Software impact of gdpr
0 likes554 views
This document provides an overview and summary of key aspects of the General Data Protection Regulation (GDPR) which takes effect on May 25, 2018. It discusses the major requirements organizations need to comply with including demonstrating accountability, implementing appropriate technical and organizational security measures, addressing new individual rights to personal data, and potential penalties for non-compliance. The document emphasizes the need for organizations to audit their data holdings, document their data management practices, and develop a GDPR compliance action plan. It also provides contact information for additional GDPR resources and updates.
Software impact of gdpr
- 1. Software:The impact ofGDPR Judgement Day: 25 May 2018 DavidClarkeFBCSCITP March 2018 ©TheTrust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone (0) 7768 962 480 GDPRThe Rise of the Data Subject.
- 2. David Clarke FBCS CTO The TrustBridge Founder of Linkedin GDPR Technology group 12036 + Members https://www.linkedin.c om/groups/1201767 @1davidclarke •Board Advisor to Regtech Startups and GRC Consultancies. •Multiple Global ISO27001 for $Billion Dollar Contracts. •PCI-DSS for a UK Credit Card Transmission Service. •CPNI Member 10+ years (Centre for the Protection of National Infrastructure (CPNI) is the United Kingdom government authority which provides protective security advice to businesses) •Creation of Global Infrastructure for Worlds Largest private trading Network, Trading $ 3 Trillion a day. •Management of Multiple Global Security Operations Centres. •CERT, Leading Edge Technological deployments and architectures. •GDPR Technology Forum – Founder LinkedIn Forum •Recognized as one of the top 10 influencers by Thompson Reuter top 30 most influential thought-leaders and thinkers on social media, in risk management, compliance and regtech in the UK. March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480
- 3. “data must be processed fairly and lawfully” Elizabeth Denham, ICO Commissioner GDPR High Level Action Plan What is Expected ….. March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 Desired Outcomes Minimise Risk Reduce the Overhead and fines of an ICO GDPR Audit Reduce risk of Data Breach Increase ability to do business Demonstrate Accountability
- 4. March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 • Food • Cars • Planes • Buildings • Finance • Healthcare Bringing IT to the 21st Century…is it Safe? We’ve had frustration too, with directors ducking away from fines by putting their company into liquidation. Liquidation isn’t a get out of jail free card – our work with insolvency practitioners saw one director disqualified for six years for trying to take this route – but we believe the public want to see stronger action Denham ICO Commissioner
- 5. March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 DataProtectionisamatter for the boardroom. Farmingout aspectsofit to the IT department or fundraisingarmwill not work. Youare accountable. Youhave the power to set the standardsfor your organisation DenhamICOCommissioner
- 6. GDPR: Controller or Processor March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 • To be a fair stand-up boxing match in a 24-foot ring, or as near that size as practicable. • No wrestling or hugging allowed. • The rounds to be of three minutes' duration, and one minute's time between rounds. • If either man falls through weakness or otherwise, he must get up unassisted, 10 seconds to be allowed him to do so, the other man meanwhile to return to his corner, and when the fallen man is on his legs the round is to be resumed and continued until the three minutes have expired. If one man fails to come to the scratch in the 10 seconds allowed, it shall be in the power of the referee to give his award in favour of the other man. • A man hanging on the ropes in a helpless state, with his toes off the ground, shall be considered down. • No seconds or any other person to be allowed in the ring during the rounds. • Should the contest be stopped by any unavoidable interference, the referee to name the time and place as soon as possible for finishing the contest; so that the match must be won and lost, unless the backers of both men agree to draw the stakes. • The gloves to be fair-sized boxing gloves of the best quality and new. • Should a glove burst, or come off, it must be replaced to the referee's satisfaction. • A man on one knee is considered down and if struck is entitled to the stakes. • That no shoes or boots with spikes or springs be allowed. • The contest in all other respects to be governed by revised London Prize Ring Rules. Following Rules for alignment............ Queensbury Rules
- 7. March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 Ifabusinesscan’t show that gooddataprotectionisacornerstone oftheir practices,they’re leaving themselvesopento afine or other enforcementactionthatcoulddamagebankbalance or business reputation, Elizabeth DenhamICO Commissioner • Breach less Liability • Data Audit without Breach • 72 Hour Breach Notification • New 6 New Privacy Rights • Demonstration of Accountability is required • Class Action is Easier • Customer Contact Points can Highlight Non Compliance • Charities, Government, Multinationals are easy targets • Heavy Fines up to 4% of global revenue. • Appropriate Technical and Organisational Measures. • Existing Client Data Unusable after May 2018. • Internal data may be at risk of non compliance. • Complex data landscape • Comprehensive data governance program required • Liability beyond data controllers • Criminalisation, Anonymisation, SARS Tampering. • Directors and Officers “Neglect” Liabilities. • Business 2 Business contractual obligations. • Accountability • Systems not designed for GDPR 20 New Risks
- 8. March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 The Benefits of GDPR • Processes and policies need to be reviewed and, to ensure readiness. • Under the GDPR data subjects have Eight new rights to their data, help you to improve overall customer satisfaction. • Data is the heart of the GDPR. the process undertaken to review and clean your data estate and remove out of date/un-unused data will leave the organisation with high quality data that you can rely on for decision making. • Greater transparency is going to the key to the success build trust with both your staff and customers. Consumer litigation and class actions will quickly follow once this regulation goes live, as has happened in the US’ – PAT MORAN
