Category GDPR

The GDPR has been in force for 12 months and the anniversary passed with much less fanfare than a year ago. What has happened and what has changed? Our MD, Howard Freeman, looks back and discusses the last year, in the exciting world of GDPR.

A year ago, we were being bombarded with emails asking for our permission from businesses to send us even more emails! Everyone thought about updating their privacy notices. Some actually did update these, but not all. However, despite some poor and somewhat misguided coverage from the BBC and other media companies, the EU General Data Protection Regulation (GDPR) arrived on 25^th May 2018. 

Together with the Data Protection Act (DPA) 2018, the GDPR was to begin a new era where business would take the security of our data seriously. The promise of heavy fines if they failed to do so, awaited.

What was the reality of this? One year on, what have we seen and what have we learnt? Has business made it their mission to become compliant? Who tried to achieve compliance on the cheap and who did not bother at all?

Leading up to the date when the GDPR came into force, the 25^th May 2018, there had been a frenzy of activity. The clearest example of this was technology companies all claiming to have the ‘silver bullet’ and this was very obvious at InfoSec 2018. There was a coffee stall who in a somewhat tongue in cheek manner, outrageously claimed to have GDPR Compliant Coffee! There is no single technology solution to complying with the GDPR.

No need to panic

Many comparisons were made to the Y2K so-called ‘bug’ where it was predicted the world would end and aircraft would fall out of the sky at midnight on 31^st December 1999. Nothing happened then and the world continued to turn. On 26^th May 2018, the world didn’t end and we all carried on. Naturally, this led to GDPR fatigue, a problem exacerbated by the uncertainty of Brexit and complacency soon set in.

Many businesses see their data as their property, and they can do with it whatever they please. Businesses have invested time and money to build up this data and so it didn’t help when, after failing to gain consent caused by the flood of pointless emails leading up to enforcement day, such data was deleted. Making this problem worse was the arrival and subsequent disappearance of so-called experts. They lacked sufficient knowledge or qualifications, suggested deletion as the only option when this did not need to be the case. This was what we like to call risk dodging as they weren’t qualified to assess risk properly.

The Myths around Compliance

Many businesses believe they are complaint when it is obvious, they are not. Some just updated their privacy policy and for those who didn’t have one, copying and pasting from someone else’s website solved that problem! A lot of companies never even managed that! Today, we are still meeting new clients who have done nothing at all and believe they don’t have to.

Many businesses have not fully understood the six data processing principles defined in Article 5 or considered their lawful basis for processing. They have very few policies in place and often neglect the need to train their staff on the Regulation’s requirements. Even if they do, they view training as a tick box exercise.

The extent of the GDPR’s requirements are often underestimated, and some organisations think it’s easy to ensure compliance without the support of a specialist. This DIY approach is, at best, dangerous and often involves the use of templates which themselves may have been designed by someone who did not fully understand either. Companies are required to ensure that their compliance project is led by somebody with specific skills, as defined in the GDPR, particularly with regard to the DPO or ‘responsible person’ role. 

Sector Compliance

Financial services are by far the most advanced in terms of achieving compliance though IFAs, and groups of IFAs often rely on a central ‘system’ but don’t have any proof of the compliance of such a system. They generally accept the provider’s word for it. Many IFAs and group of IFAs continue to store and process data, oblivious to the risk they are taking and oblivious to their reputational risk.

The public sector has been quicker in adopting compliance measures than the private sector and by some distance. GDPR apathy is evident across all sectors though and in many cases, not up for discussion.

Data Breach Reporting

With the introduction of mandatory data breach reporting under the GDPR, a lack of compliance becomes most apparent when an organisation suffers a data breach. 

No longer can organisations that suffer breaches cover them up and hope for the best. Now, data processors are required to report all breaches of personal data to data controllers. In turn, data controllers are required to report breaches to the ICO within 72 hours of becoming aware of them. Data subjects must be notified without undue delay if there is a high risk to their rights and freedoms. Most organisations have no idea how to classify the severity of a breach or carry out an appropriate investigation. Many live in fear of having to admit to clients that their data has been compromised.

Breach reports increased significantly due to the fear of heavy fines. We hear all the time of cases being opened with the ICO that didn’t need to be. This has caused a severe delay in response times from the already overworked ICO. 

However, apathy is also apparent. We deal with a lot of cases where an email account has been hacked and not dealt with properly. The provider will normally clean up the mess, but small business doesn’t seem to want to tell clients that the contents of their email may have been stolen.

