The DPO, or Data Protection Officer, is a role that has been discussed at length as the GDPR has moved from concept to reality.
The DPO is responsible for:
- Informing the organisation on its GDPR obligations
- Monitoring that compliance
- Being the first point of contact for employees and supervisory authorities
- Training Staff
- Conducting audits and supporting data protection impact assessments
There are requirements about how the role fits into the organisation. It must report to the highest level (to a board member) and have access to appropriate resources. The DPO must not be at risk of dismissal or penalty for doing the job. Conflicts of interest, such as decision-making responsibility for how data is processed, are not allowed.
You can assume that all the requirements were made with large organisations in mind.
Some organisations must appoint a DPO. Public bodies like schools and organisations that process large amounts of personal data must have a DPO in place for May 25th 2018. For others there is no mandatory requirement.
The question is, should you appoint a DPO anyway?
Organisations rely on accurate, well managed information, it makes great customer service easier and can be the basis of improved efficiency.
It may seem that the Data Protection Officer must be an IT expert but, in fact, it’s a process role. The best person to deal with the task may well sit in an Operations role or if you have someone responsible for quality management. This should avoid the conflict of interest issue, but there may still be some reassurance needed that they will be supported.
Thinking about compliance as a process you integrate with the day to day operation of the organisation, rather than an unknown external risk can remove the fear factor. Whether you give the title to a person or not, the tasks of the DPO can become part of business as usual.
Does your organisation need awareness training?
Here comes the Data Protection Bill
A point of viewOn Wednesday 17th January, the Data Protection Bill completed its journey through the House of Lords and headed back to the Commons. This means it’s heading toward the last stages before it becomes law.
Over the last few weeks I’ve been asked several times what the difference is between the Bill and the GDPR, also whether the Bill will mean that the GDPR will no longer apply. If you were hoping for this outcome, I’m afraid to dash those hopes. The Bill mentions GDPR 480 times, the Regulation is inextricably woven in.
The Bill enshrines the requirement to comply with the terms of the GDPR into UK law. This means of course that after Brexit you’ll still be required to manage personal data to the same standards as the rest of the EU. This will provide real benefit for firms wanting to do business in Europe.
But, the GDPR doesn’t cover every situation where the UK needs to manage personal data. This is particularly in relation the operation of the government itself, and situations relating to national security.
There has been some friction between the ICO and the government over these additional regulations. The Information Commissioner is concerned that government is giving itself the right to impose a different framework on a range of organisations only loosely connected with delivering public services. There are still some things to be ironed out before the Bill is given the Royal Assent.
For most organisations, these considerations will have little or no impact. The requirement to manage personal data under the terms of the GDPR remains the same, and the 25th of May remains the deadline for compliance.
Happy New Year
A point of viewHappy New Year! Welcome in the GDPR
You know what it’s like, the New Year celebrations are done and its back the realities of work. Part of that reality for 2018 is the enforcement of the GDPR that starts on the 25th May. You’re probably familiar with the basics, but just in case here is the GDPR in 59 words.
The General Data Protection Regulation replaces the Data Protection Act. It extends the definition of personal data and sets tougher sanctions for non-compliance. A new right, Data Portability, allows individuals to take personal data from one organisation to another. Organisations must take a risk management approach to data protection and some are mandated to have a Data Protection Officer.
There’s quite a lot more to it of course and the Regulation is not light reading by any means.
It’s important to recognise that that GDPR has been designed as a set of practical regulations. Let’s take data breaches, the GDPR sets out that there are three classes of breach and then mentions a deadline of 72 hours for a breach to be reported to the supervisory authority (the ICO in the UK).
With the emphasis on risk management though, only breaches that present a risk to peoples’ rights and freedoms must be notified. This was confirmed by Elizabeth Denham, the Information Commissioner back in September of last year.
Data mapping is the key to this risk assessment and its one of the most important things you can do to prepare for compliance. It’s about understanding how personal data flows through the systems and processes of your organisation. From this map, you’ll be able to see the potential risks to ensure the proper security in in place. In the event of a breach you’ll be able to know what data has been compromised and where suspect data can end up.
