GDPR, Data Privacy.
- 1. © 2016 VMware Inc. All rights reserved. Liviu Cismaru Date GDPR Main Requirements Liviu Cismaru 2017
- 2. GDPR, Chapter 1, Article 1 CONFIDENTIAL 2 CHAPTER I General provisions Article 1 Subject-matter and objectives 1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. 2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. 3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.
- 3. Enabling Strategic Goals 3 Security DataCenters Cloud Strategic Goals Risk Manage ment Operations Security & Data Governance Legal, Data Governance, Security
- 4. GDPR Requirements Background: Data Types 4 1. Article 4 - https://www.privacy-regulation.eu/en/4.htm ’Personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; 'genetic data' means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question; 'biometric data' means personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data; 'data concerning health' means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;
- 5. GDPR Requirements 5 1. Controller vs Processor. (Art 24) 2. ‘Right to be forgotten’ / Right to Erasure. (Art 17) 3. Consent; Opt-Out / Opt-In. (Art 7) 4. Right of Access by the Data Subject / Access Control. (Art 15) 5. Right to Data Portability / Data Export. (Art 20) 6. Data Breach Alerts. (Art 33, Art 34) 7. Maintain Records of Processing Activity. Transfer of Data to a Third Party. (Art 30) 8. Data Protection by Design and by Default. (Art 25) 9. Security of processing. (Art 32)
- 6. GDPR Requirements – Controller vs Processor 6 1. Controller = the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. 2. Processor = a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
- 7. GDPR Requirements – Right to be Forgotten / Right to Erasure 7 1. Article 17 - https://www.privacy-regulation.eu/en/17.htm “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay ….”
- 8. GDPR Requirements – Consent. Opt-out 8 1. Article 7 - https://www.privacy-regulation.eu/en/7.htm Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes.
- 9. GDPR Requirements – Right of Access by the Data Subject 9 1. Article 15 - https://www.privacy-regulation.eu/en/15.htm • The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: • (a) the purposes of the processing; • (b) the categories of personal data concerned; • (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; • (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; etc …
- 10. GDPR Requirements – Right to Data Portability / Data Export 10 1. Article 20 - https://www.privacy-regulation.eu/en/20.htm The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided
- 11. GDPR Requirements – Data Breach Alerts 11 1. Article 33 - https://www.privacy-regulation.eu/en/33.htm 2. Article 34 - https://www.privacy-regulation.eu/en/34.htm In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority …
- 12. GDPR Requirements – Maintain Records of Processing Activity 12 1. Article 30 - https://www.privacy-regulation.eu/en/30.htm Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information: (a)the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer; (b)the purposes of the processing; (c)a description of the categories of data subjects and of the categories of personal data; (d)the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organizations; (e)where applicable, transfers of personal data to a third country or an international organization, including the identification of that third country or international organization
- 13. GDPR Requirements – Data Protection by Design & by Default 13 1. Article 25 - https://www.privacy-regulation.eu/en/25.htm The controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organizational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimization, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. …
- 14. GDPR Requirements – Security of Processing 14 1. Article 32 - https://www.privacy-regulation.eu/en/32.htm The controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:(a) the pseudonymisation and encryption of personal data;(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;(c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;(d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.
- 15. Data Governance
- 16. Data Governance 16 User Data Flow Inbound Channels – Self Registration (CRM, DBs?) – Sales Organization (CRM, DBs?) – Marketing Organization (CRM, DBs?) – APIs i.e. oAuth, SSO. (DBs, CRM ?) – Partners / Third Parties (DBs, CRM ?) – Banks (DBs, CRM ?) Outbound Channels – Alerts • Data Breach Alerts – Reports • Access Report (Who, What) • Location Report (Where) – Data Export
- 17. Data Governance 17 Self Registration Sales Organization Marketing Organization APIs Third Parties Banks CRM MDM DBs DBs DBs DBs DBs LogsConfig Binary Security, Monitoring, Data Breach Alerts Reports Customers Alerts Reports Data Export Data Export
- 18. Data Governance 18 Data Collection 1. Does the Service allow user Create/Edit/Delete ? 2. Is Personal Data (PD) Collected ? 3. Same for Genetic Data (GD), Biometric Data (BD), Health related Data (HD). 4. Through what channel does every data type above come in ? 5. Re all data types above: what is the Data Flow between the Source (i.e. CRM, Registration Form) and the Destination (i.e. DB Tables, Unstructured, etc). Where is PD stored? 6. Is the Data above exposed through APIs, synchronous or asynchronous messaging systems, backups, batch transfers, etc, to systems out of the boundaries of your service ? CRM
- 19. Data Governance 19 Consent 1. Does the Service allow the user to Opt Out and Opt In within a reasonable time interval ? 2. Does your Service rely on any central / external Opt Out / Opt In system ? 3. Does your Service provide access to VMware's TOS (Terms of Services) agreement ? CRM
- 20. Data Governance 20 Anonymization & Pseudonymization 1. Does the Service convert PD into anonymized or pseudonymized data ? 2. If Anomymization, describe. Source, Destination ? 3. If Pseudonymization, describe. Source, Destination ? CRM
- 21. Data Governance 21 “Right to be Forgotten” 1. Does the Service provide a mechanism to delete all the PD ? 2. Does the Service provide a mechanism to delete all the pseudonymized data or disable the connection to PD in a way that the profile of a natural person can not be reconstructed based on that pseudonymized data ? CRM
- 22. Data Governance 22 Data Access Control 1. Does the Service provide a mechanism to report who has access to PD ? 2. Is the monitoring continuous ? CRM
- 23. Data Governance 23 Data Export 1. Does the Service provide a mechanism to identify and create an archive of all Personal Data that belongs to a certain user ? 2. Describe the Data Export mechanism (i.e. file format, access, etc.) CRM
- 24. Data Governance 24 Data Breach Monitoring and Reporting 1. Does the Service provide a mechanism to monitor for Data Breaches ? 2. Can this monitoring mechanism provide alerts in a timely manner, so the customer is made aware of the data breach within 72h from detection ? CRM
- 25. Security
- 26. Security 26 Data Security 1. How is PD made secure at rest ? 2. How is PD made secure in transit ? CRM
- 27. Risk Management
- 28. Risk Management 28 Subtitle is Arial 18 pt
- 29. Risk Management 29 Continuous Aspect 1. Is your Service part of a Continuous Risk Assessment program ? 2. Does your Service report the impact that a threat / failure could have on your business, based on standard metrics (i.e. financial, # of users, brand value, etc.)
- 31. Risk Management 31 Heat Map 1. Does your Service provide input to be incorporated into a heat map, based on Impact and Probability ?
- 32. Thank You