New Term, New Data, New Risks?

 

We are all guilty of shuddering a little when hearing the words ‘GDPR’, right? This is especially true when facing the beginning of the new academic year. The maze of legislation, the do’s and don’ts of data, what to do when a data breach occurs? These are common concerns for many education providers around the UK. The bad news is, data breaches need to be taken seriously and dealt with appropriately, the good news, there is support available to help you deal with them. Any organisation within the Education sector, dealing with the personal data of students and staff must be compliant. It is also a legal requirement for schools and colleges in the state sector to have a data protection officer (DPO).

What does ‘being compliant’ mean?

You should be able to answer the questions below confidently, but also show how you do them – where do you keep a record of all data breaches? How do you know when these should be reported to the ICO? • How does personal data flow across your school, trust or college? • Having does your organisation deal with data breaches? • What happens if someone makes a subject access and other requests? • Who has data protection expertise within the organisation? • Have all your staff been trained? Breaches come in many shapes, sizes, and severities. It’s critical to recognise that an integrity breach with a single inaccurate word could be as serious as a confidentiality breach.

We have put together a ‘To Do’ list when dealing with a data breach;

• When dealing with a breach, you should always start with the assumption that you’ll be notifying the ICO, in which you only have 72 hours to do so. • Get the facts, don’t look for blame and always involve the person who discovered the breach. • You’ll need records later, so begin making records now with every action you take. • Get the initial investigation going and know that mitigation is underway. • You must make a judgement about the risk to the data subjects. • You don’t have to have evidence of harm to make a report, gather all the information for the investigation. If you can, report by calling the ICO with the paperwork ready. Remember, the report is often not the end of the process The above outlines a simple checklist for dealing with a data breach, but as we all know, data breaches are just a small percentage of compliance. As practicing Data Protection Officers, we can provide support and advice on data breaches as well as SAR’s, DPIA’s, processes, supplier data and more. Speak with our team today.

/by
Sentry matches the requirements of the ICO

Our survey said……

It’s now less than four months until enforcement of the GDPR begins. You’d imagine that every now knows about the regulation even if they’re not totally clear about the impact.

On Tuesday of this week (24th January), the Department for Digital, Culture, Media and Sport released some preliminary results from Cyber Security Breaches Survey.
With less than four months to go until enforcement begins, significant numbers of businesses and charities had not heard of the GDPR. This included 20% of businesses and 25% of charities with more than 250 employees.

The highest levels of awareness were in the finance and insurance, information and communications and education sectors (79%, 67% and 52%). Still meaning that almost half of the organisations in the education sector were still not aware of the regulation. If you remember the game show Family Fortunes, the cross is showing and the ‘Eh-Uhh’ noise is blaring.

Of those who were aware of the GDPR only about a quarter have taken action. Like lots of us with Christmas shopping it looks like there will be a last-minute rush. Of course, just like joining the last-minute rush – you may not get what you want.

The fact that you’re reading this post, plainly means that you’re in the group that’s aware of the GDPR, but you may be wondering what you need to do next.

If you haven’t done it start with an audit of the personal data you are holding. It’s worth remembering that the scope of what counts as personal data is pretty broad. As well as personal data in IT systems, paperwork in any form of filing system may well hold personal data as well.

You may well find that a name and address, for example, is held in 5 different places and be from more than one source. It may take a long time, but once you understand where personal data is located and how it’s held, many of the other requirements for compliance start to fall into place.

If you don’t want to get trampled in the mad last minute rush it’s time to get going.

/by

Here comes the Data Protection Bill

On Wednesday 17th January, the Data Protection Bill completed its journey through the House of Lords and headed back to the Commons. This means it’s heading toward the last stages before it becomes law.

Over the last few weeks I’ve been asked several times what the difference is between the Bill and the GDPR, also whether the Bill will mean that the GDPR will no longer apply. If you were hoping for this outcome, I’m afraid to dash those hopes. The Bill mentions GDPR 480 times, the Regulation is inextricably woven in.

The Bill enshrines the requirement to comply with the terms of the GDPR into UK law. This means of course that after Brexit you’ll still be required to manage personal data to the same standards as the rest of the EU. This will provide real benefit for firms wanting to do business in Europe.

But, the GDPR doesn’t cover every situation where the UK needs to manage personal data. This is particularly in relation the operation of the government itself, and situations relating to national security.

There has been some friction between the ICO and the government over these additional regulations. The Information Commissioner is concerned that government is giving itself the right to impose a different framework on a range of organisations only loosely connected with delivering public services. There are still some things to be ironed out before the Bill is given the Royal Assent.

For most organisations, these considerations will have little or no impact. The requirement to manage personal data under the terms of the GDPR remains the same, and the 25th of May remains the deadline for compliance.

/by

Happy New Year

Happy New Year! Welcome in the GDPR

You know what it’s like, the New Year celebrations are done and its back the realities of work. Part of that reality for 2018 is the enforcement of the GDPR that starts on the 25th May. You’re probably familiar with the basics, but just in case here is the GDPR in 59 words.

The General Data Protection Regulation replaces the Data Protection Act. It extends the definition of personal data and sets tougher sanctions for non-compliance. A new right, Data Portability, allows individuals to take personal data from one organisation to another. Organisations must take a risk management approach to data protection and some are mandated to have a Data Protection Officer.

There’s quite a lot more to it of course and the Regulation is not light reading by any means.

It’s important to recognise that that GDPR has been designed as a set of practical regulations. Let’s take data breaches, the GDPR sets out that there are three classes of breach and then mentions a deadline of 72 hours for a breach to be reported to the supervisory authority (the ICO in the UK).

