Connect with us

Security

The Ultimate Beginners Guide to GDPR Compliance in 2019

Published

on

What is GDPR?

By now you’ve probably all heard the term GDPR. Up until 25th May 2018 the guidelines surrounding personal information, in relation to privacy, were a bit wishy-washy. The Data Protection Directive (1995) did provide some basic guidelines but it simply wasn’t good enough.

We’ve always taken a keen interest in GDPR as many VPN’s have had to make serious changes to the way they operate inc some of the major players like Avast and NordVPN.

The monitoring and sharing of information is now covered under the General Data Protection Regulation (GDPR). This aims to ensure that information is handled responsibly, by any company that deals with personal information and privacy.

According to ICO, there are 7 key principles that GDPR sets out. These are:

  • Lawfulness, fairness and transparency
  • Purpose limitation
  • Data minimisation
  • Accuracy
  • Storage limitation
  • Integrity and confidentiality (security)
  • Accountability

The principles outlined aren’t rules as such, but more so an outline of fundamentals that should be followed when creating good data protection practice. If individuals or companies fail to comply with the principles, they could be fined up to €20 million, or 4% of your total worldwide annual turnover (whichever is higher).

What was before GDPR?

GDPR is applied throughout Europe, with each country having it’s own amount of control regarding certain aspects of the regulation. The U.K. has implemented the Data Protection Act (2018) which replaces the 1998 Data Protection Act.

The new act was passed through the House of Commons and House of Lords shortly before GDPR came into force.

Impact on businesses

Whether you’re an individual, organisation or company, you may be branded as a ‘controller’ or ‘processor’ of personal data. The Information Commissioners Officer (ICO) outlines exactly what the difference is between controllers and processors.

Businesses who monitor or obtain personal information on a large scale should employ a Data Protection Officer (DPO). The officer’s role should ensure that the company in question complies with GDPR. Any questions or queries regarding data protection should be directed to them.

GDPR applies to businesses that process personal data of EU citizens. This is the case even with businesses who employ less than 250 employees. As previously mentioned, any breach which could impact the rights of data subjects should be reported to the Information Commissioner’s Office (ICO).

If possible, a breach should be logged and reported within a 24 hour period, or 72 hours at the most. Details of the breach and how it is going to be contained and resolved must be outlined to the ICO.

GDPR will give individuals control on how businesses use their data. This also applies to businesses that already have your data. For example, individuals will have the ‘right to be forgotten’. So, if you’re a customer and no longer want a business to hold your personal data, you have a legal right to retract your data.

Helpful checklist for small businesses

GDPR is undoubtedly confusing, and understandably quite stressful! I thought it would be pertinent to put together a checklist for UK small businesses so you know what to expect, and what’s expected of you.

Your small business GDPR checklist should consider past and present employees, suppliers, and customers. It should also consider anyone’s data that you’re processing, collecting, storing, or recording, and using by any means.

1| Understand your data

You will need to understand and demonstrate your understanding of the types of personal data you and/or your business holds. For example, names, addresses, IP addresses, bank details, etc. This also includes sensitive data like religious views and health details. You’ll need to demonstrate that you understand where they come from and how you will be using such data.

2| Think about consent

Does your business require consent to process personal data? Some marketing techniques require consent which makes things much more difficult under GDPR. Consent must be extremely clear and specific, so unless you 100% know what you’re doing tt may be worth avoiding the need to rely on consent unless it’s crucial to your business model.

3| Consider security measures

Your security measures and policies that are in place must be updated to be GDPR compliant. What’s more, if you don’t have any in place already, you should get them pretty quickly! Although there are more specific demands regarding security, as a broad precaution, you could use encryption.

4| Subject access rights

Individuals have the right to access their personal data. You’ll need to ensure that your business is ready to provide this information within a short timeframe if necessary. Individuals may wish to obtain their personal data in order to rectify any issues, simply to have it, or they may wish to erase it altogether. All requests carry a timeframe of one month.

5| Train employees

Employees within your business should be trained in personal data. They will need to understand what constitutes personal data, as well as processes to identify any data breaches. Employees should be aware of who your Data Protection Officer (DPO) is, and any team or individuals related or responsive for data protection compliance.

