Post on 21-Jan-2018
transcript
GDPR at Acquia
“Acquia is well positioned to meet the GDPR requirements by the May 2018 deadline. We are building on work we have done to obtain and
maintain our EU-U.S. Privacy Shield framework certification, as well as our work with customers around the EU model clauses that Acquia
has also implemented.
We’re focused not only on meeting our own obligations, but also on providing the tools that our customers will need to help them meet
their obligations under GDPR as well.”
Who am I
Tassos Koutlas, PhDUK Technical Director, FFW
Have been working in technology for 15 years
- Drupal and the web- Machine learning and machine vision- Devops
Contents
● Context
● Definitions
● Principles
● Rights
● Penalties
● How to prepare
European law has two types of legislation:
1. Directives - Member states implement2. Regulations - Immediately applicable
EU GDPR is a regulation.
1981 - EU Treaty 108 - 8 principles for protecting personal data
1995 - EU Data Protection Directive (95/46/EC)
1998 - Human Rights Act (HRA 1998) - Art. 8 right to privacy
2016 - EU GDPR approved, law in 2 years
Context
Subject matter
Rules relating to the protection of natural personswith regards to the processing of personal data.
Processing means any operation or set of operations which is performed on personal data.
Collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Natural person is a living individual.
Personal data is any information relating to an identified or identifiable natural person ('data subject').
Name, identification number, location data, an online identifier or any factor specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Controller
Determines the purposes and means of the processing of personal data.
It can be a natural or legal person, public authority, agency or other body which.
It can act alone or jointly with others.
FFW and Acquia are controllers on the data they are collecting regarding their marketing activities.
Processes personal data on behalf of the controller.
It can be a natural or legal person, public authority, agency or other body.
FFW and Acquia are processors for other parties as part of their services.
Processor
Consent
It signifies agreement to the processing of personal data.
It must be freely given and must give a specific, informed and unambiguous indication of the data subject's wishes.
It must be by a statement or by a clear affirmative action.
Privacy by design
GDPR enforces the concept of data protection by design and by default.
Businesses and organisations need to adhere to a few principles with regards to the personal data they are processing.
It is stated explicitly within the law that organisations are responsible and should be able to demonstrate compliance with those principles.
Six principles
Six principles are mentioned with regards to personal data.
1. Should be processed lawfully, fairly and in a transparent way.
2. Should be collected for specified, explicit and legitimate purpose.
3. Should be kept up to date.
4. Should be limited to what is necessary.
5. Should not allow identification of people for longer than necessary.
6. Should be processed in a way that ensures appropriate security.
An example
Requiring consent to exhibit the lawfulness of processing personal data (principle 1).
- Consent was freely given, specific, informed and unambiguous.
- It was a positive opt-in
- The person was informed that she can withdraw consent at any time.
Compliance:
- Clear privacy notice and terms and conditions, opt-in rather than opt-out
- Ability for people to withdraw consent
Asking for feedback through a form via the website capturing the email of a person.
Under GDPR an email is personal data.
Principle 6: Should be processed in a way that ensures appropriate security.
Compliance:
- SSL and HTTPS traffic only through the website
- Firewall policy for the database server- Access controls for people accessing the
network
Another example
Rights
The following are mentioned with regards to personal data.
Appropriate measures (processes, procedures and training) to allow people to exercise those rights.
All forms of communication would need to be in a concise and easily accessible form using clear and plain language.
Legal based documents would need to be revised so they are more accessible by the general public.
the right to be informed;
the right of access;
the right to rectification;
the right to erasure (right to be forgotten);
the right to restrict processing;
the right to data portability;
the right to object; and
the right not to be subject to automated decision-making including profiling
An example
In May 2015 the EU Court of Justice ruled: search engines are responsible to the content they point to and thus they need to comply with EU privacy law.
Google was asked to comply with the right to be forgotten.
- Created the framework to remove search results from EU index
- Created the process for people to request removal
Establish processes, procedure and staff training to deal with people exercising their rights.
Low
Fine up to 10,000,000 EUR or 2% of total worldwide turnover, whichever is higher.
- Child consent- Processing not requiring identification- Data protection by design and by default- Joint controllers- Representative of controllers not
established in EU- Processing- Cooperation with supervisory authority- Data security- Notifications of breaches to supervisory
authority- Communication of breaches to data
subjects
Fine up to 20,000,000 EUR or 4% of total worldwide turnover, whichever is higher.
- Principles relating to the processing of
personal data
- Lawfulness of processing
- Conditions of consent
- Processing of special categories of data
personal data (i.e. sensitive data)
- Data subjects rights
- Transfers to third countries
- Access to supervisory authority
- Order/limitations on processing or the
suspension of data flows
High
Steps to prepare
Awareness
Make sure that decision makers and key people in your organisation are aware that the law is changing to the GDPR. They need to appreciate the impact this is likely to have.
Privacy information
Review your current privacy notices and put a plan in place to make any necessary changes.
Information audit
Document what personal data you hold, where it came from and who you share it with.
Individual’s rights
Check procedures to ensure they cover all the rights individuals have (e.g. how to delete personal data, or provide data electronically in a common used format)
Steps to prepare
Data breaches
Procedures to detect, report and investigate a personal data breach
Data protection by design and data protection impact assessments
Familiarise with latest guidance from Article 29 Working Group and how to implement Privacy Impact Assessments for your organisation (or talk to us at FFW about it).
Access requests
Update procedures and plan how to handle requests within the timescales.
Lawful basis of processing
Identify your lawful basis of processing, document it and update privacy notice to explain it.
Children
Do you need to put systems in place to verify individual’s ages and obtain parental or guardian consent?
Steps to prepare
Data protection officers
Designate someone (within your organisation or some legal entity) to take responsibility for data protection compliance. Asses where the role will sit within the organisational structure.
International
If your organisation operate in more than one Member State determine your lead data protection supervisory authority
Organisations not established in EU
Designate in writing a representative in EU.
Case study - Hotjar
Thoroughly research the areas of our product and our business impacted by GDPR - COMPLETE
Appoint a Data Protection Officer - COMPLETE
Rewrite our Data Protection Agreement -COMPLETE
Develop a strategy and requirements for how to address the areas of our product impacted by GDPR - COMPLETE
Perform the necessary changes/improvements to our product based on the requirements - IN PROGRESS
Case study - Hotjar
Implement the required changes to our internal processes and procedures required to achieve and maintain compliance with GDPR - IN PROGRESS
Thoroughly test all of our changes to verify and validate compliance with GDPR - IN PROGRESS (being done incrementally as changes are completed)
Finalize and communicate our full compliance - TO BE ANNOUNCED
Final Thoughts
To prepare for GDPR, you must understand which data you create, where and how you process and finally store it.
Only then, you will be able to take the right actions to comply with the new regulations. Acquia and FFW are ready to support you on this journey.