AIIM webinar on EU Data Protection 24 September

Just putting final touches to my presentation. Despite the migrant crisis, there is a lot going on at the moment across Europe on #gdpr. Somewhat ironically having GDPR in place by now, may have helped address the information flow issues which could support a 'whole Europe' policy for migrants/refugees.

EU GDPR - data protection will never be the same again

(This blog entry is based on an AIIM webinar given on 17 July 2014)

 
As an IT practitioner I have a lot of bitter experience regarding Data Protection. I helped implement the first 1984 DPA in a large chunk of the UK NHS in 1985, and was on one of the people involved in the advisory panels for the amendments brought in for the 1998 Act.
For those readers who are unfamiliar with the abbreviation, the GDPR is the European Union General Data Protection Regulation that is intended to replace the current Data Protection Directive, and throughout this blog I will aim to explain the reason for the new Regulation and the differences from the Directive(s).
This blog and its wording is based upon the assumption that most readers are in businesses or organisations which will be affected by the GDPR, there are very few who won’t be. If not forgive me and contact me later for specifics relating to your context.
Just to clarify, Data protection is about effectively managing personally identifiable information, ensuring that the rights of the persons identified are not breached. It applies equally to both manual and electronic records
Data Protection in the EU has been around for a long time, but not because of the bureaucratic ambitions of Brussels. Rather it supports the founding principles and objectives of the EU, facilitating both free trade and a level playing field for businesses. It also supports the articles of the European Convention on Human Rights (ECHR) which all member states ascribe to.
Like the US Sarbanes Oxley Act (SBA) in 2002, the DP Directive(s) and the new Regulation effectively codify best business practice. The SBA basically enshrined in law the Federal Rules of Business first published in 1937.
The GDPR is not one of those ideas put out by Brussels which will get forgotten. It has been in debate for 20 months, it has had 250 hours of committee time, and has had 3000+ amendments tabled and addressed, it will happen.
As previously mentioned EU DP legislation is not new, being 30 years old, however the original directive did not envisage the rapid march of technology. For example the emergence of social media and cloud, Neither did it consider that the EU would be 28 countries big with ambitions to be bigger. At present, each of the 28 states has its own Data Protection Act and some of them conflict. In addition multinational companies currently have to register with the relevant Data Protection Authority in each of the member countries within which they operate.
The current directive, snappily named 95/46/EC, is therefore no longer fit for purpose, and needs updating for all the reasons mentioned above, and GDPR is has a specific focus on making the rules clearer for both social media and cloud services. 
Readers please note, it is a Regulation not a Directive, so rather than the 28 different interpretations we currently have, it will create a single regulatory landscape within the EU. This is particularly relevant for cloud applications and cloud storage providers.
Meanwhile, until it kicks in, organisations will have to comply with the individual regulations across 28 member states, plus those outside. AIIM, in association with the London law firm Bird & Bird, is currently producing a definitive guide as to how 11 of those country’s rules apply to the cloud, and to an extent, how their Information Commissioners are interpreting and enforcing them across a number of different data types.
From the implementation of the GDPR one single set of rules will apply to all EU member states and there will be one Single Data Protection Authority (DPA) within the EU responsible for each company depending on where the Company is based or which DPA it chooses to register with.
The significant changes from the previous directive include:

·         The GDPR Applies to “any information” (that can identify a person i.e. a ‘data subject’) whether private, professional or from public life.

·         The GDPR requires both ‘Privacy by Design and by Default’ (Article 23) and  that data protection is built into systems and processes and therefore privacy is accorded a high priority.

·         Data controllers in organisation must be able to prove "explicit consent" (opt-in) and consent may be withdrawn by the data subjects.

·         A data subject shall be able to request a copy of personal data being processed in a format usable by this person and be able to transmit it electronically to another processing system, and delete it.

·         Data Protection Officers (Articles 35-37) are to ensure compliance within organisations. They have to be appointed for all public authorities and for enterprises with more than 250 employees.

·         The Company’s data controller has to inform the Data Protection Authority (DPA) within 24 hours (this will probably change to ‘without due delay’) of any breach (Article 31).

·         Data subjects must be notified of any adverse impact consequent upon a breach (Article 32).