Many businesses do know they must report but many don’t want to risk it due to possible reputational damage. However, business is not seeing fines issued by the ICO. Therefore, the GDPR challenge to bring businesses to compliance is harder as they see it as not real and the belief that fines will never happen, at least not to them.

Safeguarding Personal Data

It is vital for organisations to limit access to personal data and to encrypt it. Security controls need to be implemented and validated. The Cyber Essentials Certification is security best practice to help achieve this. ISO27001 for information systems is also a vital certification.

Supply Chain Compliance

Many people believe that a data processor cannot be as liable as a data controller. A recent GDPR fine in Italy has proven this to be incorrect. The data processor operated the so-called Rousseau platform that operated a political website, plus affiliates. The fine of 50,000 Euros was not against the Data Controller, in this case the Movimento 5 Stelle political party, but the data processor, the Rousseau association.

Many organisations do not consider their supply chain but, when doing so, a non-complaint supplier may have to be replaced which, can be difficult and expensive. The use of supplier questionnaires is increasing but once returned, what happens next? Training on how to assure your suppliers are taking data protection seriously is important and its value not underestimated. Very few businesses carry out an audit of their supply chains and this has to change. This change must begin in the boardroom.

The ICO

The Information Commissioner’s Office is an often feared ‘bad guy’ or a help line for businesses who believe they have had or are having a data breach and need guidance. In the same way that going to A&E with a minor injury, calling the ICO for every incident is not why they are there. Yes, there will be some guidance and re-assurance but, once the problem appears to be solved, the caller and their business relax back into misguided non-compliance. Until of course, the next time, when the level of understanding won’t be quite as warm.

The ICO does want to be notified about breaches where the rights and freedoms of people are at risk. This must be carried out within 72 hours. What is the best way to do this? How much information is needed? Preparing such a declaration is complex and needs a clear head and no emotional involvement. If you think this is a plug for our breach management service then, you would be right. The benefit of an external organisation taking a view is a much better way of assessing what should happen next. This will allow the organisation to carry on with its business whilst we examine the incident. If the risk is low, then perhaps no report will be required. Internally, a report will be required as it is vital to understand what has happened and what measures can be put in place to prevent a repeat.

How do we help with reporting?

I often ask business, “if you had paid too little tax, would you call HMRC?” No, you probably would not. Most likely you would contact your accountant and leave it with them to resolve. After all, that is what you pay them to do. Some might say nothing and hope to get away with it. A head in the sand strategy never succeeds.

We like to consider ourselves to be offering the same vital service as an accountant, just in a different area of compliance.

GDPR made simple

Our team can help you no matter how much or how little work you have done towards GDPR compliance. Be it guidance, clarification, an audit or even just a chat, we are here to help you. Perhaps it is our Data Protection Officer as a Service, Breach Management Service or our DSAR Service or taking you through to full compliance, then we would be happy to talk.

We are a full-service company that will deliver the policies and procedures we agree with you. As a consultancy, we don’t sell packaged training courses, books or software tools that leave you to do all the work. We want you to be able to get on with running your business. Whilst you are doing that, we help you achieve and maintain regulatory compliance.

The next 12 months

Brexit will or won’t happen. That much is very clear, or unclear following the European Election results that came in on Sunday. By October, the UK will have left the EU or Article 50 will have been revoked. GDPR will stay no matter what, as the UK Government has always stated that this will be the case. Leaving the EU will not allow organisations to dodge the issue.

The ICO will continue to guide but whether fines for small businesses will begin, is debatable. Crippling a small business and seeing a dozen people lose their jobs through no fault of their own is politically dangerous but, it would send a very clear message. 

Implementing Cyber Essentials and GDPR compliance in a business must continue. However, it must increase if personal data breaches are to be prevented. Where they happen, management of the process and better outcomes for those whose data is lost.

What we will see is the rise in legal activity. BA is being sued for their now infamous data breach. Ticketmaster is facing a £5million law suit on behalf of 650 claimants following a data breach. It is claimed that victims suffered ‘multiple fraudulent transactions’ and ‘significant stress’. Such claims are only the beginning. Don’t be a victim…

Howard Freeman – 28^th February, 2019

The creation of an Internal Data Protection Policy is a good way to start your compliance journey with the General Data Protection Regulation (GDPR). As interpretation of the regulation can be complex and challenging for most people, it is a good idea to create an Internal Data Protection Policy.

Why should my company create an Internal Data Protection Policy?

The different departments or employees in your company will interpret the GDPR requirements indifferently. An Internal Data Protection Policy makes it easier for employees and saves them the effort of having to understand and interpret the entire GDPR by themselves. Not only would this be costly in terms of lost productivity, it may not be successful. In addition, your business can also articulate what is expected of your people and how these requirements must be fulfilled. 

