Information Privacy, The General Data Privacy Regulation (GDPR) & Your Business

Here we'll discuss Information Privacy. In interacting with many online resources, we submit personal information in order to facilitate, customise or improve the user experience. A number of legal entities and instruments exist internationally which oblige the controllers of this data to process and store the data legally, fairly and securely. This includes requesting only the data required to perform the function requested, retaining the data for a period no longer than can be justified given the nature of the service, protecting the data from unauthorised access and misuse. The General Data Privacy Regulation (GDPR) which has been ratified across Europe will come into force in May 2018. This Regulation will not only be binding on entities processing or storing data in Europe but also on any entity processing or storing data on European citizens.

While most businesses have programs, at various levels of maturity, to protect sensitive business and financial information, the personal information of customers is often stored in perpetuity in clear text without strong access controls. Moreover, inventories of this data are not maintained and the ability to extract this data discretely is often not exercised. Before providing some specific guidance points, I should mention the penalties for data breach as these will certainly make you sit up and take notice!

The following sanctions can be imposed:

• A written warning in cases of first and non-intentional non-compliance
• Regular data protection audits
• A fine up to 10,000,000 EUR or up to 2% of the annual global turnover for the previous financial year in the case of an enterprise, whichever is greater
• A fine up to 20,000,000 EUR or up to 4% of the annual global turnover for the previous financial year in the case of an enterprise, whichever is greater 

Here are a few things you should be doing and be able to do:

1. Perform an internal discovery exercise to identify if you process or store customer's personal data
2. Maintain an inventory of personal data stored
3. Maintain and inventroy of personal data storage repositories
4. Enforce access control to personal data storage repositories
5. Enforce retention periods on personal data storage repositories and delete data securely at the end of said period
6. Consider encryption of personal data
7. Verify that if a customer requests their data, you have the ability to extract that data and provide it to the customer 'in a structured, commonly used, machine-readable and interoperable format'. I imagine this means xml or json but this is not specified.
8. If a customer requests their data be erased, you must have the means to do this - 'the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform the controllers which are processing such personal data to erase any links to, or copies or replications of those personal data'.
9. Implement Privacy by Design principles in internal projects related to customer information
10. Perform Privacy Impact Assessments when handling personal information or making changes to systems handling personal information
11. Education - provide training to the business regarding privacy regulataions and their responsibilities.
    
    A number of the above points will be familiar to entities who have performed sensitive asset identification exercises, risk assessments or have performed efforts to adhere to information security frameworks. A privacy program needs to be supported by a strong information security program - these cannot exist in isolation.
    
    The regulation in full is available at http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679