GDPR - a view for the non experts

EU General Data
Protection Regulation
A N NO N EXPERT INT ERPRETATION T A RGETED T O MA NUFACTURING/B2 B CO MPA NIES
C L A U D I O B O L L A

Personal introduction and disclaimer
I have been working for over 20 years in the Information Technology space in various countries
and roles. In the past 5 years I specialized in IT Security, obtaining formal and professional
certificates on the subject, I am not a lawyer and this presentation is not to be considered a legal
advice, but it mean to provide additional insight onto the topic!
In the last 20 plus months I followed closely the various GDPR discussions and presentations.
None seemed to be geared toward the manufacturing sector and to companies that work in the
B2B space, where there is restricted amount of personal data.
This presentation is my collected knowledge on the topic gathered during the past months from
various presentations I attended and from my interpretation of the written regulation.
The document is not a guide, but a tool geared toward manufacturing industry and small
companies that operate in the B2B space. Where I try to bring a logical vendor neutral view of
what is required and how it may affect companies.
This presentation will help you to rationalize and better judge vendor or expert advice that you
will anyway require

Introduction
There is a lot of talk about the new EU Regulation on Personal data…
◦ It will be implemented in the upcoming months
◦ All companies will need to adapt and adjust to comply
Data protection may become as important in internal compliance efforts as is
antitrust compliance today (but it will require much more efforts)
The Regulation is not prescriptive and will need some interpretation
◦ It does not state how and when to protect data
◦ It does not impose a process or security measure to data processing
◦ It only defines what data has to be protected and what needs to be communicated
Data Protection is a Business process and risk objective
◦ IT & Information Security provides the technical measures to mitigate the risk and comply with
regulation for electronic stored data (the regulation applies also to physical/paper data)

Key points (1/2)
Under EU law, any processing of personal data requires a justification
◦ (e.g., consent, compliance with law, legitimate interests)
Territorial applicability:
◦ The GDPR also applies to all EU entities and many foreign companies working with EU data
Personal data: Definition widened (i.e. less room for anonymization)
◦ Anything that identifies directly or indirectly a physical person
Consent: Conditions for valid consent become stricter
◦ You need explicit consent
Information obligations:
◦ Much more information has to be provided that in previous regulations

Key points (2/2)
Data subject rights: Data subjects get new access and intervention rights on the use
and purpose of the data
Governance: The work load in particular regarding the documentation increases
◦ Need to keep track of explicit consent, need to do a Privacy Impact Assessment
Buzzwords: Privacy by Design in developing applications and tools
Sanctions: Severe sanctions
Time to national law: May 22, 2016
◦ EU Regulations are applied straight into national law without additional requirements
Time to implement/enforce: May 25, 2018
◦ Time by when companies and governments need to be ready to comply and to audit.
◦ No apparent extension is foreseen or published (at least not at this stage)

Who is covered by the GDPR?
All EU based companies (including UK based)
Many non-EU companies who hold or process EU citizen personal data
Whoever participates in processing activities of companies in the EU
Whoever processes data of clients who are served and located in the EU
Whoever analyses the activities of EU visitors of its own website or app
But: The applicable rules are not the same for companies outside the EU
◦ Concept of a "lead authority" (for the purposes of a one-stop-shop) does not apply, i.e. each authority can act in a competing
manner (within its territory)
◦ Foreign company may not be able to rely to exceptions and justifications set forth by EU law (i.e. Union or member state law)
(e.g., Art. 6(1)(c), 22(2), 23)
◦ Obligation of foreign companies to designate a person within the EU, who "represents" them "with regard to their respective
obligations" (cf. Cons. 80)
◦ But: Direct enforcement of administrative measures and sanctions against companies outside of the EU may not work legally
and practically

Who is covered by the GDPR?
1 Controller
2 Processor
3 Controller or
Processor
Monitoring Behavior Offering of goods
or Services
Participation
Participation
Choice of law
1
2
3