·         The Regulation enforces the ‘right to be forgotten’. Upon withdrawal of consent (or upon it no longer becoming necessary), an individual’s  data must be deleted unless there is a legitimate reason for its retention (Article 17).

     ·         There are a range of fines can be levied for non-compliance – up to EUR 250,000 or 0.5% of annual global sales for not responding to requests by the data subject or DPA, and up to EUR 1 million or 2% of annual global sales for not complying with specific GDPR regulations. To put that in context, currently in the UK the maximum fine for breach is £500,000 or EUR 628,500.

The drivers for a change to the directive also reflect what is happening on the ground. Mario Costeja, the Spanish Lawyer who recently took a case against Google requesting that it removed search results to ‘outdated’ information on him won his case in the ECHR, and now Google has established a process for removing such links in searches. However it has been to put it mildly ‘overwhelmed’ with 70,000 individuals requesting in excess of 250,000 links being removed.
And as we found out here in the UK recently, the ruling could have unforeseen consequences, as when a top BBC journalist was informed by Google that links to one of his blog posts, on the BBC website would be cut.
However, this is NOT the right to be forgotten as envisaged by the Regulation, but it is an important step towards it.
I previously referenced the US SBA – that act not only applied to the actions of US companies on US soil but to all their subsidiaries in other countries. With a similar global view, the GDPR applies to any organisation collecting personal data on individuals in any of the 28 EU states, irrespective of where that company is headquartered, or where the data is held.
Thus a company such as the cloud based file sharing and collaboration provider BOX, which does not have any EU data centres IS subject to the regulation, because it collects personal details on an EU subject.
The regulation also overrides the legal complexities we have established in current business relationships. For example, a German company signs a contract with the Irish subsidiary of a US cloud provider, fully aware that a backup of all data is physically stored in a data centre in India. While the legal location of the provider would be Ireland, the political location would be the US and the physical location would be India, legally under the regulation all data is still under German control and the responsibility of the German company.
In April, here in the UK, Trend Micro commissioned some research on awareness of the GDPR undertaken by Vanson Bourne. It includes some good and some frightening figures. First a scary, across Europe 15% of companies were not aware of the GDPR. Then some mixed messages:

·         Whilst 88% of British companies said they were aware, a tiny 7% thought their understanding was good.

·         Whilst the French had a lower level of awareness overall at 73%, those whose understanding was very good was much higher than the UK at 23%.

·         Somewhat stereotypically our German cousins had a very high awareness of  a forthcoming EU Regulation i.e. 92%

·         The real scary figure revealed by the survey is that 14% of British companies do not currently comply with 95/46/EC. That does not put them in a good position for meeting the timescale of the regulation.

Continuing the look at the awareness of the GDPR, AIIM undertook some research earlier in 2014, looking at world-wide numbers, for financial services organisations. Whilst having a “what is it?” figure, not surprisingly a bit higher than Trend’s “Not aware”, the research also had the frightening figure that 23.5% did not think the GDPR applied to their organisation.
The vast majority of those organisations have got it wrong! As I have previously expressed, if an organisation holds personally identifiable information either electronically or in manual form on EU citizens – the Regulation, applies to them in whichever country they are based. And it is not just customer data, it is employee or even associate data (with, it must be added, a few exceptions that would confuse this piece).
Whilst I have an opinion on the date for implementation of the regulation, it is still ‘up for grabs’. The reason being that the Regulation has to be approved by the 700 plus new Members of the European Parliament (MEPs) that took their seats on the 1 July 2014. A not insignificant chunk of them don’t like the EU, and want to frustrate its operations. However, back to my earlier comments, the Regulation is pretty much ‘done and dusted’ in technical terms. It has been in negotiation for 20 months, there have been 3000 plus amendments tabled and in excess of 250 hours debating time. I don’t foresee many more changes and neither does the EU Parliament, with a target date for passing the Regulation set for late 2014.
However, for organisations that are worried about addressing the Regulation, there is a 2 year implementation period, recognising that some countries and organisations need to be brought up to a level of compliance. Therefore by early 2017 all organisations need to be ready. Obviously if an organisation is complying with respective countries Data Protection Acts, it should be easier.
So in summary: Organisations should not be afraid of the GDPR. Unless they are one of the 14% of UK companies that do not currently comply with 95/46/EC. Compliance with the GDPR should not be a big leap, and even if they don’t two years is a big window.
Please note however, given the Mario Costeja case and the recent revelations that Facebook tested user responses without their consent, this is ‘hot stuff’, and potentially easy pickings for regulators
The relevant experience I would like to bring to readers is again of the SBA. Companies investigated by the SEC for potential breach would spend effectively 6 months in ‘shut down’ whilst their directors and executives provided information to the SEC, irrespective of their compliance or not. Six months when their competitors could innovate, and take market share.
Back to my opening comments  – at its base the GDPR it is about supporting free competition – it is coming - grab it – use it – those who are ready will have an major advantage.

