The Pitfalls Of GDPR & Cyber Security For Micro Organisations

When we think of charities, what usually springs to mind are the grand challenges and associated fundraising drives. We’re asked to help cure cancer, end poverty, or fight injustice. What's less visible are the thousands of micro charities, non-profits and private clubs enriching people’s lives by building and maintaining communities. 

Whether they’re a charity, helping people build a support network, a non-profit helping people gain work experience, or a small club, whose members pay a subscription to share a hobby, the problem is the same. Their funding comes with the expectation that they'll do something that GDPR and Cyber Security both make harder. 

Often these organisations' volunteers are also business owners, volunteering their skills in their spare time... But the risk of decisions made in business and as a trustee are different. 

Is GDPR dividing opinions so much that charities feel they have to stop fulfilling their purpose? 

Decisions made by committee are inherently conservative, so the lowest risk decision a small charity or club can make is to stop doing the thing they're scared of. 

As you're reading this, millions of small community-led organisations are deciding whether to stop providing services such as membership directories and support networks because they’re unclear about how their responsibilities have changed. The prospect of fines divides committees, resulting in a loss of the skills and knowledge needed to fulfil the organisation’s purpose. What's worse, is that the services that they're considering withdrawing are the things that help people connect with their communities. 

What do they need to know? 

GDPR isn’t intended to stop us sharing data, and Google and Facebook share far more information about us than micro charities will ever collect. What is expected is more transparency and documentation of what’s happening, identification of the lawful basis to carry out this activity, and the processes and security measures they will use to manage the risk of a breach. 
Not collecting data is a legitimate cyber security measure, but good security isn't intended to be obstructive. In the case where they have to have a database of personal information whatever happens, but are considering reducing the services is used for, their cyber risk remains almost the same. 

Cyber risk relates to the value of data to hackers – as you collect information you collect risk. Adding some more security to reduce the risk would probably let them continue their projects. Keeping data subjects safe is either a question of protecting or of not collecting data. 

The choice not to use data is reducing an entirely different risk – the risk that the charity hasn’t understood the regulation, or that their members disagree with how their data is being used. Here’s what Piers Clayden had to say about the legal aspects of helping people stay in touch: 

“Small charities face a number of challenges when trying to work out how to comply with GDPR. The problem being that compliance will require the 2 things that small charities don’t have in abundance – time to drive through the necessary changes in practice and policy and money to take external advice (because the available guidance may not provide the answers you are looking for).

“Organisations who handle (‘process’) personal data can only do so legally where they have ‘lawful grounds’ for that processing. For charities trying to stay in touch with members and potential donors, the lawful grounds will most likely either be on the basis of the member/donors’ ‘consent’ or that the processing is necessary for the charity’s ‘legitimate interests’. 

“If a charity can mount an arguable case for using the ‘legitimate interests’ grounds (and it does require some analysis) then it may save the charity from having to seek new consents from its existing database.”

So, any charity or club collecting personal data might have to rethink what they're doing. If the data is collected purely for marketing or fundraising then it's unlikely to be a legitimate interest, but charities and clubs have a huge advantage over businesses... They're already required to be transparent. They have constitutions or they've had to register with the charities commission.

So if you're responsible for making decisions about a charity’s data use, or questioning whether you can even afford to send every member a letter asking for their consent... what did you already promise your donors and members that you would do?

This is an editorial article containing opinions that are not intended to replace advice. If you need support developing cyber security processes please follow the links below.

By Emma Osborn, independent cyber security consultant, OCSRC Ltd, with Piers Clayden, technology lawyer, Clayden Law Ltd.

Emma Osborn is an independent cyber security consultant, specialising in the support of smaller organisations and non-technical business leaders as they develop their cyber security processes.  OCSRC

If you’re looking for specialist legal advice, Piers Clayden can be found here: Clayden Law 

You Might Also Read:

GDPR For Dummies:

GDPR: It’s A Marathon, Not A Sprint:

« Hacking The Vote
A Guide To Preventing Charity Cybercrime »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

MetaCompliance

MetaCompliance

MetaCompliance is a cyber security and compliance organisation that helps transform your company culture and safeguard your data and values.

Brookings Institution

Brookings Institution

The Brookings Institution is a nonprofit public policy organization. Cyber security is covered within the various study areas.

Global Digital Forensics (GDF)

Global Digital Forensics (GDF)

GDF specialise in Digital Forensics and e-Discovery. Other services include Data Breach Response and Cyber Security.

Planit Testing

Planit Testing

Planit is a leader in Quality Assurance and a specialist in software testing and training services.

LRQA Nettitude

LRQA Nettitude

LRQA Nettitude is an award-winning global provider of cybersecurity services, bringing innovative thought leadership to the ever-evolving cybersecurity marketplace.

Privitar

Privitar

Privitar is leading the development and adoption of privacy engineering technology enabling our customers to innovate and leverage data with an uncompromising approach to data privacy.

24By7Security

24By7Security

24By7Security are Cybersecurity & Compliance Specialists with extensive hands on experience helping businesses build a defensive IT Infrastructure against all cyber security threats.

Blue Lance

Blue Lance

Blue Lance is a global provider of cybersecurity governance solutions. Our software solutions automatically collect and store the information necessary for investigations, audit and compliance.

MazeBolt Technologies

MazeBolt Technologies

Israel-based MazeBolt is an innovation leader in cybersecurity, with over two decades of experience in pioneering DDoS protection solutions.

Earlybird Venture Capital

Earlybird Venture Capital

Earlybird is a venture capital investor focused on European technology innovators.

Open Data Security (ODS)

Open Data Security (ODS)

Open Data Security is a market leader in the information security sector, offering services to companies, governments and individuals, helping them shield from hackers and cyber attacks.

Wib

Wib

Wib is an API security leader. We are the only company providing a solution for the entire API development lifecycle.

Strivacity

Strivacity

Strivacity lets brands quickly add secure login and identity management capabilities to their customer-facing applications without tying up an army of developers or consultants to do it.

SolidityScan

SolidityScan

SolidityScan is an advanced smart contract scanning tool designed to uncover vulnerabilities and proactively address risks within your code.

Flow Security

Flow Security

Enterprises run on data, Flow secures it at runtime. With a runtime-first approach, Flow is a game-changer in the data security space, securing data itself, beyond the infrastructure it resides in.

Triovega

Triovega

Triovega are a leading provider for production security and efficiency. Our solutions enhance OT security, and reduce production downtime.