To see how we can help you be prepared click here
GDPR Envy: Data protection across the pond
A point of viewAmong all the questions about the impact of the GDPR, it’s interesting to see another perspective on concerns about personal data. This comes from consumers in the USA, a country with some mixed attitudes toward privacy in general. From a survey conducted in September 2017, PWC have produced a report for their Consumer Intelligence Series called Protect.me.
There are some fascinating insights into the representative American adult. Fully 45% of the sample thought that their email or social media accounts would be hacked in the next 12 months, 29% expected to be the victim of credit card fraud (really 29%?) and 21% expected their employer would be subject to a cyberattack.
It’s perhaps worth pointing out that 25% of the people asked thought they would have a lottery win in the next 12 months so despite the worries there is still optimism
Of the people asked only 10% felt they have complete control of their personal information. More than 70% felt that the company holding their data (the Data Controller from our perspective) was better qualified to protect that data compared to the Government. At the same time more than 80% felt that there should be regulations covering how companies can use personal data.
What’s interesting is something that makes it into the report almost as a throwaway line.
“Unlike the European Union’s approach to data privacy regulation—known as the General Data Protection Regulation (GDPR)—most US data privacy laws vary by sector, data type, or from state to state.”
Whether we are in the EU or not our decision to implement and abide by the requirements of the GDPR means that we are likely to be given trusted status. This means that there are more that 600 million people whose data can be processed here in the UK. It also means that firms in the EU will be able to outsource to the UK easily. Sometimes there are advantages to doing things as a group!
With the GDPR the Devil is in the details
A point of viewMention the UK and the EU right now you’ll almost certainly hear about Brexit. Organisations pondering life outside of the EU may be forgiven for not being totally up to date with the details of the GDPR.
Take a journey back in time with me to 1963. Britain was trying to get into the six member club that was the EEC. General De Gaulle had just given his first ‘non’ because of a perceived lack of commitment to the principle of the community.
In the same year Richard Mayne the personal assistant to the first President of the EEC said
“On the principle that ‘the devil is in the details’, what should have been a merely formal occasion developed into a debate about the Community’s official languages and the site of its headquarters”
It’s arguable whether De Gaulle was proven right in the end, but if the GDPR is anything to go by Mayne was spot on.
The problem is that despite the 99 Articles, the 173 recitals and the hundreds of pages of guidance there are still plenty of places where the regulations must be interpreted. There is discussion about how case law will develop around these blank spaces but who wants the be the name on the court case?
For organisations who are moving towards compliance a judgement must be taken on how to proceed in the world away from the ‘Eurocrats’ (reputedly another Mayne invention). There is a balance between being able to deliver service to customers, keep their information secure and avoiding enforcement action.
The 25th May is not going to be the end of the process by any means. We’ll all be adjusting our view of what the regulations really require for some time to come.
If you want help understanding what the GDPR means for you click here
Should you have a DPO?
A point of viewThe DPO, or Data Protection Officer, is a role that has been discussed at length as the GDPR has moved from concept to reality.
The DPO is responsible for:
There are requirements about how the role fits into the organisation. It must report to the highest level (to a board member) and have access to appropriate resources. The DPO must not be at risk of dismissal or penalty for doing the job. Conflicts of interest, such as decision-making responsibility for how data is processed, are not allowed.
You can assume that all the requirements were made with large organisations in mind.
Some organisations must appoint a DPO. Public bodies like schools and organisations that process large amounts of personal data must have a DPO in place for May 25th 2018. For others there is no mandatory requirement.
The question is, should you appoint a DPO anyway?
Organisations rely on accurate, well managed information, it makes great customer service easier and can be the basis of improved efficiency.
It may seem that the Data Protection Officer must be an IT expert but, in fact, it’s a process role. The best person to deal with the task may well sit in an Operations role or if you have someone responsible for quality management. This should avoid the conflict of interest issue, but there may still be some reassurance needed that they will be supported.
Thinking about compliance as a process you integrate with the day to day operation of the organisation, rather than an unknown external risk can remove the fear factor. Whether you give the title to a person or not, the tasks of the DPO can become part of business as usual.
Does your organisation need awareness training?