Talking about sanctions ...
Each (national) authority may issue administrative sanctions
◦ They shall be "effective, proportionate and dissuasive"
◦ Concerning governance & data of children: EUR 10m or 2% of worldwide turnover, whichever is higher
(revenue of the legal entity at issue, not the entire group)
◦ With regards to substantive breaches of regulation: EUR 20m or 4% of worldwide turnover (tied to Group of
companies and not legal entities)
If administrative sanctions are not possible, other penalties are permitted
Authorities have the powers to intervene against data processing activities
◦ They can temporarily or permanently stop a certain data processing
◦ They are obliged to deal with each complaint of a data subject
◦ Data subjects can enforce their rights and claims (e.g., damages) by court Associations can act on behalf of
data subjects or on their own
Note: Non-EU countries already have or will have sanctions, as well
Applies also to manufacturing/B2B

Personal Data - Definition
Legal entities and related data do not fall into the definition
of personal data
Most of B2B data will therefore be personnel related
But not only!!
The EU increasingly follows
an "absolute" approach
with regard to the
definition of personal data

Consent
Relevance: Apart from the performance of a contract, a legal obligation and "legitimate interests",
consent is the most important grounds for data processing
Consent must be presented clearly distinguishable from other matters
Consent can always be withdrawn (with effect for the future; right to erasure)
Consent that has already been validly obtained in the past continues to be valid (need to have proof).
Shall the consent provided
within a contract be
optional with regard to all
data processing activities
that are not necessary for
the performance of the
contract (Art. 7(4))?
Will Manufacturing/B2B need to request consent
to all physical persons for data processing?
Including Employees ??

Information duties
Principle of transparency is supplemented by an obligation to inform on a number of
defined points
◦ To the extent the data subject has not yet been informed
◦ Also applies in case of indirect data collection (max. 1 month), except where it is impossible, result
in a disproportionate effort or defeats the purpose (in which case alternatives such as information
on a website shall be pursued)
◦ Obligation to inform also applies in case of (later) secondary purposes
Consequence: Extensive privacy notices become mandatory
◦ Upon first contact or collection
◦ On the website for all cases of indirect data collection not covered otherwise
◦ Few exceptions, such as internal investigations
Pro memoria: An obligation to inform may also exist in cases of data breaches
Applies to manufacturing/B2B

Inform on what? (1/2)
Name, contact details of the controller and data protection officer
Purposes of use, data categories, categories of recipients (if any)
Legitimate interests, if relied upon
Whether exports are intended, whether to a whitelisted country, and if not, where
the data subject can obtain a copy of the safeguards used
Data sources (if data is collected indirectly)
Period for which data will be stored (or criteria used to determine it)
Manufacturing and B2B will need
to inform employees and 3rd
party of the data processing and
related changes in the processing
For example change in payroll provider or new
location of data repository

Inform on what?
Information on the right of the data subject for access, rectification, erasure, restriction,
objection and data portability
Right to withdraw a consent (and eventually the consequences)
Right to lodge a complaint with the supervisory authority
Whether the data requested is necessary for the performance of a contract and
the consequences of not disclosing the data requested
Automated decision-making (including profiling), the logic and consequences

Data subject rights
Data subject rights are significantly extended and become more complicated
◦ It remains unclear to which extent data subjects will make use of them
◦ They may require changes to data processing procedures and systems
All requests must be complied with at no charge and within one month
◦ Extension of deadline is possible by two months
◦ In case of "manifestly unfounded or excessive" requests it is possible to
◦ charge a reasonable fee or refuse to act upon the request
◦ Previous data recipients may have to be informed of the request
Right of access and data portability (= return of own data)
Right to rectification
Right to erasure ("right to be forgotten"), restriction (= partial usage ban) and objection (= complete
usage ban)
Right to "human intervention" in case of automated decision-making

Erasure, restriction and
objection
Are you able to erase data from your systems in case a data
subject withdraws his or her consent you have relied upon?
Are you able to suspend the processing of data where you failed
to fully comply with the GDPR, where the accuracy of the data
is contested or where an objection has been filed?
Which data do you really need for the establishment, exercise
or defense of legal claims or compliance with EU law (the two
main reasons you have for justifying not to delete data upon
request)?

