2. DISCLAIMER
This presentation is a commentary on the GDPR, as Ernest Staats, interprets it, as of the date of
publication. We’ve spent some time with GDPR and like to think we’ve been thoughtful about its
intent and meaning. But the application of GDPR is highly fact-specific, and not all aspects and
interpretations of GDPR are well-settled.
As a result, this presentation is provided for informational purposes only and should not be relied
upon as legal advice or to determine how GDPR might apply to you and your organization. We
encourage you to work with a legally qualified professional to discuss GDPR, how it applies
specifically to your organization, and how best to ensure compliance.
Ernest Staats, MAKE NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE
INFORMATION IN THIS PRESENTATION. This presentation is provided “as-is.” information and
views expressed in this presentation, including URL and other Internet website references, may
change without notice.
2
4. TO LEARN MORE ABOUT GDPR
There are 99 Articles, which together define the
Regulation
There are 173 Recitals
Essential how to understand how the Regulation
will be interpreted by the EU Data Protection
Authorities
To understand the Articles and Recitals
http://www.privacy-regulation.eu
Free Guides: from Taylor Wessing
4
5. 5
•Industry Best Practices
•Data Discovery &
Inventory
•Implement Security
Standards
•Enterprise Risk Register
• A shift in thinking
7. (ALL KEY ROLES HAVE A STAKE IN THE
GAME)
Controller
An Entity that
collects personal
data for some
purpose
7
Processer
An entity that
processes data
on behalf of the
controller
Controllers and Processors are to implement controls to ensure a level of security appropriate to the risk (Article 32)
8. Any information relating to an
identified or identifiable natural
person “Data Subject”
Name
IP address / MAC address
Face
All PII or ePHI
What is Personal data?
More care needs to be taken with sensitive personal
data eg. health data, religious beliefs
9. PRIVACY
NOTICE
What information is being collected?
Who is collecting it?
How is it collected?
Why is it being collected?
How will it be used?
Who will it be shared with? http://ico.org.uk/for-organisations/guide-to-
data-protection/privacy-notices-transparency-
and-control/
10. • Right to be informed
• Right to access personal data
• Right to rectification – correct
errors
• Right to erasure
• Right to restriction
• Right to data portability
• Right to object
10
RIGHTS AND REDRESS
11. FAIR AND LAWFUL
Make sure you have a
legal basis to process
personal data
Only collect what you
need
Clearly tell individuals
what personal data
you are collecting and
why
13. Appropriate technical and
organisational measures
shall be taken against
unauthorized use or
unlawful processing of
personal data and against
accidental loss or
destruction of, or damage
to, personal data.
SECURITY OF PERSONAL DATA
14. WHAT CAN YOU DO?
Use the CIS Critical Security Controls to baseline your systems
Critical-Security-Control-Manual-Assessment-Tool-v7
Security-Control-Executive-Assessment-Tool
Critical Security Control SubSet Mappings v7.0b.xlsx
Use the form below to vet your cloud vendors
Cloud_Provider_Security_Assessment_Questionnaire_Templ
ate.xlsx
Write an Incident Response Policy and Procedures
14
Absolute announced new “Free” GDPR Data Risk and Endpoint Readiness Assessments
https://www.absolute.com/en/go/reports/gdpr-data-risk-assessment to accelerate compliance with the
impending General Data Protection Regulation (GDPR
15. GDPR CONSENT
15
43 GDPR Requirements*
1. Provide notification to data subjects,
in clear and plain language.
2. Request and obtain the data
subject’s affirmative and granular
consent.
3. Discontinue with processing
activities if the data subject denies
consent.
4. Provide a mechanism for data
subjects to withdraw consent.
5. Obtain affirmative consent from a
child’s (under age of 16) parent or
guardian.
16. GDPR NOTICE
16
1. Provide notice of processing activities at the
time personal data is obtained.
2. Provide notice of processing activities if
personal data has not been obtained
directly.
3. Provide the data privacy notice at all points
where personal data is collected.
17. GDPR DATA SUBJECT RIGHTS 1-8
17
1. Provide mechanism for validating
identity of the requesting data
subject.
2. Provide mechanism for to request
access to their personal data.
3. Provide a mechanism to respond to
requests on personal data access.
4. Maintain the technological ability to
trace and search personal data.
5. Provide mechanism to request
rectification and rectify personal
data.
6. Provide a mechanism to request the
erasure of personal data.
7. Maintain the technological ability to
locate and erase personal data.
8. Track to which additional controllers
18. GDPR DATA SUBJECTS RIGHTS 9-16
18
9. When personal data is made public,
contact those entities for data
erasure.
10.Provide mechanism to request the
restriction of data processing.
11.Maintain the technological ability to
restrict processing of personal data.
12.Provide mechanism to request
copies and transmit personal.
13.Provide mechanism to respond to
data portability requests.
