logo.png
Guided Website Threat Review

Foregenix Blog

Information Privacy, The General Data Privacy Regulation (GDPR) & Your Business

PCI, PA-DSS and P2PE, GDPR

,30/01/17 16:43

To begin, we'll take the following definitions of 'privacy' and 'information privacy' from the International Association of Privacy Professionals:

Broadly speaking, privacy is the right to be let alone, or freedom from interference or intrusion. Information privacy is the right to have some control over how your personal information is collected and used.

Here we'll discuss Information Privacy. In interacting with many online resources, we submit personal information in order to facilitate, customise or improve the user experience. A number of legal entities and instruments exist internationally which oblige the controllers of this data to process and store the data legally, fairly and securely. This includes requesting only the data required to perform the function requested, retaining the data for a period no longer than can be justified given the nature of the service, protecting the data from unauthorised access and misuse. The General Data Privacy Regulation (GDPR) which has been ratified across Europe will come into force in May 2018. This Regulation will not only be binding on entities processing or storing data in Europe but also on any entity processing or storing data on European citizens.

While most businesses have programs, at various levels of maturity, to protect sensitive business and financial information, the personal information of customers is often stored in perpetuity in clear text without strong access controls. Moreover, inventories of this data are not maintained and the ability to extract this data discretely is often not exercised. Before providing some specific guidance points, I should mention the penalties for data breach as these will certainly make you sit up and take notice!

The following sanctions can be imposed:

  • A written warning in cases of first and non-intentional non-compliance
  • Regular data protection audits
  • A fine up to 10,000,000 EUR or up to 2% of the annual global turnover for the previous financial year in the case of an enterprise, whichever is greater
  • A fine up to 20,000,000 EUR or up to 4% of the annual global turnover for the previous financial year in the case of an enterprise, whichever is greater 

Here are a few things you should be doing and be able to do:

  1. Perform an internal discovery exercise to identify if you process or store customer's personal data
  2. Maintain an inventory of personal data stored
  3. Maintain and inventroy of personal data storage repositories
  4. Enforce access control to personal data storage repositories
  5. Enforce retention periods on personal data storage repositories and delete data securely at the end of said period
  6. Consider encryption of personal data
  7. Verify that if a customer requests their data, you have the ability to extract that data and provide it to the customer 'in a structured, commonly used, machine-readable and interoperable format'. I imagine this means xml or json but this is not specified.
  8. If a customer requests their data be erased, you must have the means to do this - 'the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform the controllers which are processing such personal data to erase any links to, or copies or replications of those personal data'.
  9. Implement Privacy by Design principles in internal projects related to customer information
  10. Perform Privacy Impact Assessments when handling personal information or making changes to systems handling personal information
  11. Education - provide training to the business regarding privacy regulataions and their responsibilities.

    A number of the above points will be familiar to entities who have performed sensitive asset identification exercises, risk assessments or have performed efforts to adhere to information security frameworks. A privacy program needs to be supported by a strong information security program - these cannot exist in isolation.

    The regulation in full is available at http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

TRENDING POSTS

Duncan Slater
Alert: Major UK Payment Service Provider iFrame Man-In-The-Middle Breach

The Foregenix Digital Forensics and Incident Response Team recently reported a man-in-the-middle ...

Read More
Kirsty Trainer
The "Key" to Secure Data - P2PE - Derived Unique Key Per Transaction (DUKPT)

Written by Andrew McKenna, PCI QSA, PCIP at Foregenix The encryption key infrastructure usually ...

Read More

Cyber Security Insights

Alex Constantinou
15/06/17 10:34

Password Manager OneLogin breached.

With the amount of websites and services which require passwords for authentication increasing, it can be difficult at times to remember all our ...

Read More

Ewan Gardner
01/06/17 12:20

General Data Protection Regulation (GDPR) is coming. Don't bury your head in the sand.

What does May 25th 2017 mean to you? The 40th anniversary of Star Wars being released in cinemas? The 78th birthday of celebrated actor Sir Ian ...

Read More

Duncan Slater
26/05/17 14:08

“Mind the Gap” – As a Small eCommerce Business, Who is Responsible for Your Security?

  Major corporations spend hundreds of thousands of pounds and in some cases employ teams of people dedicated to manage and ensure the security of ...

Read More

Kirsty Trainer
23/05/17 10:48

8 Critical Steps to Reduce the Risk of Ransomware Infection

The WannaCry ransomware infestation is a wake-up call for all entities connected to public networks, such as the internet, to recognise ...

Read More

Mike Hinton
16/05/17 17:24

Foregenix announce new partnership with Juno Web Design

We’re delighted to announce a new partnership between ourselves and Nottinghamshire based agency ‘Juno’. With the rapidly increasing threat to ...

Read More