The key elements of a Data Protection Policy

Typically, the policy will have the following elements:

• Purpose of the policy: This part of the policy describes why this Internal Data Protection Policy is being used, and why it is important for the company. Consider this more like the privacy vision of your company.
• Definitions of key terms: This part of the Internal Data Protection Policy defines key terms like personal data, special categories of data, etc., in the context of the company.
• Principles and purposes of processing: This part of the Internal Data Protection Policy defines the guiding principles for the processing of personal data, and the activities for which personal data can be processed. For example, this may include mapping the company activities to legitimate purposes defined in GDPR.
• Key requirements or controls: This part of the policy lists the key requirements that should be fulfilled in order to be considered compliant with the policy. To ensure that employees and managers can validate the fulfilment of a requirement, a set of controls can be provided. For example, to fulfil the requirements of lawful processing, a control should be implemented to ensure that all processing activities are listed and mapped to one of the legitimate purposes defined in the policy.
• Key roles and their responsibilities: This part of the policy defines the key roles for your team and the stakeholders for ensuring compliance with this policy. This section also outlines the responsibilities of each of the key stakeholders. It is important to note that the responsibilities of employees must also be explicitly stated, so that the employees feel like a part of it. This is the start of creating a culture of awareness, better known as a GDPR Culture.
• Appointment of Lead Supervisory Authority: This part of the Internal Data Protection Policy states who is considered (from the perspective of your company) to be the Lead Supervisory Authority. If your company is based in multiple locations, or operates as different legal entities, it should be specified how the management intends to manage the relationships with different Supervisory Authorities. In the UK, this is the Information Commissioner’s Office (ICO).

Having an internal Data Protection Policy within a company can be a huge advantage. You must not underestimate the value of this of having such a policy, as it allows all employees and external staff of your company to understand what is to be done, and why. 

What is more important, as part of the approval process, it will allow your senior management to be aware of the company’s obligations in relation to the GDPR. So, if you can do so, create your Internal Data Protection Policy today. If not, see the services we offer and call us if we can help you create your policy and help on your journey to GDPR compliance.

The ICO announced this week that a former headteacher has been fined over £1000 by a magistrate’s court for unlawfully obtaining children’s personal data from previous schools where he had been employed.

Darren Harrison took the information from two primary schools where he had been employed and then transferred it to the computer system at his new school. As he had no lawful reason to do such data processing, he was found to be in breach of the data protection legislation.

Six months into his role as Deputy Head at Isleworth Town Primary School, Harrison was suspended. A subsequent IT audit showed large volumes of sensitive personal data present on the Isleworth server from his previous schools, Spelthorne Primary and The Russell School in Richmond.

During the course of the investigation, Harrison provided no valid explanation as to how the information had appeared on his system, which was via an upload from his USB stick, stating he had deleted the personal data from it.

In a subsequent interview with the Information Commissioner’s Office (ICO), Harrison read from a prepared statement advising that the information had been taken for professional purposes.

Appearing before Ealing Magistrates’ Court, Harrison admitted two offences of unlawfully obtaining personal data in breach of s55 of the Data Protection Act 1998.

He was fined, and with additional costs including a victim surcharge and court costs, this totalled over £1000 

In another incident, The University of Greenwich was fined £120,000 by the Information Commissioner following a “serious” security breach involving the personal data of nearly 20,000 people.

The personal data included contact details of 19,500 people including students, staff and alumni such as names, addresses and telephone numbers. However, around 3,500 of these included sensitive data such as information on extenuating circumstances, details of learning difficulties and staff sickness records. This was subsequently posted online.

This was caused by a microsite created on the University infrastructure, created by an academic with the University’s consent to facilitate a training conference as long ago as 2004. The site had an anonymous upload function to allow delegates to upload conference papers. Following the conference, this was not removed or disabled and it didn’t receive regular security updates. In 2013, it became apparent that the site had been compromised.

In mid January 2016, hackers exploited this microsite using SQL injection to gain access to an account with sufficient permissions to upload PHP exploits. These exploits in turn allowed the attackers to gain access to other databases hosted on the web server. The attacker then extracted the data.

The case of Harrison is symptomatic of careless IT and lack of care with regards to personal data. We have always recommended not using portable storage devices for reasons like the Harrison case but also for cyber hygiene. He took large amounts of data and admitted taking it for ‘professional reasons’ and that he had no right to process the data. For the latter, he was in breach of the DPA. Not only did he face a fine and costs, he also lost his job!

