EU’s New Data Rules Are 1 Year Away

May 25 2018 is a date that should be etched in red on the calendars of any company that does business in the European Union (EU).

That’s the day companies must be in full compliance with the EU’s General Data Protection Regulation (GDPR), which requires them to take specific steps to more securely collect, store and use personal information.

For companies still at the beginning of their efforts, that’s not much time. The Sophos security blog, Naked Security has produced the follwing guidance.  Companies ignore GDPR at their peril

First, a dose of reality: companies not in compliance this time next year face brutal fines for violations. For example, NCC Group came up with a model that extrapolated from the fines actually imposed for breaches by the UK’s Information Commissioner’s Office and calculated what they might be under GDPR. Under the model, British companies that were penalized for breaches last year could have faced fines totaling £69m under GDPR, rather than the £880,500 they collectively had to pay up. 

TalkTalk, which last year was slapped with the biggest fine ever in the UK for a data breach, of £400,000, would have faced a bill of £59m, calculated NCC, while Pharmacy2U, which was fined £130,000, would have faced a bill of £4.4m.

Those are sobering numbers, especially in light of a January report from (ISC)2’s EMEA council, which covers issues concerning Europe, the Middle East and Africa. According to the report, organisations aren’t doing too well, having accomplished precious little in the first year they had to get things in order. The council warned of what it sees as poor acceptance of accountability across organisations and an apparent belief that the task ahead is one for the specialists, either legal or technical.

Meanwhile, a recent report by Crown Records Management found that nearly a quarter of UK businesses surveyed said they had stopped preparing for GDPR, with 44% saying they didn’t think GDPR would apply to them once the UK leaves the EU in March 2019 as a result of last year’s Brexit vote.

Since the UK will still be in the EU when GDPR comes into effect, and presumably will continue to do business in the EU after Brexit, that’s an unfortunate and potentially costly assumption.

Size matters not
Another point of confusion for companies is about size. Specifically, do small businesses face the same requirements under GDPR as the big enterprises?
GDPR requires that any company doing business in the EU, no matter the size, more securely collect, store and use personal information. Like the big guys, smaller companies face fines for violations that might occur.
But the regulation accounts for the fact that smaller businesses lack the same resources as larger enterprises. UK-based data protection consultancy DataHelp makes note of the differences on its website:

Under the current law, as contained in the Data Protection Act, (DPA), the same rules apply, regardless of the size of an organisation. However, the General Data Protection Regulation (GDPR) … recognises that SMEs require different treatment from both large and public enterprises.

One area of concern for small businesses is the GDPR requirement that companies hire a data protection officer. But that part is for firms with more than 250 employees. Though smaller firms may still need to employ someone in this role if handling personal data is core to their operations, it may not have to be a full-time employee, but rather a consultant, which could be less costly. Daunting as it all may seem, small businesses can take comfort in this: as long as they can demonstrate that they’ve put their best foot forward to meet the requirements of GDPR, regulators will work with them on any problems that might arise. The key is to bring in the right consultants and document all actions taken.

Now what?
Now that we’ve outlined what’s at stake, let’s look at some concrete steps companies must take to be taking to be ready for May 2018.
Naked Security recently reviewed a 12-point checklist published by Ireland’s Office of the Data Protection Commissioner. The compliance practitioners we talked to have repeatedly cited that list as particularly helpful.

The checklist is as follows:

1.    Be aware. It’s not enough for CEOs, IT staff and compliance officers to be aware of what GDPR requires. Employees from the top to the bottom of an organisation need to be extensively educated on the regulation’s importance and the role they have to play.
2.    Be accountable. Companies must make an inventory of all personal data they hold and ask the following questions: why are you holding it? How did you obtain it? Why was it originally gathered? How long will you retain it? How secure is it, both in terms of encryption and accessibility? Do you ever share it with third parties and on what basis might you do so?
3.    Communicate with staff and service users. This is an extension of being aware. Review all current data privacy notices alerting individuals to the collection of their data. Identify gaps between the level of data collection and processing the organisation does and how aware customers, staff and service users are.
4.    Protect privacy rights. Review procedures to ensure they cover all the rights individuals have, including how one would delete personal data or provide data electronically.
5.    Review how access rights could change. Review and update procedures and plan how requests within new timescales will be handled.
6.    Understand the legal fine print. Companies should look at the various types of data processing they carry out, identify their legal basis for carrying it out and document it.
7.    Ensure customer consent is ironclad. Companies that use customer consent when recording personal data should review how the consent is sought, obtained and recorded.
8.    Process children’s data carefully. Organisations processing data from minors must ensure clear systems are in place to verify individual ages and gather consent from guardians.
9.    Have a plan to report breaches. Companies must ensure the right procedures are in place to detect, report and investigate a personal data breach. Always assume a breach will happen at some point.
10.    Understand Data Protection Impact Assessments (DPIA) and Data Protection by Design and Default. A DPIA is the process of systematically considering the potential impact that a project or initiative might have on the privacy of individuals. It will allow organisations to identify potential privacy issues before they arise, and come up with a way to mitigate them.
11.    Hire data protection officers. The important thing is to make sure that someone in the organisation or an external data protection advisor takes responsibility for data protection compliance and understands the responsibility from the inside out.
12.    Get educated on the internal organisations managing GDPR. The regulation includes a “one-stop-shop” provision to assist organizations operating in EU member states. Multinational organisations will be entitled to deal with one data protection authority, or Lead Supervisory Authority (LSA) as their single regulating body in the country where they are mainly established.

