Katie Smith (katie.smith@convercent.com) is EVP Chief Ethics & Compliance Officer for Convercent in Denver, CO, USA.

The prevailing narrative around data privacy right now is one of fear. In light of high-profile scandals from companies like Facebook, Equifax, and Google, the discussion around data privacy is largely reactive. Consumers are calling for mass boycotts (#deletefacebook), and companies are reacting by severely restricting data access. However, although personal data privacy is crucial for our collective digital future, rushing to the extreme approach of “total lockdown” threatens the very real benefits of data access.

Take GDPR, for example. Europe’s General Data Protection Regulation (which became enforceable May 25) has one priority: strengthen data control and privacy. Lawmakers had private citizens in mind when they wrote it, with the noble goal of giving us more control over our data. But they forgot another very important (and vulnerable) group: corporate whistleblowers.

GDPR’s “right to be forgotten” article in particular could jeopardize compliance and ethics teams’ ability to conduct successful investigations — from harassment cases to retaliation monitoring and beyond. Obviously it will take years to fully assess the ramifications, but it’s important to consider GDPR’s impact on ethics investigations today so we can be as prepared as possible for what’s to come.