logo.png
GET GDPR READY

Foregenix Blog

Andrew McKenna

Information Privacy, The General Data Privacy Regulation (GDPR) & Your Business

PCI, PA-DSS and P2PE, GDPR

,30/01/17 16:43

To begin, we'll take the following definitions of 'privacy' and 'information privacy' from the International Association of Privacy Professionals:

Broadly speaking, privacy is the right to be let alone, or freedom from interference or intrusion. Information privacy is the right to have some control over how your personal information is collected and used.

Here we'll discuss Information Privacy. In interacting with many online resources, we submit personal information in order to facilitate, customise or improve the user experience. A number of legal entities and instruments exist internationally which oblige the controllers of this data to process and store the data legally, fairly and securely. This includes requesting only the data required to perform the function requested, retaining the data for a period no longer than can be justified given the nature of the service, protecting the data from unauthorised access and misuse. The General Data Privacy Regulation (GDPR) which has been ratified across Europe will come into force in May 2018. This Regulation will not only be binding on entities processing or storing data in Europe but also on any entity processing or storing data on European citizens.

GDPR.png

While most businesses have programs, at various levels of maturity, to protect sensitive business and financial information, the personal information of customers is often stored in perpetuity in clear text without strong access controls. Moreover, inventories of this data are not maintained and the ability to extract this data discretely is often not exercised. Before providing some specific guidance points, I should mention the penalties for data breach as these will certainly make you sit up and take notice!

The following sanctions can be imposed:

  • A written warning in cases of first and non-intentional non-compliance
  • Regular data protection audits
  • A fine up to 10,000,000 EUR or up to 2% of the annual global turnover for the previous financial year in the case of an enterprise, whichever is greater
  • A fine up to 20,000,000 EUR or up to 4% of the annual global turnover for the previous financial year in the case of an enterprise, whichever is greater 

Here are a few things you should be doing and be able to do:

  1. Perform an internal discovery exercise to identify if you process or store customer's personal data
  2. Maintain an inventory of personal data stored
  3. Maintain and inventroy of personal data storage repositories
  4. Enforce access control to personal data storage repositories
  5. Enforce retention periods on personal data storage repositories and delete data securely at the end of said period
  6. Consider encryption of personal data
  7. Verify that if a customer requests their data, you have the ability to extract that data and provide it to the customer 'in a structured, commonly used, machine-readable and interoperable format'. I imagine this means xml or json but this is not specified.
  8. If a customer requests their data be erased, you must have the means to do this - 'the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform the controllers which are processing such personal data to erase any links to, or copies or replications of those personal data'.
  9. Implement Privacy by Design principles in internal projects related to customer information
  10. Perform Privacy Impact Assessments when handling personal information or making changes to systems handling personal information
  11. Education - provide training to the business regarding privacy regulataions and their responsibilities.

    A number of the above points will be familiar to entities who have performed sensitive asset identification exercises, risk assessments or have performed efforts to adhere to information security frameworks. A privacy program needs to be supported by a strong information security program - these cannot exist in isolation.

    The regulation in full is available at http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

TRENDING POSTS

Kirsty Trainer
"Key" to Secure Data - P2PE - Derived Unique Key Per Transaction (DUKPT)

Written by Andrew McKenna, PCI QSA, PCIP at Foregenix The encryption key infrastructure usually ...

Read More
David Kirkpatrick
Penetration Testing: The Quest For Fully UnDetectable Malware

Malware continues to be one of the main attack vectors used by criminals to compromise user and ...

Read More

Cyber Security Insights

Jake Dennys
18/04/18 15:02

Foregenix named as finalists in The Techies 2018!

The Techie Awards 2018 are a Business Exchange initiative to celebrate the innovation and entrepreneurship of the IT community in Swindon & ...

Read More

Duncan Slater
18/04/18 10:57

Reducing the Impact of a Breach Through Early Detection (Part 2) - Incident Response vs Incident Readiness

This two-part series is focused on reducing the impact of a breach through early detection. In part one we looked at the change in mindset from ...

Read More

Paul Taylor
17/04/18 15:43

Responsible Disclosure of Zero-Day Vulnerabilities Discovered in NfSen and AlienVault OSSIM (Part 2)

Part 2 of 2 – Vulnerability details This is the second and final post in our series about zero-day vulnerabilities we discovered in NfSen and ...

Read More

Duncan Slater
12/04/18 13:30

Embrace Failure To Improve Your Security

Like many others this week, I have been glued to the amazing action coming from the Gold Coast, Australia, as many of the world’s top athletes ...

Read More

Duncan Slater
09/04/18 11:53

Reducing the Impact of a Breach Through Early Detection (Part 1)

How you respond to any incident can have a dramatic effect on the overall outcome and its potential on going impact.  Over this two-part series ...

Read More