Making it your own
Those approached for the Naked Security Sophos piece cited in the main article noted how they’ve taken the guidelines of Ireland’s Office of the Data Protection Commissioner and put their organisations’ stamps on it. One of them was Craig Clark, information security and compliance manager for IT services at the University of East London. 

From a project point of view, he suggested the following be completed or nearly completed by mid 2017:

•    C-Suite Awareness
•    User Awareness
•    DPO Appointment
•    Information Identification
•    Updated Privacy Notices
•    Updated Data Protection Policies
•    Updated Information Sharing Agreements
•    Approved Data Privacy Impact Assessments
•    Identification of any cross-border transfers
•    Establishment of Data Subject Rights Management protocols
•    Privacy by Design implemented into the Project Methodology

Clark added "A lot of guidance is still to be written by the ICO [UK Information Commissioner’s Office] but I’d want at least the above to be implemented"

Brexit doesn’t exempt UK companies
As mentioned, some assume they are free of GDPR because the UK is leaving the EU. That is not true. The following facts apply:

1.    British prime minister Theresa May sent a letter to the president of the European Union officially triggering Brexit in late March 2017. The exit process will take at least two years to complete, meaning those UK companies will still be a part of the EU on the day GDPR takes effect.
2.    Once the UK is no longer part of the EU, many of those companies will still do business with companies that are in the EU. That alone will keep UK businesses on the hook for compliance.

Therefore, companies should approach GDPR as they were before Brexit happened.

Sophos

You Migh Also Read: 

TalkTalk's Cybersecurity Lesson:

EU / US Privacy Shield Affects Your Organisation:

Tesco Could Have Been Facing £2bn Fine After The Bank Hack:

Implementing EU Privacy Laws Requires 28,000 New Data Professionals:

 

 

« Current Cybercrime Threats Originate In Espionage
Algorithms: An Unseen Influence On The UK Election »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

RedTeam Security

RedTeam Security

RedTeam Security is a provider of Penetration Testing, Social Engineering, Red Teaming and Red Team Training services.

InfoSecurity Magazine

InfoSecurity Magazine

Infosecurity Magazine has over ten years of experience providing knowledge and insight into the information security industry.

Cyber Defense Media Group (CDMG)

Cyber Defense Media Group (CDMG)

CDMG is the leading global media group for all things cyber defense.

Grid32

Grid32

Grid32 provides independent computer system and physical security audit services to government and corporate clients of all sizes.

Censornet

Censornet

Censornet's autonomous, integrated cloud security gives mid-market organisations the confidence and control of enterprise-grade cyber protection.

SenseOn

SenseOn

SenseOn’s multiple threat-detection senses work together to detect malicious activity across an organisation’s entire digital estate, covering the gaps that single point solutions create.

Edvance

Edvance

Edvance operates a range of cybersecurity businesses including value added cybersecurity solutions distribution, security technology innovation and development, and SaS solution offerings.

Security Engineered Machinery (SEM)

Security Engineered Machinery (SEM)

SEM provides comprehensive end-of-life solutions for the protection of sensitive information in government and commercial markets.

Pires Investments

Pires Investments

Pires is building an investment portfolio of high-tech businesses across areas such as Artificial Intelligence, Internet of Things, Cyber Security and Augmented/Virtual Reality.

Bittnet Training

Bittnet Training

Bittnet Training is the leader in the IT Training market in Romania. We develop the IT skills of IT professionals as well as those who wish to start a career in IT.

Computacenter

Computacenter

Computacenter is a leading independent technology partner, trusted by large corporate and public sector organisations. We help our customers to source, transform and manage their IT infrastructure.

Unit 42

Unit 42

Unit 42 brings together world-renowned threat researchers, incident responders and security consultants to create an intelligence-driven, response-ready organization.

Supra ITS

Supra ITS

Supra ITS is a leading full-service technology partner offering IT Consulting, Cloud Services, 24x7 Managed IT & Cybersecurity Services, and IT Project Support.

Gomboc.ai

Gomboc.ai

Gomboc solve cloud infrastructure security policy deviations by providing tailored remediations to the IaC (Infrastructure as Code).

CXI Solutions

CXI Solutions

CXI Solutions: Your trusted partner in cybersecurity. We offer a full range of cybersecurity solutions to protect your business from digital attacks and virtual threats.

Chestnut Hill Technologies (CHT)

Chestnut Hill Technologies (CHT)

CHT provide Best Practices IT Cybersecurity and Technology Solutions and Consulting Support to the Mid Cap through Fortune 1000 Nationwide.