With the emphasis on risk management though, only breaches that present a risk to peoples’ rights and freedoms must be notified. This was confirmed by Elizabeth Denham, the Information Commissioner back in September of last year.

Data mapping is the key to this risk assessment and its one of the most important things you can do to prepare for compliance. It’s about understanding how personal data flows through the systems and processes of your organisation. From this map, you’ll be able to see the potential risks to ensure the proper security in in place. In the event of a breach you’ll be able to know what data has been compromised and where suspect data can end up.

To see how we can help you be prepared click here

/by
Get the training you need with GDPR Sentry services

GDPR Envy: Data protection across the pond

Among all the questions about the impact of the GDPR, it’s interesting to see another perspective on concerns about personal data. This comes from consumers in the USA, a country with some mixed attitudes toward privacy in general. From a survey conducted in September 2017, PWC have produced a report for their Consumer Intelligence Series called Protect.me.

There are some fascinating insights into the representative American adult. Fully 45% of the sample thought that their email or social media accounts would be hacked in the next 12 months, 29% expected to be the victim of credit card fraud (really 29%?) and 21% expected their employer would be subject to a cyberattack.

It’s perhaps worth pointing out that 25% of the people asked thought they would have a lottery win in the next 12 months so despite the worries there is still optimism

Of the people asked only 10% felt they have complete control of their personal information. More than 70% felt that the company holding their data (the Data Controller from our perspective) was better qualified to protect that data compared to the Government. At the same time more than 80% felt that there should be regulations covering how companies can use personal data.

What’s interesting is something that makes it into the report almost as a throwaway line.
“Unlike the European Union’s approach to data privacy regulation—known as the General Data Protection Regulation (GDPR)—most US data privacy laws vary by sector, data type, or from state to state.”

Whether we are in the EU or not our decision to implement and abide by the requirements of the GDPR means that we are likely to be given trusted status. This means that there are more that 600 million people whose data can be processed here in the UK. It also means that firms in the EU will be able to outsource to the UK easily. Sometimes there are advantages to doing things as a group!

/by

With the GDPR the Devil is in the details

Mention the UK and the EU right now you’ll almost certainly hear about Brexit.  Organisations pondering life outside of the EU may be forgiven for not being totally up to date with the details of the GDPR.

Take a journey back in time with me to 1963. Britain was trying to get into the six member club that was the EEC. General De Gaulle had just given his first ‘non’ because of a perceived lack of commitment to the principle of the community.

In the same year Richard Mayne the personal assistant to the first President of the EEC said

“On the principle that ‘the devil is in the details’, what should have been a merely formal occasion developed into a debate about the Community’s official languages and the site of its headquarters”

It’s arguable whether De Gaulle was proven right in the end, but if the GDPR is anything to go by Mayne was spot on.

The problem is that despite the 99 Articles, the 173 recitals and the hundreds of pages of guidance there are still plenty of places where the regulations must be interpreted. There is discussion about how case law will develop around these blank spaces but who wants the be the name on the court case?

For organisations who are moving towards compliance a judgement must be taken on how to proceed in the world away from the ‘Eurocrats’ (reputedly another Mayne invention). There is a balance between being able to deliver service to customers, keep their information secure and avoiding enforcement action.

The 25th May is not going to be the end of the process by any means. We’ll all be adjusting our view of what the regulations really require for some time to come.

If you want help understanding what the GDPR means for you click here

/by
GDPR Sentry can help you fill the knowledge gap

Should you have a DPO?

The DPO, or Data Protection Officer, is a role that has been discussed at length as the GDPR has moved from concept to reality.

The DPO is responsible for:

  • Informing the organisation on its GDPR obligations
  • Monitoring that compliance
  • Being the first point of contact for employees and supervisory authorities
  • Training Staff
  • Conducting audits and supporting data protection impact assessments

There are requirements about how the role fits into the organisation. It must report to the highest level (to a board member) and have access to appropriate resources. The DPO must not be at risk of dismissal or penalty for doing the job. Conflicts of interest, such as decision-making responsibility for how data is processed, are not allowed.

You can assume that all the requirements were made with large organisations in mind.

Some organisations must appoint a DPO. Public bodies like schools and organisations that process large amounts of personal data must have a DPO in place for May 25th 2018. For others there is no mandatory requirement.

The question is, should you appoint a DPO anyway?

Organisations rely on accurate, well managed information, it makes great customer service easier and can be the basis of improved efficiency.

It may seem that the Data Protection Officer must be an IT expert but, in fact, it’s a process role. The best person to deal with the task may well sit in an Operations role or if you have someone responsible for quality management. This should avoid the conflict of interest issue, but there may still be some reassurance needed that they will be supported.

Thinking about compliance as a process you integrate with the day to day operation of the organisation, rather than an unknown external risk can remove the fear factor. Whether you give the title to a person or not, the tasks of the DPO can become part of business as usual.

Does your organisation need awareness training?

/by

Is anyone going to focus on schools?

This is a question that many people are asking. With high profile breaches making the news, will the ICO care about schools?

Let’s just return the statistics about breaches. In 2017/18, around 3,300 breaches were serious enough to have to be reported to the ICO. Of these more than 350 came from Education and Childcare. This is more then 70% higher than Finance, Insurance and Credit, the sector that people think of first when considering breaches.

Remember that to be reported, a breach must have serious impact on a data subject. The breaches in the financial sector may impact on peoples money, but schools deal with a huge amount of confidential data

/by