14.Locate personal data and export in
structured, machine-readable
formats.
15.If processing for direct marketing,
provide mechanism to object.
16.Maintain the technological ability to
19. GDPR DATA GOVERNANCE
19
1. Maintain audit trails to demonstrate
accountability and compliance.
2. Maintain inventory of data detailing
categories of data subjects.
3. Maintain auditable trails of
processing activities.
4. Carry out data protection impact
assessments of processing
operations.
5. Provide the de-identification of
personal data for archiving
purposes.
20. GDPR PRIVACY BY DESIGN
20
1. Embed privacy controls (in service
and development lifecycle).
2. Embed privacy designed to minimize
the amount of personal data
collected.
21. GDPR DATA SECURITY
21
1. Provide mechanism to
pseudonymize, encrypt, or otherwise
secure personal data.
2. Implement security measures in the
service.
3. Confirm ongoing confidentiality,
integrity, and availability of personal
data.
4. Provide mechanism to restore the
availability and access to personal
data.
5. Facilitate regular testing of security
measures.
22. GDPR COMPLIANCE MODEL
22
1. Controllers notify DPA within 72
hours in the event of a data breach
incident.
2. Controllers notify affected data
subjects of a high-risk data breach
incident.
3. Processors notify controllers without
undue delay of a data breach
incident.
23. GDPR DATA TRANSFER
23
1. Track and record personal data that
is forwarded to third-parties.
2. Provide mechanism for tracking and
recording data transfers in and out of
the EU.
3. Maintain inventory of data transfer
contracts with third-parties.
4. Provide appropriate safeguards (e.g.,
Privacy Shield) for effective legal
remedies.
Editor's Notes
There are 99 Articles, which together define the Regulation
•What’s equally important are the Recitals
›173 Recitals in total
›They provide a way to interpret the Articles
›Essential how to understand how the Regulation will be interpreted by the EU Data Protection Authorities
•To help easily navigate the Articles and Recitals, there are some great online resources
›Ex: http://www.privacy-regulation.eu
Data Inventory
•This lists what data you collect, and where you store and process that data
•Keep it simple!
•Your legal representation may have a free spreadsheet for this exercise. If not, create a spreadsheet with the following columns:
›Department
›System
›Admin
›Who is the data about
›Data Type
›Where is it located
›Who provided the data
›Why did you collect the data
•Inventory in-hand, go talk with your outside counsel for next steps
Industry Best Practices
Common Security Standard and Frameworks
A shift in thinking
Who does the data belong to
How are we going to handle data?
To comply with GDPR, organizations must know their data. There’s no way to follow GDPR without knowing about the data that one collects and processes.
Knowing one’s data is essential to protecting it. An organization must understand the type of data it has, why it has it, how it is used, and with whom it is shared, among other things. This is the first step to getting a handle on data protection
You’ve just inventoried your data (Data Inventory). We now need to understand what risks are associated with personal and sensitive data
•Identify which data is high risk, and which is critical risk
•If you don’t have a Risk Register, you can easily create one with the following columns:
›The data set
›The vulnerability associated with that data
›The threat associated with that
›Likelihood of the threat
›Impact of the threat
›Recommended control(s)
Both Data Controllers and Processers must
Detect & prevent a personal data breach, which is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data (Article 4)
GDPR looks for controllers and processors to implement controls to ensure a level of security appropriate to the risk (Article 32)
Controller
“The natural or legal person, which, …, determines the purposes and means of the processing of personal data.”
Processer
“a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.”
the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.”
Solution Purveyor
CSV
ISP
Consultant
Data protection law applies when your Org, as data controllers are processing personal data.
What is personal data?
It includes any records, as well as information held and used about identified or identifiable natural persons. CCTV images, website photos and information, apps, etc. Paper-based and digital.
Personal Data (from GDPR)
“…means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
“Processing” refers to anything you do with personal data – collecting, using, analysing, sharing, and disposal.
The GDPR defines personal data quite broadly. According to the GDPR Article 4, personal data is “any information relating to an identified or identifiable natural person.”
Many privacy laws cover identified people but fail to adequately cover identifiable people. In contrast, the GDPR has a broad definition of identifiable: “[A]n identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.”
It is alarming how much data that we think isn’t linkable to a person can actually be linked to that person. The GDPR understands this; many other privacy laws don’t
Privacy notices are an important and necessary way of being transparent and telling parents, pupils and staff what you’re doing with their information.
You should have a clear privacy notice and make people aware of it, in a way they’re likely to see and understand – for example, on your website, on your noticeboard, in communications with parents and staff. It should tell people the detail in the bullet points on the slide.
make sure you tailor any templates you use so that they clearly and accurately reflect what you do with people’s data.
You’ll also have to consider how you provide privacy notices to staff, about what you do with their data.