- 9. GDPR: Key Rights to data March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 1. The right to be informed 2. The right of access 3. The right to rectification 4. The right to erasure (RTBF) 5. The right to restrict processing 6. The right to data portability 7. The right to object 8. Rights in relation to automated decision making and profiling We’ve had frustration too, with directors ducking away from fines by putting their company into liquidation. Liquidation isn’t a get out of jail free card – our work with insolvency practitioners saw one director disqualified for six years for trying to take this route – but we believe the public want to see stronger action Denham ICO Commissioner
- 10. March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 • Accelerate your digital transformation programme • Improve your business processes and productivity: • Reduce inaccuracies and minimise errors • Empower employees and they’ll deliver an improved customer experience • Develop a Single Customer View • Improve your customer confidence: • Access to deep intelligence • Respond faster Benefits 2 The new legislationcreatesanonusoncompaniesto understandthe risksthattheycreate for others, andto mitigatethoserisks.It’saboutmovingawayfromseeingthelaw asaboxtickingexercise,and insteadpushesyouto buildaculture ofprivacythat pervadesyour entire organisation.It meanstaking proper considerationofwhat your customersexpect. Elizabeth DenhamICO Commissioner
- 11. March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 • Forecasting and risk management will improve: • Tighter control over third party contracts and liabilities • Improved working relationships with third parties and service providers • Improved IT processes and associated security • Market Advantage as others may not be ready in this industry • Better Child Protection • Class/Group Action is possible The Benefits 3 “Bothcompaniessentemailsaskingforconsenttofuturemarketing.Indoingsotheybrokethelaw.Sendingemailsto determinewhetherpeoplewanttoreceivemarketingwithouttherightconsent,isstillmarketinganditisagainstthe law.” “InFlybe’scase,thecompanydeliberatelycontactedpeoplewhohadalreadyoptedoutofemailsfromthem.” SteveEckersley,ICOHeadofEnforcement, “Businessesmustunderstandtheycan’tbreakonelawtogetready”
- 12. March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 What Compliance is Expected ….. If a way can be found to align the incentives, the processes and compliance will take care of themselves, “ Ron Baker How Do You Stop Sea Captains From Killing Their Passengers? David Kestenbaum
- 13. March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 What is Covered: looking after the Data Subjects Rights Where Social Interest Meets Self Interest Situation Appraisal Convict Ships Up To 33% Died on trip Australia Force the captains to bring a doctor along. Require them to bring lemons to prevent scurvy. Have inspections. Raise captains’ salaries. None of it worked. Incentives matter. Instead of paying for every prisoner that walked on the ship in Great Britain, the government only payed for each prisoner that walked off the ship in Australia. In 1793 this was adopted and implemented immediately: the survival rate shot to 99%.
- 14. Why is Data Protection so difficult, 20 years after becoming a legal requirement? Software Is not designed for Data Protection March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480
- 15. What do we need from our software systems. Security – The Ability to manage the 5 Categories of Breach – Access – Disclosure – Destruction – Loss – Alteration – Built in Encryption Management , – Identity Access and privilege Management March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 ICO Example A hospital could be responsible for a personal data breach if a patient’s health record is inappropriately accessed due to a lack of appropriate internal controls. Breach Management
- 16. What do we need from our software systems: Information Rights Management •The right to be informed •The right of access •The right to rectification •The right to erasure •The right to restrict processing •The right to data portability •The right to object •Rights related to automated decision making and profiling March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 You can cling to the belief that we’ve got the law wrong or that it doesn’t apply to your sector or that the regulatory burden is too great. Or you can commit to positive change. Change that, in my view, is not only achievable but will reap its own rewards. Denham ICO Commissioner Delivery of Data Subject Rights
- 17. What do we need from our software systems. GDPR Principles (Especially Retention Capability) March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 GDPR 6 Principles
- 18. GDPR: Best Practice Privacy by Design – GDPR also states that software which is used to handle Personal Data must follow the principles of Security by Design (SbD) and Privacy by Design (PbD) – Privacy by Design: The principle of the inclusion of data protection from the onset of the designing and planning of systems, rather than as a later addition March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480
- 19. Next Steps – Plan now! – Audit your data holdings and data management – Document what you hold, why and for how long – Create or refresh your Privacy Notices/Policy – Know what to do if there is a breach – Review your consent approach in your best interest – Consider a formal GDPR alignment project – Build an Action Plan January 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 803.348.0000
- 20. GDPR: Conclusion and Next Steps January 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 803.348.0000 Awareness DataDiscovery DataClassification DataMarking DataOwnership GDPRData Governance Demonstrate Accountabilit y FutureProofing
- 21. For up to date information March 2018 © The Trust Bridge www.thetrustbridge.com penny.heyes@thetrustbridge.com phone 07768 962 480 LinkedIn Group GDPR http://GetGDPR.at/Linkedin Daily GDPR News http://GetGDPR.at/News Follow me @1davidclarke 57k followers (access to a library of useful articles and Items)