Category Archives: GDPR

Data Protection, GDPR

GDPR – How do we go about it ?

8 October, 2017 Chun Wong

Think I’m on a roll, this is my 5th GDPR themed post.

Here’s a more practical article that’ll help you towards alignment with GDPR.

Content for this web log.

Essentials for success.
Information Security Management Systems
What to do with old or archived PII

Essentials for GDPR Success

Educate

The C suite, the board and your employees must be made aware of the organisation’s obligations and their obligations.

Design

Ensure that your on-boarding, training, strategy, policy and procedures take into account the data protection demands of GDPR.

Accountability

Be clear on who is accountable for the data you hold and process. That you can prove that PII is correctly collected, processed, used and treated for the whole Data Life Cycle.

Red Herrings and dead-ends

GDPR is not a technology problem

You can not solve with tools alone, though they may make life easier for some tasks.

Don’t make the mistake of assigning the whole task of GDPR compliance to IT.

IT apply the controls, they’ll tell you where your data is and where it’s going.

It is not solely an InfoSec problem either, though it plays a significant role.

GDPR belongs right at the top, with the head honcho.

The CEO no less.

A significant structure like GDPR, isn’t self-supporting, it relies on good information security and well implemented information technology.

(Unless you totally paper based and you don’t use any IT systems, for processing of PII, but information security part still applies)

Unfortunately unless your process and IT maturity is realistically rated as managed or above, there is work and improvement required on the underlying technology, so that it is properly designed and operated too.

For this, a good route to take is an already established information security management system (ISMS) such as ISO27001.

Isn’t it a monster ? We can’t afford it ? It’s too disruptive!

I hear you say. No, it is designed as a framework, it is scalable. Not all of it will apply to your organisation. You don’t have to go for accreditation immediately, but it’s extra kudos if you do, something to aim for in continual improvement.

Be clear I’m not saying ISO27001, COBIT, Cyber Essentials etc are mandatory. You may be doing your own thing which is just as good or better. Although it is another level of control you may need to prove and justify.

Prioritise and Segment

Determine where your data or operations impact on the data subjects most. Deal with that first.

Old / Archived PII

Do you need to keep it for legal or regulatory reasons ?
Is there a clear and lawful reason for you to retain this information ?Do you have explicit consent to use the PII for your intended use ?

No ? delete it (properly).

If you want to keep it or re-purpose it, strip out the PII elements, so that you end up with anonymised data.

Otherwise anonymise it

Proportionality

You are not expected to spend a dis-proportionate of effort to achieve 100% data sanitisation. If the archives are properly secured it doesn’t mean you have to pull out every archive since year dot to scan for PII.

However, if it is recalled for any reason, you’ll need to ensure that the data on there is properly treated by removing the PII where necessary, for example removing people who have requested the right to be forgotten.

See Articles 35, 36 and 83 and Recitals 84, 89-96

Any other business ?

There will be more follow-ons from this one that’ll build upon what’s been said above. Examples of other things you should know and should be doing are :

What do you have in your software estate ? Shadow IT has the means of scuppering your GDPR efforts. Seek out the old MS Access databases ….
Vulnerability management
What does your network look like ?
How does your data flow ?
Are all those rules necessary on your firewall ?
When was the last time the firewall rules were audited ?
Can you show why that rule is in place and trace it back to the change request and associated approval ….?

Plenty to mull over and discuss, but that’s enough for today.

GDPR

Do you know what you have ? Do you know what you doing ?

5 July, 2017 Chun Wong

My 4th GDPR themed article. It’s designed to encourage debate and discussion, hopefully help you on the journey to GDPR compliance

Do you know what you have ?
Do you know what you doing with it ?

Two very simple questions.
Two very important questions.

If you were asked that, how would you answer ?
You can go down the philosophical route, etc.

I’ll leave that angle for another day.

This is about the nitty gritty around data protection and GDPR, so really it’s

Do you know what data you have ?
Do you know what you doing with it ?

For the organisations that can, hand on heart say,

“We are fully compliant with the Data Protection Act 1998”,

you know, the one that’s been around for nearly 20 years.

You are in a very good place.

You already comply with a substantial part of GDPR.

You have some work to do to bring it up to scratch for GDPR, but it isn’t onerous.

Well done

For the rest …

Unfortunately this probably isn’t the case.
This isn’t about a particular company or organisation; I’ve had exposure of enough commercial entities to confidently say that GDPR is likely to be a thorn in the side for many.

For some organisations, they may be able to turn it round to be a competitive advantage, a differentiator.

Your goal, is to be able to say

We know :

Who is the business risk owner for that service and it’s dependent, constituent parts (article 25).
Who owns and is accountable for the data processed for that service (article 24).
Exactly the profile of data being processed.
The amount and type of PII (personal identifiable information) in this data.
What we do with PII is legal, fair and transparent (article 12).
We don’t hoard PII unnecessarily.
We know the impact of the processing we apply to PII (article 33 for high risk processing)
We don’t transfer PII outside of the EEA without consent or other safeguards (article 44,45,46).
Who has access to the data (article 24).
Where this data is going (article 24).
Where (all) this data is stored (article 24).
Whether we have the clear legal purpose to use the PII for that purpose and not just rely on consent (article 6,7).
That it can be checked for accuracy and amended by the data subject (article 16).
That we do check the data for accuracy.
We have an easy to use mechanism to remove PII for a particular person (article 17).
We make it easy to take PII to another service provider (article 18).
We use the appropriate technical controls and techniques to ensure the confidentiality and integrity of PII (article 24,25).
We enforce a properly designed life cycle is applied to our data (article 25).
We have the means to report data breaches without delay and within 72 hours (article 55).
We can prove that we do the above (article 24,25).
Also ensure that our business partners, service providers, data processors and controllers do the above.
We have a Data Protection Officer, as we have rely on significant data processing of PII.