Data portability 1/2
Five preconditions (cumulative)
◦ Personal data of the data subject
◦ Provided (by the data subject) to a controller (not just processor)
◦ Processing is based on consent or a contract
◦ Processing is carried out by automated means
◦ Rights and freedoms of other persons are not adversely affected

Data portability 2/2
What can the data subject ask for?
◦ Return of the data in a "structured, commonly used and machine-readable format" in
order to pass it along to another controller
◦ Where technically feasible to have it transmitted directly to the other controller
A typical use cases are still unclear, but may include
◦ Doctors (patient data)? Banks (orders)? Auction platforms (offerings)? Telcos (CDRs)?
Online-shops (past orders)? Employers (job application data & payroll)?
May apply to manufacturing/B2B
depending on the data

Automated decisions, profiling
Prohibition or a right to object?
Option 1: Profiling or automated decisions are used only where they do not produce legal or similar effects to the data
subject (e.g., personalized ads)
Option 2: Profiling or automated decisions are used only for entering into or performing a contract, without sensitive
data, and the data subject has the right to present his or her view to a human and have the decision reconsidered
Option 3: The explicit consent is obtained beforehand, and steps are taken to deal with its withdrawal; human
intervention must still be possible
The provision aims at automated credit- or
e-recruitment decisions without human
intervention, but applies to many other
cases, e.g., personalized prices, activation of
software, security monitoring
Should not apply to manufacturing/B2B
depending on the data

Governance 1/2
Concept of "accountability": Controller has to be able to "prove" its compliance
Contracts with processors: Detailed requirements as to what the contract has to
cover, but not many changes in substance (exception: veto on sub-processors)
Maintaining records of processing activities becomes mandatory, also for
processors; the minimum required content corresponds plus/minus to what is
required pursuant to Art. 11a DPA, plus information on exports, retention
periods, and technical and organizational measures undertaken

Governance 2/2
Obligation to undertake a formal privacy impact assessment (PIA) in case of
likely "high risk" projects, and to prior consultation of the supervisory authority
if the project is indeed of a high (privacy) risk high absent mitigation measures
If the business of a company is based on the monitoring of individuals or on the
processing of sensitive data, then a data protection officer must be appointed

Data Breach Notifications 1/2
All breaches against measures to protect personal data have to be recorded and
– if privacy risk to data subjects are likely – notified to the supervisory authority
(within 72 hours)
What has happened? Who is affect? Consequences? Measures? Contacts? The
provision focuses on IT security breaches (hacking, data theft, wrongly sent e-
mails, invoice mix-ups), but can also apply to other violations of data protection
provisions (e.g., use of data in violation of binding instructions)

Data Breach Notifications 2/2
Notification of data subjects is necessary (only) in case of a high risk to them
◦ Not necessary in case of measures to prevent access by third parties (e.g., encrypted
data) or if the risk has in all likelihood been eliminated
If informing involves a disproportionate effort: A publication of the notification
or an "equally effective" measure is possible, too
Data Encryption does not remove the requirement to notify

The privacy buzzwords ...
Data minimization (Art. 5 GDPR)
◦ Collect, use, store and other process data only insofar adequate, relevant and necessary
for the purpose (f.k.a. "principle of proportionality")
Privacy by Design (Art. 25 GDPR)
◦ "... implement appropriate technical and organisational measures, ..., which are
designed to implement data-protection principles, such as data minimisation, in an
effective manner ..."

The privacy buzzwords ...
Privacy by Default (Art. 25 GDPR)
◦ "... implement appropriate technical and organizational measures for ensuring that, by
default, only personal data which are necessary for each specific purpose of the
processing are processed."
By default, personal data should not be made accessible without the individual's
direct and explicit intervention

Privacy by Design
(1) Taking into account the state of the art, the cost of implementation and the
nature, scope, con-text and purposes of processing as well as the risks of varying
likelihood and severity for rights and freedoms of natural persons posed by the
processing, the controller shall, both at the time of determination of the means for
processing and at the time of principles, such as data , in an effective manner and to
integrate the necessary safeguards into the processing in order to meet the
requirements of this Regulation and protect the rights of data subjects.
To summarize… you need to, when necessary, build into all new system or
applications or processes the necessary protection against the lost of personal data.
All clear…?
Easier: Art. 7 para. 1 CH DPA
Applies to all including
manufacturing/B2B

