General Data Protection Regulation Philippe Roggeband. Business Development, Manager, GSSO EMEAR

Transcription

1 General Data Protection Regulation Philippe Roggeband Business Development, Manager, GSSO EMEAR

2 Why should you care? Data Protection, and compliance with the General Data Protection regulation, is NOT an option. It becomes mandatory in May 2018 Not being compliant may result in huge fines (up to 20M or 4% of the WW turnover) Demonstrating compliance ahead of time will be an important business differentiator

3 Some background GDPR took over three years for an agreement to be reached It has 173 Whereas elements defining the context It has 99 articles stating obligations It will come into effect in May 2018 Fun fact : It has 20,000 more words than Shakespeare s Hamlet

4 Some basic terminology Regulations have binding legal force throughout every Member State and enter into force on a set date in all the Member States. Directives lay down certain results that must be achieved but each Member State is free to decide how to transpose directives into national laws. Decisions are EU laws relating to specific cases and directed to individual or several Member States, companies or private individuals. They are binding upon those to whom they are directed.

5 What was voted on 27 th April 2016? Regulation 2016/679 On the protection of natural persons with regard to the processing of personal data and on the free movement of such data Repealing Directive 95/46/EC Directive 2016/680 On the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data Repealing Decision 2008/977/JHA

6 In other words Regulation 2016/679 applies to all organisations which control or process personal data Directive 2016/680 applies to law enforcement bodies : Police, Ministry of Interior, state investigation organisations etc. This deck is about REGULATION 2016/679 and how it may affect your organisation

7 Introduction Whenever you open a bank account, join a social networking website or book a flight on-line, you hand over vital personal information : Name, Address, Credit card number, etc. Under EU law, personal data can only be gathered legally under strict conditions, for a legitimate purpose Persons or organisations which collect and manage your personal information must protect it from misuse and must respect certain rights of the data owners Public authorities and individuals transfer vast amounts of personal data across borders. Common EU rules ensure that personal data enjoys a high standard of protection everywhere in the EU. The EU Data Protection regulation also foresees specific rules for the transfer of personal data outside the EU

8 Personal Data definition personal data means any information relating to an identified or identifiable natural person ( data subject ); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person

9 Data Processing definition processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction

10 Data Controller definition controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law

11 What has changed with the new Regulation?

12 Key changes vs Directive 95/46/EC GDPR defines new rights for consumers (Data subjects) The GDPR will apply not only to companies established in the EU, but to all companies that target EU markets or consumers. Penalties for non-compliance will reach unprecedented heights with new maximum fines of EUR 20 million or 4% of annual worldwide revenue. EU legislators have introduced significant compliance burdens such as recordkeeping obligations and mandatory privacy impact assessments (PIAs) and, under the accountability principle, companies will have to be able to demonstrate compliance upon request.

13 Consumer / individual rights Unambiguous consent Right to withdraw consent Right to data portability Right to be forgotten Right to be informed when data is compromised Right to compensation One-stop shop

14 Individual Rights : Conditions for Collection and Use Legal Basis for Processing (or legitimate reason) : Necessity to perform a contract ; compliance ; legitimate interest which outweighs privacy right Fraud prevention Consent Freely given, specific, informed and unambiguous indication Can be withdrawn Right to be forgotten Right to request that individual data be erased. Exemptions may apply if the processing is deemed necessary for the exercise of freedom of expression, compliance with a legal obligation, public interest

15 Individual Rights (ctd) Right to Data Portability Provides a way for consumers to take their data from one service provider to another. Individual will be able to request a copy of their personal information in a structured and commonly used electronic format. Only applies to information obtained on the basis of consent or as necessary to perform a contract

16 Scope of the Regulation Data Controller or Processor is based in EU Data Subject is based in EU, even if the holding / processing organisation is based outside the EU This means in practice that a company outside the EU which is targeting consumers in the EU will be subject to the GDPR. This is not the case currently.

17 Remedies, Liability and Penalties (Articles 77 to 84) Data Subjects can exercise rights to Lodge complaints Effective judicial remedy against controllers or processors Compensation and liability in the case of infringement of the Regulation Administrative fines can be imposed Infringements to obligations of the controller, processor, certification body or monitoring body : 10M or up to 2% of total WW turnover Infringements to basic principles, data subject s rights, transfer of personal data to non-compliant third parties : 20M or up to 4% of total WW turnover

18 Compliance and Governance Accountability : companies must be able to demonstrate their compliance to regulators on request. Documentation and Recordkeeping Companies must register data processing activities with their DPA Data controllers and processors must maintain a record detailing purposes of data processing ; potential data recipients ; appropriate safeguards ; security measures.

19 Compliance and Governance (ctd) Privacy Impact Assessments Companies will be required to conduct PIA s for processing activities which are likely to result in high risk for the rights and freedom of individual, e.g. Use of sensitive data Systematic monitoring of public areas.. PIA will include Risk Assessment Analysis of safeguards and accountability measures

20 Compliance and Governance (ctd) Privacy by Design and by Default Requires that companies put in place technical and organisational measures to implement data protection principles GDPR mentions pseudonymization as an example of such measures Other measures include : Key coding techniques Limiting access ( need to know ) Data minimization Limiting data retention

21 Compliance and Governance (ctd) Data Privacy Officer GDPR introduces a requirement to appoint a DPO, but only in limited circumstances Company s core activities require regular and systematic monitoring of individuals on a large scale Activities include large-scale processing of sensitive data Data processed relates to criminal offences DPO may be appointed for a group of companies DPO must have expert knowledge of privacy and data protection law and practice

22 Cross-border Transfers and Binding Corporate Rules EU data protection law prohibits transfers of personal data to non-eu countries that do not provide for an adequate level of personal data protection without individuals explicit consent, unless appropriate safeguards are in place. In addition to continuing to recognize approved Standard Contractual Clauses, the GDPR now formally recognizes the use of BCRs Binding Corporate Rules ("BCR") are internal rules (such as a Code of Conduct) adopted by multinational group of companies which define its global policy with regard to the international transfers of personal data within the same corporate group to entities located in countries which do not provide an adequate level of protection. Putting in place BCRs entails implementing a comprehensive privacy program which is then subject to the approval of European data protection authorities (DPAs).