6| Supply chain

All suppliers and contractors within your business need to be GDPR compliant. This is to ensure that they are not going to cause any breaches and pass any penalties or fines onto you. You will need to make sure that your contracts with your suppliers are updated too, so make sure you obtain a copy of this.

7| Fair processing

As part of GDPR, you must now be able to explain to individuals what you’re using their personal data for. This shouldn’t be a difficult task or one to worry about if you’re using their data fairly and correctly.

8| Data Protection Officer

It’s time to decide whether you need to employ a DPO or not. Small businesses are likely to be exempt, but larger businesses may not. It’s worth checking out to make sure you’re not in breach of any GDPR rules.

Defining consent

As an individual, you may be familiar with pre-ticked boxes when signing up for online accounts, purchasing products, registering for newsletters etc. These boxes were often pre-ticked and somewhat hidden, giving companies access to your personal data. Now, gone are the days of being bombarded by unwanted marketing emails and random phone calls.

Consent has been redefined under the new GDPR rules. Gone are the days of small print and hidden messages where individuals ‘accidentally’ or involuntarily sign up to marketing emails, texts, etc. Policies must be made abundantly clear now and be presented in such a manner.

Rules around pre-existing personal data are a little different. You may not require consent for this, but there must be a legal basis that’s compliant with the Data Protection Act (DPA). The main thing here is to remember that these legislations apply to businesses and consumers!

GDPR statistics 2018

  • Around 59% of UK businesses know the implications that GDPR will have on them.
  • On average, 73% felt that they were prepared when it came to documents and print management.
  • Only 6% of UK businesses made GDPR a priority. This is compared to 30% in France.
  • CNIL (French data protection regulator) reported a 50% increase in the number of complaints since GDPR came into force on 25th May.

Right of Access

Right of access (or subject access) allows an individual the right to obtain their own personal data. Right of access gives individuals the ability to understand how their data is being used and why their data is being used in such a way. This ensures that their data is being used in a lawful manner.

Individuals have the right to obtain certain information from companies, which includes:

  • a copy of an individual’s personal data
  • confirmation that an individual’s personal data is being processed
  • supplementary information (mainly corresponds to information provided in a privacy notice)

An individual, as we know, is entitled to their own personal data. However, they are not entitled to information about other people. On the other hand, if the information they are trying to obtain is about them as well as someone else, this is acceptable.

As an individual, it’s recommended that you ascertain whether the information you’re requesting is defined as personal data or not. You can check to see what’s classed as personal data (to be sure) here.

Am I a Data Controller or Data Processor?

GDPR applies to data controllers and data processors, but what does this actually mean? Data processors refer to operations performed on data, so when data is stored, collected, recorded, shared, etc. Data controllers are also data processors, the difference being is that they decide what the purpose or reason for processing data activities actually is.

Data Processors

As a data processor, there are legal obligations that GDPR require you to do:

  • Keep and maintain up-to-date personal data records. This includes outlining the details of processing activities and data subject categories. Categories refer to customers, employees, suppliers, and the types of processing – transferring, receiving, disclosing etc.
  • Keep and maintain details of transfer to countries that are outside of the European Economic Area (EEA)
  • Implement and maintain security measures that are appropriate, e.g. encryption

If a data processor is responsible for a data breach, they will have a lot more legal liability compared to the DPA. Individuals can make a direct claim against the data processor, so it’s imperative that you understand your responsibilities as one.

Data Controllers

As a data controller, you are by nature a data processor too. The same GDPR requirements therefore apply. However, the GDPR obligations are placed on you and your business to ensure that contracts with processors are compliant and standards are met.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Security

Nokia Reveals Plans to Ensure 5G Security

Published

on

By

Nokia has announced plans to address the critical security needs of 5G networks, unveiling an enhanced security programme and advanced security testing and verification laboratory.

The new initiatives, which will extend the network provider’s commitment to ensuring the highest standards of security, are set to focus on end-to-end (E2E), mission critical networks that “will define the 5G era”.

Building on the success of its “industry-leading” Design for Security (DFSEC) process, Nokia has launched the upgraded DFSEC 2.0 to carry out additional verification work in areas such as E2E identity management and network slicing.