Exporting Data (to other countries)
The good news: Exports that are permitted today in principle remain permitted
also under the GDPR
Concept of adequacy decisions by the European Commission remains
◦ Existing decisions keep their validity; Switzerland and Canada has the right to be found
adequate provided it complies with the revised CoE Convention 108
Concept of contractual safeguards and binding corporate rules (BCRs) continues
to work for unsafe third countries (Including USA, despite the safe harbor
decision)
◦ BCRs are still subject to approval by the National supervisory authority
◦ EU model clauses continue to be valid (but are likely to be revised)

Exporting Data
Exports to unsafe third countries may also be undertaken on the basis of
approved code of conducts and approved certification mechanisms
The provisions are only of limited relevance for exports from non-EU countries
The new GDPR concepts are already supported by the existing DPA
Manufacturing/B2b may exports personal data to the USA
Example include: eMail address book, HR data and data contained in ERP systems and
unstructured data

WHAT
do we
need to do?
INTERPRETATION OF KEY POINTS INTO TANGIBLE ACTIONS

 Group data protection
policies
 Establishing group-wide data
protection policies step-by-step
 Start with a general data protection
policy, then continue with policies
for key areas and applications such
as HR, data from website and
consumers
 Local law adjustments where
required
 Definition of responsibilities for data
protection compliance (1st, 2nd and
3rd line of defense), including local
law obligations (e.g., local
registrations|filings)
 Group-wide data protection training
program for dealing with personal
data
 Integration of policies into the IGDTA
framework, local management to put
in place policies
 As opposed to the IGDTA, the
policies define standards that Group
companies must abide to also for
their own personal data (e.g., HR
data), even when stricter than local
law
 Inventory of data files and
data processing procedures
 Centrally documented the way
how the Group and its entities is
collecting, using, storing, disclosing
and otherwise processing personal
data
 Centrally documented Group data
protection compliance, including
local authority filings, etc.
 Part of this task will have to be done
already for the purpose of creating
data protection policies
 Also focusing on decentralized
data files since they are likely to be
processed with less care and
coordination than in the case of
Group wide applications
 Task requires local assistance; can be
performed by the local data
protection coordinator
 Allows early identification of
data protection issues
 Easier compliance with legal
standards (e.g., obligation to notify
or register with data protection
authorities)
 Data Protection Officer and
standardization of
compliance procedures
 Key procedures/tasks to ensure
compliance with data protection
policies and legal requirements are
standardized (instead of ad-hoc and
potentially
 inconsistent handling of issues)
 Shall cover data subject access
requests, data protection review of
new projects, IT applications and
reviews of third party contracts for
data protection compliance
 Creation of standard clauses for
service provider contracts, data
subject requests, etc.
 Group data protection officer as a
center of competence with a
network of local data protection
compliance managers
 Early identification of Group internal
data protection issues and
developments in the legal
environment and ability to approach
them strategically
 Defined procedures for regular
audits of Group entities and service
providers
 Intra-Group Data Transfer
Agreement (IGDTA)
 Multilateral data agreement that
regulates Group internal cross-
border and outsourcing transfers
 Serves a nucleus for establishinga
global data protection governance
framework
 Ability to cover all data within the
company as well as all entities ("big
bang" or "step-by-step")
 A proven, cost effective approach
already followed by many other
multinationals
 Recognized by the European
Commission and the European data
protection authorities
 Roll-out possible within six months (if
no local pushback)
 Does not limit Group companies in
the processing of their own data; it
only sets forth rules on how they
have to treat data of other Group
companies and does so based on
Group policies
 Appointment of local data protection
coordinator for local implementation
and notifications with authorities
 Data Protection
Management System (DPMS)
 Implement a Group wide data
protection management system, i.e.
the necessary documentation and
processes to ensure that data
protection compliance (prevent,
detect, respond violations) is done
systematically instead of ad-hoc and
that any need for changes to the
processing of data is addressed early
on
 All procedures involving the
processing of personal data have
been documented, have been
reviewed and adapted for
compliance with applicable data
protection laws and group policies
and the IGDTA, where stricter, and
are periodically reviewed for
improvement
 All systems used for processing
personal data shall provide an
adequate level of data security in
line with the recommended controls
and measures as per the ISO 27001
standard
 Eventually, the Group may have
certain aspects of its data protection
compliance externally audited and
certified
1A Real MUST 2 Must have 3 Should have 4Good to have 5Nice to have
Situation pre – GDPR

