My presentation- Ala about privacy and GDPR
- 2. AGENDA • INTRODUCTION • WHY GDPR • TERMS AND DEFINITIONS • GDPR PRINCIPLES • GDPR REQUIREMENTS • AUDITING GDPR.
- 3. INTRODUCTION The purpose of the General Data Protection Regulation (GDPR) is to modernize data protection and provide greater protection to individuals through the standardization and harmonization of previously fragmented data protection legislations. Is new EU legislation that comes into effect on May 25th 2018
- 4. WHAT IS THE PURPOSE OF GDPR? • DATA PROTECTION IS ABOUT PROTECTING PEOPLES PRIVACY. WITH THE CONTINUED GROWTH OF THE INTERNET, MODERN DAY LIVING HAS BECOME MORE DATA DRIVEN RESULTING IN BUSINESS LOOKING FOR NEW WAYS TO LEVERAGE THE POWER OF TECHNOLOGY AND THE INTERNET This data driven world is much more interconnected, making it much harder to limit the harm to individuals if data protection goes wrong. The results of this may leave an individual exposed to identity theft, financial loss or criminal exploitation Companies are given personal information in good faith and are responsible for ensuring that the personal information given to them is protected in a way that will not compromise the individual. How personal information is protected depends on the type of personal information a company collects and how the company will use that information. This means that data protection is contextual and every company will have its own way of meeting its data protection requirements
- 5. CHANGES TO THE EXISTING REGULATION What the GDPR brings to the current regulatory framework
- 6. CHANGES TO THE EXISTING REGULATION What does the GDPR bring (compared to the existing Data Protection Directive)) Applies to all entities targeting data subjects in the EU, even if they are based out of the EU. Fines ranging between 2 to 4% of the global annual turnover or €10 - 20 million Personal data now includes location data, IP addresses, online and technology identifiers. Reinforced rights: Access, rectification, restriction, erasure, objection to processing; no automated processing and profiling. Required for processing, where there is no other legal obligation. Report a personal data breach to the Data Protection Authority within 72hrs. Data Protection Authorities (DPA) of main establishment can act as lead DPA, supervising processing activities throughout the EU. Binding Corporate Rules as tools for data transfers outside the EU and EEA are now embedded in law, where there is no adequate decision to perform a transfer. International data transfers One-stop shop Data breach notification Consent Data subjects rights Expanded definitions Sanctions Broader territorial scope
- 7. DEFINITIONS What are the key aspects you need to know
- 8. IMPORTANT TERMINOLOGY DATASUBJECT An individual who is the subject of the information or data. DATACONTROLLER A person, company or organisation who determines the purposes and means of processing personal data DATAPROCESSOR A person, company or organisation who processes personal data on behalf of the controller 8
- 9. PERSONAL IDENTIFIABLE INFORMATION (PII) Any type of information relating directly or indirectly to an identified or identifiable natural person and can lead to the identification of an individual when used alone or combined with other relevant data. Examples are: General Personal Data Name, Surname Gender Date of birth Home Address ID Number Personal email address Biometric data (photograph / video) Behavioral information Financial Information Social Security Numbers Account numbers (bank accounts, credit cards, etc.) Personal Identification Numbers (PINs) Passwords to financial accounts Income information Personal Identifiable Information Sensitive Information Racial or ethnic origin Religious beliefs Health Information Sexual orientation Political views Criminal convictions / Security measures / Offenses Health Information Medical records Physical / mental health information Health plan Health history
- 10. DATA PROTECTION ROLES Data subject Data controller Data processor Supervisory authority (SA) / Data Protection Authority (DPA) 1 0
- 11. AN INDIVIDUAL’S RIGHTS The GDPR seeks to balance the rights of an individual, or data subject in relation to their personal information with the need a company has to hold and process personal information. The right of Access The right to Object The right to Rectification The right to Erasure Rights in relation to Automated decision- making & Profiling The right to Data Portability The right to Restrict processing 1 1
- 12. CORE PRINCIPLES Processing of personal data Integrity and confidentiality Processing data in a secure manner, providing protection against unauthorised actions, loss, damage and destruction. Lawfulness and fairness Applying legitimate grounds for collecting data ensuring there is no negative impact on the data subject. Data Subject rights Informing the data subject about his rights regarding processing his personal data. Purpose limitation Collecting and processing data for specified, explicit and legitimate purpose. Data transfer and Disclosure Applying protection safeguards and measures on data transferred to third parties. Data minimisation GDPR Privacy Principles Collecting and processing data adequately and relatively to what it is necessary in relation to the purposes for which they are processed. Transparency Processing data in a lawful, fair and transparent manner in relation to the data subject. Accuracy Ensuring data is accurate and up to date in relation to the purposes for which they are processed, and erased or rectified accordingly. Accountability Introducing technical and organizational measures to ensure data processing is performed in accordance with the GDPR Storage limitation Keeping data for no longer than is necessary for the purposes for which they are processed.