(The above isn’t complete … there is more)

In short we protect the rights and privacy of EU data subjects in compliance to EU GDPR.

That doesn’t seem too bad ?

Data protection, data privacy is a concept, that has to be baked into strategy, into policy and most importantly into the culture, in GDPR parlance, it has be designed (in) by default.

This is the overarching structure for data protection in the EU (and UK post Brexit).

Data Protection, GDPR

UK GDPR – Flies in the ointment and devils in the detail

28 June, 2017 Chun Wong

This is the third article on GDPR, the first dealt with Brexit and GDPR, the second confirmation that UK will be implementing stronger Data Protection.

Complications

There may be some “gotchas”, possible “flies-in-the-ointment”; the question of adequacy due to differences in equivalence and the effects of divergence.

Equivalence – EU GDPR

Overtime, you get divergence in any system if there isn’t a common control factor. Which is likely to test compatibility in the future, but for now, more importantly, what will 2019 bring us ?

The Supervisory Authority enforces the GDPR (and DPA98), the European Court of Justice (CJEU) has the final say. Post-Brexit, this is unlikely to be the case and will likely be the UK’s Supreme Court.

There are other UK laws, such a Regulation of Investigatory Powers Act (RIPA) 2000 which are not compatible with the current EU directive, so are not going to work in harmony with GDPR. GDPR allows investigations for crimes, RIPA’s definition are looser.

There is also a political element too, will the other 27 EU member countries be generous in their assessment of UK Data Protection 2019 and grant her equivalence with a few choice derogations ?

So what’s going to happen?

No one knows for sure – this is my take on it :

UK (and globally others) will have to comply with EU GDPR, by May 2018 (it’s actually in force now, but not enforced till May 2018, EU 95/46/EC was repealed in April 2016).

Post-Brexit UK businesses will have to comply with UK GDPR and EU GDPR.

What happens to the contentious bits of UK law or UK interpretation / implementation ?

UK will have to negotiate acceptance of her derogations or compromise on some aspects of internal laws.

Without this, we will not have equivalence, which may lead to data processed in another more compliant EEA member state instead, which is something we’d all prefer to avoid.

… next article

More practical aspect of GDRP – How to approach GDPR and towards the goal of compliance

GDPR – Nothing to do with us; UK is leaving the European Union, so we don’t need to do anything.

13 September, 2016 Chun Wong

(GDPR – General Data Protection Regulations 2016)

Bit of history to put things into perspective, in 1950, the Council of Europe created an international treaty to protect human rights and fundamental freedoms in Europe. Article 8 provides a right to respect for one’s “private and family life, his home and his correspondence”. The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data was published in 1980, this defined the data controller and personal information. A year later EU Treaty 108 was drafted which which espouses the Eight principles for protecting personal data. There are many other notable Acts of Parliament, including the Data Protection Act 1984 and Computer Misuse Act 1990. Let’s get to the present day.

GDPR is the culmination of efforts to update the EU Data Protection Directive, 95/46/EC that was ratified in 1995.

There are 99 articles and hundreds of recitals in the GDPR. I’ll present that in a GAP analysis in the future.

Bottomline

The Good news

The underlying reasons for having the GDPR hasn’t changed from the EU Data Protection Directive of 1995, the tenets are broadly the same.
Lawful processing, accuracy, appropriate technical controls etc still form the core of the GDPR.

However, as always, the devil’s in the details.

What has changed ..?

The reach of the new regulation is significantly extended.

The potential penalties are designed to be “effective, proportionate and dissuasive”. Based on a two-tier basis of 2%/4% of global turnover or 10m/20m Euros, whichever is greater.

Data Protection breaches will be taken more seriously.

Transparency. Accountability. Consent. Portability.
Breach notification. Certification. Data Protection Officer. Privacy by design.

Using tricks to opt people in will regarded in a negative light and is not in line with transparency.

The C suite will be accountable for Data Protection, not something which is loosely delegated to someone in IT.

Personal Data Breaches, the ICO must be notified within 72 hours.

Data Controllers must implement data portability in a commonly used format.

A Simple Checklist

Does your business collect, store or process personal data (anything that identifies an individual of the EU) ?
(That includes customer lists, membership details, medical records, delivery addresses, cookies and other identifying markers)
Does your business have customers in any EU state ?
Does your business intend to retain or gain new customers in any EU state after Brexit ?
Does your business intend to partner with EU entities that serve EU customers between now and Brexit ?
Does your business intend to partner with EU entities that serve EU customers after Brexit ?

A “Yes” or may be means that your organisation will be better placed if it aligns it’s governance and policies soon, as it is likely to take time to adopt and implement.

This is not an IT exercise – this needs to be owned at C or board level and this must be demonstrable.

Also, don’t forget that the UK is still in the EU and it will take a minimum of 2 years for Brexit to complete, which takes us into 2019, a year after GDPR is in effect.

For non-UK readers (and companies), there are no geo-boundaries to this. Your company may be based in South Africa, but if you have EU customers (non-company), you need to comply.

Some questions that need to be addressed
Will the UK retain the GDPR after Brexit ? If it doesn’t, the UK will need introduce something broadly similar if she intends to trade with the remaining EU members. Which requires time and money.

My money is on the UK adopting the GDPR and applying some judicious derogations, enough to gain some flexibility, but retain compatibility.

On a similar vein, keep any eye on how the issue with US Safe Harbor/ Privacy Shield and Ireland Data Protection challenge of model contract clauses plays out in the near future.