On the 25th May 2018, all businesses across Europe and the UK will face dramatic changes to Data Privacy Laws. With fines of up to 4% of revenue for noncompliance, GDPR has huge potential for disruption if not adhered to. The GDPRforum was held on 1st Sept 2017 to gain valuable insight from Data Privacy experts, teach people how to prepare for the new laws, and how to turn a crisis into an opportunity. The forum was held at the iconic British Airways i360 for an afternoon dedicated to GDPR. During the forum, our attendees learnt about handling Data Privacy from brands like eBay, Irwin Mitchell, and Pragmatic. Our experts offered practical advice on preparing for the new laws, and how to turn a crisis into an opportunity! GDPR Speakers: David Lockie – Pragmatic – Founder Dan Hedley – Irwin Mitchell – Partner Gilbert Hill – Independent Privacy Technologist Ben Westwood – eBay – Senior Privacy Manager & Data Protection Officer UK (Slides coming soon)

2. David Lockie // GDPR Forum // September 2017

5. ●
●
●
●

7. ●
●
●

9. ●
●
●
●

15. ●
●
●

16. ●
●
●
●
●
●

17. ●
●
●
●
●
●

19. ●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●

20. ●
●
●
●
●
●

24. The Myth
- The Sun, 28 July 2017

25. The Reality
“Predictions of massive fines under the GDPR that simply scale up
penalties we’ve issued under the Data Protection Act are nonsense.
Don’t get me wrong, the UK fought for increased powers when the
GDPR was being drawn up. Heavy fines for serious breaches reflect
just how important personal data is in a 21st century world. But we
intend to use those powers proportionately and judiciously.
And while fines may be the sledgehammer in our toolbox, we have
access to lots of other tools that are well-suited to the task at hand and
just as effective.”
- Elizabeth Denham, Information Commissioner, 9 August 2017

27. The Myth
“You have to have consent to process personal data.”
- Nearly everyone, all the time
For example…
“The Data Protection Bill will require explicit consent to be
necessary for processing sensitive personal data.”
- An actual DCMS press release (no, really)

28. The Reality
• Consent is one possible basis for processing personal data.
• There are 5 others: contractual necessity, legal obligation, protection
of vital interests, public interest necessity and legitimate interests
– “Special categories of data”
• Consent is basically only really useful where you can’t rely on any of
the others – typically, in relation to direct marketing.
• Consent is hard to get right, and easy to lose.
• Basically, consent is rubbish.

30. The Myth
“It’s all ok as long as you have consent.”

31. The Reality
• You probably don’t have consent, actually
– Or at least, not for as much stuff as you think you have!
• Consent might be legal basis on which you process, but you still
have to do that processing in accordance with GDPR e.g.
– Fairly, transparently
– Purpose limited
– Accurate and not retained for longer than necessary
– Kept safe and secure
– Record keeping
– Rights exercise

33. The Myth
“Data protection is an IT issue.”
“Buy this ‘thingy’ and you’ll be compliant.”

34. The Reality
• Data protection is a boardroom issue
• IT is involved, but so are Operations, HR, Sales, Marketing…
• There is no turnkey technology solution to GDPR compliance
– People and process first
– Technology tools can help with particular issues e.g. data
discovery, record keeping, data housekeeping, security

36. The Myth
“All businesses have to appoint a Data Protection Officer.”
“All businesses with more than 250 employees have to
appoint a Data Protection Officer.”
…or some variation on that theme.

37. The Reality
• Most businesses will not be obliged to appoint a DPO
• You must appoint a DPO only if:
– You’re a public authority
– Your core activities require regular and systematic monitoring of
data subjects
– Your core activities consist of large scale processing of special
categories of data
• Otherwise, don’t have to… but might want to anyway?

39. The Myth
“All data breaches have to be reported within 72 hours.”

40. The Reality
• Not a straight myth, but only kinda true
• Data breaches much be reported to the ICO by the controller
UNLESS “unlikely to result in a risk to the rights and freedoms of
natural persons”
– Encrypted?
– Retrieved unopened?
– A bunch of corporate email addresses?
• Obligation is “without undue delay and, where feasible, not later than
72 hours after having become aware of it”
• Must give (good) reasons if late

41. A few things that aren’t myths
• Extraterritorial effect
• Primary obligations for data processors
• Record keeping
• Transparency
• New subject rights
• New contractual requirements for processors
• More prescriptive security requirements

42. If watching a bunch of lawyers getting
apoplectically angry is your idea of a good
time…
#GDPRubbish

44. GDPR – from Threat to Business
Opportunity in 30 minutes

45. GDPR – New Kind of Superhero Required

46. Privacy 1:0 – The Cookie Monster

47. Audit, Transparency & Learning

48. GDPR – ‘The Marathon’
• Europe-Wide – Unified
• Big Fines, Bigger Brand Fallout
• Data Breaches – 72hrs to comply
• Data Privacy & DPO’s – An Inside Job
• A Journey with No Destination – Beware FUD-Mongers & ‘Experts’

49. Consent & Processing

50. What Is Consent Under GDPR?
• “Any freely given, specific, informed and unambiguous indication of his/her
wishes, by which the data subject, either by statement or clear affirmative
action, signifies agreement to personal data related to them being processed”
• “Affirmative Action”
• “Freely Given”
• “Specific & Informed”
Consent is contextual, not absolute

51. Withdrawing Consent & Data Portability

52. Article 30 – Data Hoards & Record Keeping

53. Article 30 – What you need to Know & Show
• Name & Contact details of Controller
• Purpose of the processing
• Description of categories of data subjects and data
• Recipients to whom data will be disclosed including 3rd
parties
• Transfers of personal data to another country
• Time Limits – ‘shelf life’ for retention of data
• Security around how data is held

54. Transparency: Informed Choice = Best Sense

55. Wetherspoons Pubs Email - high Risk vs Return?

56. Keep Learning…
• Train & get staff onboard
• Bake into brand values, educate customers
• Admit vulnerability – we’re human!
• Don’t overlook offline
• The Weakest Link – tough questions for suppliers
• Speak with competitors

57. Enjoy Data Responsibly
• Thanks!
• Gilbertmhill@gmail.com
• Twitter: @gilbertHill