- 13. PROCESSING PERSONAL DATA Consent Contractual necessity Legal obligation Vital interests Public interest Legitimate interests Legitimate bases for processing 1 3 https://ico.org.uk/for-organisations/gdpr-resources/lawful-basis-interactive-guidance-tool/
- 14. ACTIONS TO BE TAKEN 8 key measures to be taken Although GDPR legislation is, of course, a legal given, its implementation has organisational and IT elements as well. a total of 8 measures to be implemented: 1. DATA PRIVACY POLICY & AWARENESS PROGRAM 5. ADAPTING THE AGREEMENTS BETWEEN CONTROLLERS AND PROCESSORS (THIRD P ARTIES) 6. ADJUSTING COMMUNICATION TO THE ‘ DATA SUBJECTS’ THROUGH ‘PRIVACY NOTICES’ 2. MAINTAINING A REGISTER OF PROCESSING ACTIVITIES & DATA 3. PRIVACY IMPACT ASSESSMENTS (PIAs) ON THE CRITICAL PROCESSES 7. DATA BREACH NOTIFICATION 8. APPOINTMENT OF A DATA PROTECTION OFFICER (DPO) 4. IMPLEMENTING SECURITY MEASURES (PRIVACY BY DESIGN AND DEFAULT)
- 15. Assess Capture Store Use Destroy Data Protection by Design and by Default Data Protection Impact Assessment (DPIA) Documentation Retention Period Right to erasure Portability Third Party copies Appropriate use Consent Manage Consent Restricted International Transfers Safe and Secure Restricted Access Data Inventory Subject Access Requests Contracts with Data Processors Data breaches Data Minimisation Privacy Notices Privacy Rights Obtain Consent SUMMARY OF GDPR INFORMATION LIFE CYCLE
- 16. HOW PENALTIES AND FINES ARE INCURRED The level of fines will be dependent on the nature, gravity and duration of the infringement and take into account any remediation measures a company has undertaken. Fines can incurred for a range of infringements and are not limited to the list below: A breach of GDPR Principles Issues around the individuals rights Unlawful data processing Breaches of Sensitive Personal Information Transferring data to countries without adequate protections Processing where consent cannot be proven or has been withdrawn 1 6
- 17. AUDITING GDPR Auditors will be indispensable in helping enterprises adhere to these rules and maintain compliance 1 7 Auditing GDPR is about assessing the controls put in Place to respond to risk; it should consider the trio of risk across all facets of an enterprise: • People • Processes • Technology People Processes Technology
- 18. AUDITING GDPR 1 8 GDPR Article 5 (2) states, “The controller shall be responsible for, and be able to demonstrate compliance” with GDPR by ensuring that personal data are processed in accordance with the following six principles: Lawfulness, fairness and transparency Purpose limitations Data minimization Accuracy Storage limitations Integrity and confidentiality In reality, the controller is accountable for ensuring compliance with the six key principles. Auditors are concerned with validating the level of compliance.
- 19. 1- LAWFULNESS, FAIRNESS AND TRANSPARENCY 1 9 “GDPR Article 5 states, Data shall be…processed lawfully, fairly and in a transparent manner in relation to the data subject: The regulation requires that all the enterprise’s processes relating to personal data be evidenced, form an inventory of what data are processed on which systems, where they are stored and with whom they are shared. This should provide the necessary summary of processes from which the auditor can work Lawfulness : Auditors must ensure that enterprises have the systems and processes in place to ensure that these rights are not breached.
- 20. FAIRNESS AND TRANSPARENCY 2 0 In terms of GDPR, it can be said that fairness is achieved when the data controller has put in place working procedures for data subjects to exercise their legal rights without hindrance, These rights are exercised through a subject access request (SAR) A GDPR SAR audit will be an audit of processes and the design and effective implementation of controls. Request Validation Response Fairness : In terms of GDPR, it can be said that fairness is achieved when the data controller has put in place working procedures for data subjects to exercise their legal rights without hindrance
- 21. TRANSPARENCY 2 1 “GDPR Article 12 requires that any information the data controller (enterprise) gives to the data subject (individual) about its data processing practices must be concise, transparent, intelligible and in easily accessible form, and must be provided in writing within one month, at the latest. Transparency : In addition to auditors reviewing and validating the SAR response log, they also need to consider whether the information provided is indeed concise, complete, accurate and easily understandable.