EU GDPR , not hard to address - just think differently

When I am discussing with clients the potential impact on their business processes of the forthcoming EU General Data Protection Regulation (GDPR), I am invariably asked for an example and I always endeavour to identify one appropriate for their business environment.

Imagine therefore, my delight when one, which is applicable to more than half the UK population, landed literally on my mat this morning.

The example in question was a letter from our local Electoral Registration Officer (ERO -the council chief executive) explaining that there are now two versions of the electoral register: the existing ‘electoral register’ and the new ‘open register’, but I didn’t need to do anything as I had automatically been put on both.

In the UK, the electoral register lists the names and addresses of everyone who is registered to vote in public elections, it is also used for detecting crime, calling people for jury service and checking credit applications. The new open register is an extract from the electoral register which can be sold to any person, company or organisation, in most cases for marketing by the person buying and to raise income for the ERO selling.

One of the central requirements of the forthcoming  GDPR is that there is ‘explicit consent’ for the use of personal information, with a few exceptions for national security and public health. Therefore under the Regulation, rather than the wording of my letter being ‘Your name and address will be included in the open register unless you ask for them to be removed’. The wording needs to state ‘Please confirm you are willing for your information to go on the open register’.

This may make my ERO balk, because rather than a few members of the electorate ringing up his team to be taken off the open register i.e. ‘opt-out’, his team would potentially have to deal with a much higher number of requests to ‘opt-in’.

However, if the ERO looks again at the process; each year he sends a letter to the ‘head of the household’ requiring them to list the names and dates of birth all residents who will be 18 before the next election. It would be a simple change to require there to be a signature against each name confirming that that person wishes either to ‘opt-in’ or ‘opt-out’ of the open register. This should be compliant with the GDPR and as a bonus it could reduce the current opportunity for electoral fraud.

As I said in a recent AIIM webinar organisations need to see the GDPR as an opportunity, not an overhead, those that don’t will be caught by the regulator and it will cost, both in reputation and fines (up to €1 million or 2% of annual global sales). My suggested change to process will not cost the ERO any more than now, and may even save him the costs of some of his team answering calls from the worried electorate.

Blasts from the past

Just found two videos of myself on the interweb. One at EMC Documentum in Lisbon, and the other at the EU ICT conference in Lyon. Quite scary, but they do give the confidence a boost. Links here if you promise not to criticise.

Internet search engines biased? Duh?

The news that Google is in discussion with European Commission (EC) to settle the alleged antitrust case around the biasing of search results to promote its own products, was inevitable, given that a similar allegations are being investigated by the FTC in the US.
What is surprising however, is that users of the dominant internet search engine in Europe apparently cannot recognise the bias.
Google is a business, it is not a charitable endeavor like Wikipedia. As a company it would be niaeve, in fact iresponsible to to its sharehol;ders not to promote its own, and other sponsored products.
When I go to my local Tesco supermarket, at the end of the isle will be the branded goods being promoted (and which Tesco is paid to place there). Then down the isles there will be a mix of branded and Tesco own label goods, with the own label goods often having a promotional price on the shelf edge.
Despite the ideal of a totally free internet, it has to be paid for somehow. Even Jimmy Wales has to post a donation request message once a year.
In due course Google will stump up lumps of cash for both the EU and US treasury coffers, and will make some changes to the algorithms. Let's just hope that the organisation currently funding the lobbying of the EC, Microsoft has the algorithms in Bing ready for inspection.