BigID IAPP webinar on data-driven enterprise privacy management
0 likes226 views
This document summarizes a presentation on automating GDPR compliance. It discusses how risk assessments and data protection impact assessments can help organizations meet GDPR accountability requirements. Risk assessments can identify what personal data is processed, for how long, and its uses. They should be reviewed by privacy teams and can be automated. Data protection impact assessments may be required for high-risk processing. Maintaining records of risk assessments and data protection impact assessments can aid with data subject rights requests and regulator questions.
BigID IAPP webinar on data-driven enterprise privacy management
- 1. www.iapp.org Thursday, November 2, 2017 Time: 11:00 a.m. - noon EDT 3:00 - 4:00 p.m. UTC Beyond PIAs: A Tutorial on Automating GDPR Compliance
- 2. www.iapp.org Welcome and Introductions Host: John Howie, CIPP/US, CIPT Chief Privacy Officer, Consumer BG Huawei Panelists: George Chedzhemov, Director of Client Success BigID 2 Dave Cohen CIPP/E,CIPP/US Knowledge Manager IAPP
- 4. www.iapp.org Laying Groundwork for Compliance with the GDPR 4
- 5. www.iapp.org Accountability in GDPR • Art 5 2.: The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). –Lawfulness, fairness, and transparency; Purpose limitation; Data minimization; Accuracy; Storage limitation; and Integrity and confidentiality • Accountability is met through documentation –Beyond what is called for in Art. 30 Records of Processing Activity –Documentation may be in writing or in electronic form 5
- 6. www.iapp.org Data Protection Impact Assessments (DPIAs) • DPIAs can assist with some accountability requirements but most organizations will not perform them routinely –GDPR call for DPIAs to be performed when there is a high risk to the rights and freedoms of natural persons from data processing • Best practice calls for a Risk Assessment (RA) to be performed in all processing activities –Can leverage automation to gather information about processing activities, data, etc. –RA can feed into a DPIA if one is ultimately required 6
- 7. www.iapp.org Information gathered in a RA • A RA can be performed by product teams, and can identify: –Personal data elements processed (e.g. name, D.O.B., address, salary, etc.) –The length of time data will be kept for –The uses to which the data will be put –Where the data will be (is already) stored and/or transferred to • RAs should be reviewed by Privacy teams for risk/follow-up –Review can supplement information with legal basis, etc. • Automation to gather/store/process RAs can greatly help 7
- 8. www.iapp.org Consent • When Consent is Legal Basis for processing of personal data: –Consent must be a freely given, specific, informed, unambiguous indication of the data subject’s wishes… (Art. 4 (11)) –The “…controller shall be able to demonstrate that the data subject has consented…” (Art. 7 1.) –Additional data subject rights are provided for • Data subjects must be able to easily withdraw consent –Implications for use of data, etc. • Consent is also a valid derogation to enable data transfers outside of EEA 8
- 9. www.iapp.org Personal data breach response • Art. 33 and 34 specify requirements to notify supervisory authority and data subjects –Personal data breach is a broad term –Not every breach needs to be reported • RA/DPIA documentation can be used to determine whether or not notification is required, and to whom –Based on risk to data subjects, datasets that may have been compromised, etc. 9
- 10. www.iapp.org Data subject rights • RA/DPIA documentation can be aid when data subjects exercise their rights –Good documentation will detail: • What personal data is processed • Where data is stored and transferred to • Whether or not decision-making/profiling is taking place • Consent as legal basis modifies rights –Withdrawal of consent prohibiting further processing, data portability, automated decision making, etc. 10
- 11. www.iapp.org Maintenance of records • RAs/DPIAs should be revisited on an as-needed basis, e.g.: –When volume of data changes –Product or service updates or features are added or withdrawn –When technological changes are made (including storage locations) • RAs/DPIAs can be part of your Records of processing activities –Not required, but a best practice of end-to-end documentation • Well maintained records are easy to show to regulators –Stored in central location, accurate, complete, etc. 11
- 12. www.iapp.org Questions and Answers Host: John Howie, CIPP/US, CIPT Chief Privacy Officer, Consumer BG Huawei john@thehowies.com Panelists: George Chedzhemov, Director of Client Success BigID gchedzhemov@bigid.c om 12 Dave Cohen CIPP/E,CIPP/US Knowledge Manager IAPP dave@iapp.org
- 13. www.iapp.org Thank You to our Sponsor Speakers and Participants 13
- 14. www.iapp.org Web Conference Participant Feedback Survey Please take this quick (2 minute) survey to let us know how satisfied you were with this program and to provide us with suggestions for future improvement. Click here: http://www.questionpro.com/t/AL2CRZa13s Thank you in advance! For more information: www.iapp.org 14
- 15. www.iapp.org Attention IAPP Certified Privacy Professionals: This IAPP web conference may be applied toward the continuing privacy education (CPE) requirements of your CIPP/US, CIPP/E, CIPP/G, CIPP/C, CIPT or CIPM credential worth 1.0 credit hours. IAPP-certified professionals who are the named participant of the registration will automatically receive credit. If another certified professional has participated in the program but is not the named participant then the individual may submit for credit by submitting the continuing education application form here: CPE credit application. Continuing Legal Education Credits: The IAPP provides certificates of attendance to web conference attendees. Certificates must be self-submitted to the appropriate jurisdiction for continuing education credits. Please consult your specific governing body’s rules and regulations to confirm if a web conference is an eligible format for attaining credits. Each IAPP web conference offers either 60 or 90 minutes of programming. 15
- 16. www.iapp.org For questions on this or other IAPP Web Conferences or recordings or to obtain a copy of the slide presentation please contact: Dave Cohen, CIPP/E, CIPP/US Knowledge Manager International Association of Privacy Professionals (IAPP) dave@iapp.org 603.427.9221 16