A representative of the ICO said that: “they (the ICO) will continue to take action against those who they find have abused their position of trust.”

What could the three schools have done to prevent this happening?

• Ban and block the use of USB storage devices to prevent anything being saved to them.
• Cloud services where documents are accessed and worked on ‘in the cloud’ with download functions turned off.
• Carry out data discovery to understand where data is being stored and by whom.
• Put in place an ‘Acceptable Use Policy’ to make the use of USB storage a disciplinary matter.
• Create a security culture to encourage staff to discourage bad practices and behaviours.

How could the University have prevented their incident?

• Conducting an exercise to understand exactly what was on their network. This would have revealed the presence of more than one microsite that were simply not needed.
• An audit to show risk of where student and other personal data was stored would have revealed how easily a theft could take place.
• Understanding the age of the data and why it was stored might have reduced the impact. If this data, or some of it, was historic and not required, then surely it would have been worth deleting and therefore reducing the size and impact of the breach.

So, why do educational establishments need a Data Protection Officer?

• A good DPO is truly independent. An external DPO is even better
• To data map and discover data silos
• Understand the flow of data around the establishment
• Audit systems, users and their behaviours
• Record data breaches and report where appropriate
• Handle DSARs in a compliant manner and record all requests and outcomes
• Ensure that the supply chain is compliant and monitor this
• Help create a GDPR culture and train all the people in the school

If you would like to know more about our DPO as a Service for schools and colleges, please get in touch on 03333 22 1011 or email [email protected].

Data Protection Officer as a Service

The GDPR (General Data Protection Regulation) states that any organisation must not keep data for any longer than it is needed.

Article 5(1)(e) states:

“Personal data shall be:

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’)”

Deciding your Data Retention Policy

Without specific retention periods set within the GDPR, it is up to your business to establish how long data should be kept for. When determining your retention periods, it is important to bear in mind that you will need be to be able to justify them. Your retention periods should be based on two key factors: the purpose for processing the data, and any legal or regulatory requirements for retaining it.

Data should not be held for longer than is needed and shouldn’t be kept ‘just in case’ you might need it. Old data is potentially toxic to an organisation. If you don’t need it, get rid of it. However, as long as one of your purposes still applies, you can continue to store the data.

Legal and regulatory requirements should also be acknowledged, because you may need to keep hold of data for reasons such as tax and audits, or to comply with defined standards and guidelines. This is not considered to be keeping the information for longer than necessary because it is then being processed for the purpose of meeting your legal obligations. A good example of this is HR pay records being kept as required by the HMRC.

What to do with Data once past the Retention Period

Your Data Asset Register can be amended to include retention dates. This allows the responsible person to track and then arrange deletion on or before the required date. Any failures to delete or inability to confirm if any data might exist on back-ups, mail servers or on personal computers should be recorded and a note added to the risk register.

If you don’t want to delete the data you can keep it if you anonymise the data. However, if there is any possibility that this can be linked to an individual then this means it has not been carried out properly.

If you go the deletion route you must also seek out paper copies of the data which could be slow and ultimately unsuccessful. This is why you need to know in advance where all your data might be. People love to print documents which is why interviews must be carried out during the discovery phase.

With this in mind, examining backups, email accounts and machines no longer in use should be checked and then permanently deleted.

Anonymised Data

If you have chosen the anonymisation route, the Regulation allows it to be kept for as long you wish. This means that the information cannot be connected to an identifiable data subject. If the data “could be connected to a natural person by the use of additional information”, then it is not adequately anonymised. A great deal of care should be taken to understand whether the data is really needed.

Under the storage limitation principle (Article 5(1)(e)), personal data can be retained for longer periods without being anonymised if the data is being kept for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

Maintaining Compliance

Maintenance of compliance is what all business strives to achieve but not all remember that GDPR is a journey, and like car for example, it must be maintained. When considering data retention for maintenance of compliance, understanding where your data is is important. Without a data discovery project, you will find it impossible to then classify your data and therefore not knowing how you acquired the data will make it impossible to decide how long you should keep it. A Data Asset Register with someone in your organisation having responsibility for its upkeep will keep track of the information going in and out of your organisation, and its location whilst in the business.

The best method of tracking all the data your organisation holds is known as a data flow map which sets out how data flows around your business and allows you to identify the data you hold and where it is moving to and from.

These maps keep track of what data comes into your organisation, where it goes, who has access to it and where it is stored. A data flow map should be used in conjunction with an Access Policy to determine who has access to the data.  It also allows you to plan how your data will be used and if it will be needed for future use – which is important when deciding your data retention periods.