23 Mandatory Breach Notification & DPA s Companies must notify the competent DPA (Data Protection Authority) within 72 hours DPA s have new task and powers Imposing fines for non-compliance Handling complaints Co-operation with other authorities Drafting standard contracts for data transfers

24 Key changes (ctd) Binding Corporate Rules (BCRs) are formally recognized as an international transfer mechanism. Mandatory breach notification will be established for all of the EU Member States.

25 High-level roadmap to compliance Data Policies Users Processes Technology

26 Are there existing Policies? Do they include Compliance elements? With what? Are roles defined? Do they include need-to-know & Separation of Duties? Are Access control rules defined and implemented? Are they role-based? Are they context aware? Are they granular? To what level? Do they meet GDPR requirements?

27 What is the status of operational capabilities? Are processes defined to align new initiatives / projects with policies? Is there a SOC? Are processes defined to deal with incidents? Is there an Incident Response Team? Do currently installed technologies allow these processes to be effective? Access control Incident / breach of policy detection Incident response

28 How can Cisco help?

29 Cisco s Approach to Managing Privacy Understand Prioritize Develop Govern Privacy Impact Analysis Kickstart a program Periodic review of capability evolution Privacy Program - Assessment and Strategy Development Comprehensive assessment of requirements and development of a program roadmap Privacy Compliance Program Support Accelerate development and implementation Transform compliance requirements into a practical program

30 Service Description Scope & Impact Analysis Program Assessment & Development Compliance & Certification Support Address GDPR requirements Assess applicability of your organisation s data, partners and entities to GDPR compliance Understand the current state of your compliance program and the steps to create an effective data protection program Perform a review of your GDPR program to adjust for changes in business services, new markets, adoption of technologies, use of partners and changed regulations Identify other privacy obligations anticipated by your business plans Develop a custom GDPR programme Perform an evaluation of GDPR requirements and obligations Understand specific business needs, information lifecycle, growth plans and use of technology Perform a Data Protection Impact Assessment to discover PII that is being collected, why it is being collected and how it will be used, secured, shared and stored. Assess existing program against a custom set of relevant process maturity goals Development of a comprehensive program roadmap to meet the needs of the business and GDPR compliance Accelerate implementation of existing GDPR programme Provide independent and experienced advice on how to meet GDPR mandates Transform GDPR compliance requirements into a practical program and implementation plan Review governance mechanisms of your current GDPR compliance program and assess readiness for certification *Assuming large enterprise, local. MNC will be multiple derivative, depending on # of business lines.

31 Cisco Technology solutions NAME SHORT DESCRIPTION Secure Data Centre Obviously, Data Centres will be the location of choice to store personal data, and as such, will be the primary target for attacks on confidentiality. The Cisco Secure Data Centre for the Enterprise Solution Portfolio provides design and implementation guidance for enterprises that want to deploy physical and virtualized workloads in their data centres. Using our solutions can provide exceptional protection to address today's advanced data security threats. Associated technologies: NGFW, NGIPS ACI Stealthwatch Advanced Threat Analytics Network Segmentation & Access Control One of the key elements of GDPR compliance is controlling access to the resources where the personal data is stored and processed. Cisco s Access control and network segmentation capabilities help customers gain awareness of everything hitting their network, and provide access consistently and efficiently. This relieves the stress of complex access management, as security policies are updated and distributed dynamically. Associated technologies: Identity Services Engine TrustSec Breach detection and notification Major news organisations, analyst reports, and companies have all confirmed a new era of intrusions, theft, and malicious attacks. A major challenge facing organisations seeking GDPR compliance will be detecting these advanced threats, then analysing and blocking them. Cisco offers a full portfolio of solutions, combining combines static and dynamic malware analysis with threat intelligence into one unified solution. Associated technologies: OpenDNS Advanced Malware Protection, ThreatGrid Stealthwatch (Network as a Sensor) Active Threat Analytics

32 What about Cisco? Will we be compliant? As the GDPR seeks to strengthen privacy compliance and organisational accountability while driving consistency and interoperability throughout the EU and the world Cisco is committed to full compliance with the GDPR requirements by May From our developers and engineers to our legal and HR programs, we look at data protection and privacy from all angles. We devote significant resources to data protection and privacy and have a rigorous compliance program that has been driving toward robust privacy protection for years

33 Do you need more information?

34 8 Recommendations Prepare for data security breaches Establish a framework for accountability Embrace privacy by design Analyse the legal basis on which you use personal data Check your privacy notices and policies Bear in mind the rights of the data subjects If you are a supplier to others, consider whether you have new obligations as a processor Consider BCR to facilitate cross-border data transfers

35 Closing thought Being Compliant does not make you secure Being Secure helps you to be compliant

36