something that film and TV CIOs grapple with on a daily basis. The strength of network security is where most of the attention is focused but encrypting data at rest in addition has to be an obvious preventative measure. If data residing on a server is encrypted, then an unlawfully accessed corporate server or iCloud account will not expose the sensitive data stored there.

Encryption at rest also means that accidental data loss from the wrong email address, a lost laptop or USB drive simply doesn’t matter as data cannot be accessed, exploited or released online. Tracking a data loss is important but ensuring controlled access in the first place is a more pro-active measure.

While the GDPR regulation will force companies to do a better job of protecting personal data, perhaps the same philosophy should relate to all sensitive data. At Fortium we are focused on protecting premium TV and movie content in the most sensitive stages of the workflow, such as post production, editing and localization.

It can be difficult persuading companies to spend money on security and it often takes an actual content leak for management to then act. Prevention is better than cure but also less expensive in the long run.

Click here to translate this article
Click here to download the complete .PDF version of this article
Click here to download the entire Spring 2016 M&E Journal