Technology & Innovation

GDPR – An issue of hearts and minds, not cyber

October 20, 2017

Global, Europe

October 20, 2017

Global, Europe
Steve Durbin

Managing Director

Steve Durbin is Managing Director of the Information Security Forum (ISF). His main areas of focus include strategy, information technology, cyber security and the emerging security threat landscape across both the corporate and personal environments.  He is a frequent speaker and commentator on technology and security issues. Steve has considerable experience working in the technology and telecoms markets and was previously senior vice president at Gartner. He has served as an executive on the boards of public companies in the UK and Asia in both the technology consultancy services and software applications development sectors.


@stevedurbin

 

It bears repeating that, at its core, GDPR is about clarifying where PII is in any given organisation.

If there remained any doubt that breaches of sensitive consumer data are a deepening plague on society, the should silence any detractors. The Equifax breach (May-July 2017) alone is an unmitigated disaster that will have persistent negative effects on individuals and businesses. The fact that Equifax’s entire business revolves around collecting, tracking, and sharing highly sensitive personal data—and that they were not prepared to prevent, detect, or report the breach in a timely manner—should strike everyone from consumers to senior managers as particularly alarming. 

European Union (EU) regulators have already taken unprecedented measures to combat and contain data breaches. The GDPR is the greatest shake up in privacy legislation for over 20 years. Adopted in April 2016 and with enforcement due from 25 May 2018, it gives EU citizens much more control over their private data.

GDPR legislation redefines how and to what extent the Personally Identifiable Information (PII) of EU citizens and residents must be protected. GDPR’s scope is : it forces organisations—wherever in the world they are based—to comply with its requirements where EU citizen data is concerned. Penalties underscore the gravity of the mandate, potentially reaching beyond 20 million EUR for large global companies.

Any professional that has attended a security or risk-related conference over the last six months is almost guaranteed to have found vendors offering GDPR services. These savvy marketers know that it takes at least some specialist knowledge to comply with GDPR and they know many organisations have left their preparations until the last minute. Yet their offerings only address a portion of the work; there is no quick fix for diligent, continuous improvement efforts focused on people, policy, and process.

It bears repeating that, at its core, GDPR is about clarifying where PII is in any given organisation. It requires businesses to conduct a robust inventory of how information is collected, stored, managed and used moving forward. In order to be successful, an effective programme for GDPR must also consider related people and processes as well as technology elements during preparation and implementation. Relying solely on technology solutions will not sufficiently address the difficulties ahead. Until employees on every level internalise that data is treasure, the breach epidemic will continue to spread.

People

All staff (employees and contractors) need an appropriate level of awareness depending on their involvement in handling personal data throughout the information life cycle. The primary data handling functions include creation, processing, storage, transmission and destruction. In addition, executive management will be responsible for ensuring that an organisation meets its legal obligations to implement GDPR requirements.

A Data Protection Officer (DPO) is outlined as a core requirement of GDPR; this individual will serve as a focal point for ongoing data protection activities. However, an organisation’s governance functions—information security, legal, records management, and audit—should also ensure they are familiar with the requirements and have the necessary people, processes and technical solutions in place to achieve compliance.

Organisations that are already running effective compliance programmes have established a number of other roles (eg a central GDPR programme manager) to liaise at all levels while coordinating day-to-day actions across the business.

Another useful exercise is to appoint a team of individuals to act as GDPR ‘champions’ across the organisation by supporting and enforcing GDPR-related actions like data discovery, gap analysis and awareness campaigns. These types of initiatives can go a long way to ensure that all staff are aware of their roles in implementing a successful GDPR strategy.

Processes

With reform on the horizon, organisations planning, or already doing business in Europe, need an almost immediate handle on what data they are collecting on European individuals. They need to thoroughly document and monitor where it is coming from, what it is being used for, where and how is it being stored, who is responsible for it, and who has access to it.

Under GDPR, this means establishing appropriate data protection policies. New and enhanced data protection procedures should be built into processes that already exist in the organsation, including project planning activities, external service contracts and procurement processes or upholding rights to erasure or portability (ie, “privacy by design”). By engaging the people who deal with these processes in a conversation about GDPR and why it is important, organisations will be better equipped to update processes with the necessary requirements to become GDPR compliant.

GDPR is also forcing businesses to turn traditional data privacy on its head by assessing the impact from the perspective of the rights and freedoms of data subjects, rather than from an organisational perspective. The mechanism for this assessment should be put in place now to put businesses in good stead to meet this requirement.

Start Preparing Now

No organisation that operates a global footprint, either directly or through an array of suppliers, can afford to not prepare for changes that will result from new GDPR compliance rules. Falling out of compliance with data regulation can hit businesses hard in the pocket. Noncompliance can mean fines of up to 20,000,000 EUR or up to four percent of the annual worldwide turnover of the preceding financial year.

In addition, if an organisation is found to be infringing the requirements of the GDPR, supervisory authorities can compel an organisation to process data in certain manners or cease processing altogether. For many digitally transformed businesses, this could be a fatal hit. Authorities will also compel organisations to communicate data breaches to affected data subjects, resulting in bad press and reputational damages.

While GDPR may send companies unfamiliar with the regulation into a tailspin, the mandate is relatively straightforward. The checklist of rules simply requires a high level of preparation and acknowledgement of responsibility, all of which must be shouldered by the individual organisation — and more importantly, all the individuals within it.

For most organisations, this is a critical time for their data protection regimes as they determine the applicability of the GDPR and the controls and capabilities they need to manage their compliance and risk obligations.

Those organisations that appeal to the hearts and minds of the people within the organisation who deal with PII and the GDPR process will not only make compliance efforts more successful, they will strengthen their business as a whole and fortify the public trust upon which the digital economy is built. 

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week