Another important difference between the Data Protection Act and the GDPR is that two existing Privacy concepts will be entrenched in law in Article 25, namely ‘Privacy by Design’ and ‘Privacy by Default’.
These concepts are not new but will have enhanced prominence and importance with the enforcement of the GDPR, under Article 25.
Privacy by Design means businesses need to consider privacy at the initial design stages and throughout the development process of any new products, processes or services that involve processing personal data.
Privacy by Default means that when a system or service includes choices for the individual on how much personal data he/she shares with others, the default settings should be the most privacy friendly ones.
Sounds simple, right? Well, maybe not…. It is far more than a tick-box compliance exercise that can be buried within audits and contracts…it requires full commitment to build data protection into company culture and all aspects of its operations. Essentially, these Principles encapsulate an ethos that should permeate every organisation that controls or processes personal data.
So here are a few tips for applying these key principles (and soon to be legal obligations):
Educate all staff so they understand the principles – and that the Privacy obligations and accountability sit with ALL staff not just IT or compliance teams
Conduct a Privacy Impact Assessment – or PIA. A PIA is an analysis of how personally identifiable information (PII) is collected, used, shared, and maintained within the organisation
Best practice is to create a PIA template which can then be filled in for each new system or product/service. The ICO have provided a PIA template https://ico.org.uk/media/about-the-ico/consultations/2258461/dpia-template-v04-post-comms-review-20180308.pdf
Implement appropriate technical and organisational measures to ensure that only personal data necessary for each specific purpose are processed. This applies to the amount of personal data collected, the extent of processing, period of storage and accessibility
Data collection techniques – including cookies – should also be reviewed and revised to avoid excessive data collection. Ensure that automated deletion processes are in place to remove personal data after an appropriate (and set) period of time
Remember this is a legal obligation – no longer a ‘good idea’ or a ‘nice to have’
One big benefit of applying Privacy by Design and Default, is that it will also make it easier to be transparent, which is absolutely key when it comes to earning the trust to collect the data in the first place – and also a fundamental principle of the GDPR.
So, time to embrace Privacy!
Read about how REaD Group have embraced information security and implemented Privacy by Default [https://gdpr.report/news/2017/10/23/breach-level-index-findings-must-businesses-better-protect/]