Our recently-updated guidance - Privacy notices, transparency and control code of practice - is a must-read to help you comply in this area.
Right to be informed about the person data organizations have about them
Right to access personal data
Right to rectification – correct errors in personal data or add to incomplete records
Right to erasure (aka “the right to be forgotten”)
Right to restriction on processing of personal data
Right to data portability
Right to object to the processing of personal data
Over the next few minutes, we’re going to highlight some of the principles in a bit more detail to see how they apply to what schools do, and what you need to do about it.
Principle 1 requires that:
Personal data shall be processed fairly, lawfully and in accordance with an appropriate schedule condition (2 or 2&3)
Make sure you have a legal basis for the processing:
Lawful – don’t break any other law e.g. common law duty of confidentiality; Human Rights Act
Need a good legal justifiable reason/basis for the processing. In the DPA these are found in schedules 2 and 3 - for processing personal data you must identify a relevant schedule 2 condition that applies, and if the personal data is sensitive (health, racial or ethnic origin, religious beliefs, criminal offences, sexual life, etc) a relevant schedule 3 condition must also apply.
Example conditions that schools may currently rely on are:
- necessary for a legal obligation
- necessary for a function of a public nature exercised in the public interest
- consent
Note that most of the conditions require the processing to be ‘necessary’ – this means you should only collect and use what you need for your purpose.
Fair:
No unwarranted detrimental effects on individuals
Within the reasonable expectations of users whose personal data it is.
Clearly tell them what you’re doing with their data. Privacy notices and other, more innovative ways.
This is also an important principle when deciding if it’s OK to share / disclose information to, other organisations.
Image used with permission from https://www.serveit.com/gdpr-for-developers-data-protection-by-design-and-default/
Article 25 of the GDPR mandates that data protection be built in starting at the beginning of the design process. This means that data protection cannot be an afterthought and must be documented.
By default, only personal data necessary for each specific purpose of the processing should be processed. Default settings should be set so that personal data isn’t accessible to an indefinite number of people.
To comply, you need to ensure that your organization has taken appropriate technical and organizational measures to protect the personal data it processes.
Think about all the personal data you hold:
Manual records – what files do you have? How can you keep these appropriately secure?
- where do you store them? (locked cabinets, locked rooms etc)
- who has access to them? (staff, other third parties?)
- Have you got any stored away in an archive?
- Do you securely destroy records in line with a retention policy?
- How do you transport them if needed?
- What about if you need to share information? How is it sent? Do you know if it’s been received by the correct recipient?
- Do staff need to take records out of the office, for working at home or at other premises? Do you allow this?
What about electronic files and portable devices? –
- lots of what we have already said already applies
- are the files / devices encrypted?
- do you have a secure password policy that staff stick to?
- do you have role-based access controls with individual logons?
- what about uploading or sending data to other organisations when you need to, what mechanisms do you use? Are they secure?
- do staff have the ability to access internal systems and data outside of organization? How?
- Do you allow BYOD (bring your own device)?
Examples of security incidents we’ve seen:
Human error, often combined with inadequate policies in place:
Full attendance record mistakenly sent to new employer as part of a reference
Letters and emails sent to the wrong clients, staff, including, disciplinary, health and other sometimes sensitive information
Sensitive personal data lost in the post –
- personal data found at printer by another staff or client
Staff or client reports sent to the wrong address
- email addressing - non-use of BCC where it would have been appropriate
- text message re staff behaviour meant for supervisor sent to wrong person in error
- data file with staff and client personal data accidentally placed in shared drive
- spreadsheet uploaded to website - full details of sensitive information
Technical measures - passwords
passwords to access sensitive information not sufficiently strong
Technical security measures
website security - personal data accessible. Insufficient pen testing, inaccurate coding
sending sensitive information via unprotected email
- lost unprotected USB sticks including sensitive private data
- unencrypted drives / laptops / devices stolen from homes / cars / bags
website hacked, administrator passwords stolen. One staff used the same password for their website administrator access and their access to the main organization database. Hackers accessed information from the database.
The seventh principle also sets out the requirements for when you use data processors (as we mentioned before, for example using Iron Mountian or other system providers for processing your data, using shredding companies to shred confidential paper waste, using cloud IT providers)
When you use a data processor, the seventh principle requires:
- that you choose a processor who offers sufficient guarantees that they can look after your data properly
- that you have a written contract in place setting out that the processor keeps the data as secure as you would have to under the law, and that they are to only process data in they way you instruct them to
- that you take reasonable steps to ensure that the processor complies
“…organizations must demonstrate that they have implemented appropriate measures to mitigate privacy risks. Even in the absence of a privacy breach or customer complaint, regulators may require firms to exhibit evidence of their compliance and risk management strategies, including a privacy impact assessment (PIA) when appropriate.”
Source: Brief: You Need An Action Plan For The GDPR; Forrester Research; October 2016