- 22. 2- ACCURACY 2 2 “GDPR Article 5 states, Personal data shall be… accurate, and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate…are erased or rectified without delay….: Each data stream may have been replicated by various departments and individuals for different uses. Auditors must recognize the risk posed by shadow IT and unstructured data. Accuracy : Auditors should seek to assess the completeness of the data discovery exercise and the actions that followed. Auditors should: Review the process undertaken by the business to locate and cleanse the data • Review the rules that are put in place to minimize the instance of shadow IT systems and manage unstructured data • The strategic audit plan should cover data quality. Traditionally, data quality audits have focused on corporate data; with GDPR, these audits now need to cover personal data.
- 23. 3- PURPOSE LIMITATION 2 3 “GDPR Article 5 states, Personal data…shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.” Purpose limitations : Auditors should expect that records are flagged with a reference to a defined purpose that will in turn define the basis. Auditors should also expect to see evidence of validation and a link to a records retention and deletion policy.
- 24. 4- DATA MINIMIZATION 2 4 “GDPR Article 5 states, “Personal data…shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed” Data Minimization: The key for the auditor is to assess the processes and associated rules that have been established to validate the data collected. Thus, to comply with GDPR, enterprises must implement data minimization rules and processes at every step of the data life cycle.
- 25. 5- STORAGE LIMITATION 2 5 “GDPR Article 5 states, “Personal data shall be kept in a form which permits identification of data subjects for no longer than necessary for the processing purposes; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes” Storage limitation: Auditors should approach with caution and consider retention in terms of other legislation and regulation before GDPR and the enterprise’s needs. GDPR only replaces existing data protection legislation and does not overwrite other existing legislation such as that relating to record retention (e.g., for tax purposes).. The key phrase to consider here is “permits identification.” Auditors should conclude from this that so long as the systems and processes work to anonymize the data at a given point in time then it is acceptable to keep and utilize the data for modeling An enterprise should build into its records retention and deletion policies (both manual and electronic) the rules that ensure compliance with legislation and regulation Enterprises can easily fail to comply with GDPR by failing to safeguard personal data upon disposal of hardware and software
- 26. 6- CONFIDENTIALITY, INTEGRITY AND AVAILABILITY 2 6 “GDPR Article 5 states, “Personal data must be processed using appropriate technical and organizational security measures, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage.
- 27. 2 7 Providing audit assurance on GDPR is not a one-off process; the regulation requires auditors to consider personal data throughout the enterprise’s annual audit plan
- 28. IN A NUTSHELL What are the key points to remember
- 29. 7 9 7 9 KEY POINTS Data Privacy Impact Assessment (DPIA) Data Transfers to Third Countries / Organisations Awareness & Training Data Protection Officer (DPO) Marketing Data Breach Notification Privacy by Design & by Default Consent prior processing Third Party agreements Data Erasure GDPR Reporting to Supervising Authorities Data Retention & Storage Security Legal involvement Inventory of processing Incident Response & Crisis Management Data Portability Automated processing
- 30. PERSONAL DATA REMEMBER MUST BE PROCESSED FOR SPECIFIC PURPOSES ONLY AND NOT FOR ANYTHINGELSE When using personal data, make sure to use it only for the purposes that you told them about or that they agreed to, so that there are no surprises. 2 MUST BE FAIRLYAND LAWFULLY PROCESSED Make sure to handle people's personal data only in ways they would expect, and be open and transparent about how you intend to use the data. 1
- 31. PERSONAL DATA REMEMBER 3 MUST BE ADEQUATE, RELEVANT AND NOTEXCESSIVE When collecting personal data, do not collect more data than needed. 4 MUST BE ACCURATE AND UP TODATE Ensure that data you collect about your clients or employees is accurate, for example, the correct spelling of a name. It is also important to check that your records are up to date.
- 32. PERSONAL DATA REMEMBER 5 MUST NOT BE KEPT FOR LONGER THAN IS NECESSARY Do not keep personal data for longer than it is needed, and put procedures in place for archiving and destroying personal data when it is no longer needed. 6 MUST BE PROCESSED IN LINE WITH INDIVIDUALS’ RIGHTS the right to access a copy of the personal data you hold about them or to have their personal datarectified, blocked, erased or destroyed or even the right to dataportability they can object to processing of theirdata or opt out of directmarketing they can exercise their right to beforgotten and claim compensation for damages if their rights are not respected
- 33. PERSONAL DATA REMEMBER 7 • MUST BE KEPT SECURE • KEEP PERSONAL DATA SECURE AND CONFIDENTIAL, USING, OF COURSE, IT MEASURES (SUCH AS ENCRYPTION) BUT ALSO ORGANISATIONAL MEASURES TO ENSURE YOUR PEOPLE AND SUPPLIERS DO NOT BREACH THIS CONFIDENTIALITY. 8 MUST NOT BE TRANSFERRED TO OTHER COUNTRIES WITHOUT ADEQUATE PROTECTION Before sending personal data to another country, make sure that adequate measures are put in place.