Setting the Stage 1/2
Most companies have achieved only level 1 and/or 2 (in the past)
◦ No end-to-end data protection governance
◦ Data protection is handled ad hoc, and most companies can live well with it
The three biggest challenges…
◦ Establishing the information necessary for assessing the situation
◦ Where is the data, what is the purpose, what
◦ Lack of (human) resources and internal cooperation (IT, business, legal)
◦ Amendments of IT systems and business processes, and eventually the need to give up
the processing of personal data that can no longer be justified
◦ ie storing in any form the health status of the client contact and/or it’s family

Setting the Stage 2/2
Pressure on the part of the to management should increases due to the
sanctions
But: The GDPR follows (and permits) a risk-based approach (whereas "risk"
refers to the data subject's privacy risk)
◦ No company will be able to comply with the GDPR in every respect
◦ The risk have to be recorded, assessed and accepted.

ImplementPrepare Organize
 Manage consent
 Determine request
handling procedures
 Remove old data where
possible
 Identify and document
processing purpose
 Conduct Risk Assessment
 Train all (key) staff
 Appoint a Data Protection
Officer*
 Review privacy policies
 Prepare breach notification
How to Handle the issue
 Identify processes
impacted
 Assemble a team  Appoint mandated
owners
 Document risks
*DPO is a subject matter
expert and coordinates the
ongoing compliance
Can be an external roleHow to handle the issue

General steps to undertake 1/2
Create/appoint a data protection office/officer
◦ A subject matter expert is required (even if not mandated by law)
◦ This figure is a legal expert, located within region, can be external and represent the organization
(organization can be legal entities or business units or group), depending on organization it can become a
full time role or can be outsourced
Document data processing activities and data protection compliance measures
◦ What data the company collects, why and who is responsible, where is stored and how we
protect it (both in physical or electronic format).
Data protection notices (internal, external), contracts with clients and other
information have to be reviewed; options going forward need to be determined
Consent declarations need to be review and amended going forward
Contracts with providers (and templates) need to be reviewed and amended

General steps to undertake 2/2
Processes and policies in case of data subject requests are to be established
Processes for assessing new data protection activities need to be created;
guidelines for "privacy by design" and "privacy by default" are to be defined
Data transfer contracts with group companies and partners are to be reviewed
and changed, or entered into, to the extent they do not yet exist
◦ Technical and organizational data security measures are to be verified and updated; a
process for handling data breaches is to be established
Check on the need to designate an EU representative as per Art. 27 GDPR

Final thoughts
Things are never as bad as advertised! – this also is true with the GDPR
◦ Administrative sanctions will be proportional (this does not mean that you should not do anything!!)
But: Unclear operational rules increase the risk of misunderstandings
◦ Improvements in data governance and compliance are required throughout the company
Even if there won't be many changes in substance to company processes
◦ Data protection may become as important in internal compliance efforts as is antitrust compliance today (but it will
require much more efforts)
Risk-based approach is essential
◦ Works only when you understand your own data processing activities
External support helps, but internal resources are nevertheless necessary
Regular Training will be required on this subject to remain compliant over time

GDPR - a view for the non experts

Recommended

Recommended

More Related Content

What's hot

What's hot (18)

Similar to GDPR - a view for the non experts

Similar to GDPR - a view for the non experts (20)

Recently uploaded

Recently uploaded (20)

GDPR - a view for the non experts