According to a statement, another key advance which is expected to drive this movement is Software Defined Networking (SDN) – with distributed cloud infrastructure and augmented intelligent control systems – as it will allow networks to scale in the 5G era.

In order to support the collaborative research taking place as part of DFSEC 2.0, Nokia will also open the “Future X Security” (FXSec) Lab.

The facility, to be established as an extension of Nokia’s Future X network lab, will facilitate the joint testing and verification of industrial automation solutions in private local area networks (LANs), as well as trials across public wide area networks (WANs).

Marcus Weldon, Corporate Chief Technology Officer and President of Nokia Bell Labs, said: “End-to-end 5G networks will fundamentally transform societies by providing ultra-high-speed wireless connectivity allowing massive, low latency ultra-reliable streaming data that will drive intelligent automation for a wide array of infrastructure, industries and enterprises.

“But with great opportunity comes significant security risk that must be addressed end-to-end, using an array of novel techniques and technologies.

“As the most trusted end-to-end solution provider in the 5G era, Nokia is taking a leadership position in defining and building advanced security solutions that will meet mission-critical needs, leveraging the deep and extensive security research and disruptive innovations from Nokia Bell Labs.”

Source: https://www.porttechnology.org/news/nokia_reveals_plans_to_ensure_5g_security

Continue Reading

Security

Peak gamer bling achieved with Swarovski-encrusted WASD keys

Published

on

By

I’ve seen a whole bunch of keyboards this week at Computex Taipei, but none quite so opulent as this exclusive offering from HyperX. As part of a collaboration with Swarovski, which it should be noted is far from a newcomer to the whole stickingcrystalsonrandomgadgets thing, the gaming accessory maker has designed a keyboard with bedazzled WASD and number keycaps.

I used the keyboard briefly and I don’t know if I’d say that the crystal glass felt particularly premium, but the jewel-encrusted keycaps did have a nice grip to them, if that’s what you’re into. If you wanted to experience an even greater rush of superiority after headshotting an opponent in Overwatch, I suppose this might do the job.

HyperX also made a matching headset, as well as one for the PS4:

And there’s also a mouse to go with the keyboard, though I’m not convinced the crystals are located in the most comfortable spot.

HyperX told me they made this gear for this year’s Taipei Game Show and don’t currently have plans to put it on regular sale, but they’d consider it if there turns out to be a lot of interest. I’m not sure there will be, but with the money pouring into esports these days, who knows? Maybe this could be someone’s aesthetic.

Source: https://www.theverge.com/2019/5/29/18642129/hyperx-swarovski-crystal-mouse-keyboard-headphones

Continue Reading

Security

Firefox Quantum Offers Anti-Cryptojacking Feature

Published

on

By

Firefox Quantum, the latest version of open-source internet browser Firefox, has a new privacytoggle that protects against cryptojacking, according to a blog post by Mozilla on May 21.

Mozilla previously warned official blog post that websites can deploy scripts that launch a crypto miner on a user’s machine without them being aware — a practice known as cryptojacking.

To combat these exploitative practices, Mozilla partnered with online privacy company Disconnect to create a crypto mining blocker for their browser. Users can now toggle an opt-in feature, that purportedly blocks would-be cryptojackers from taking advantage of spare computing power to mine cryptocurrencies.

Mozilla initially announced that it would block cryptojacking in new browser releases in August 2018. As per a report by Cointelegraph, Firefox featured cryptojacking protection in its Firefox Nightly 68 and Beta 67 versions this April, just prior to the launch of Quantum.

Firefox Quantum also aims to mitigate the practice of so-called “fingerprinting,” which makes a sort of digital fingerprint of a user that is employed to monitor their activities on the internet.

Cryptojacking at the consumer level was called “essentially extinct” by cybersecurity company MalwareBytes on April 23. According to the report:

“Marked by the popular drive-by mining company CoinHive shutting down operations in early March, consumer cryptomining seems to have gone the way of the dodo. Detections of consumer-focused bitcoin miners have dropped significantly over the last year and even from last quarter, while business-focused miners have increased from the previous quarter, especially in the APAC region.”

According to the report, consumer malware detections have gone down by approximately 40%. Businesses, however, are being targeted more heavily by cryptojacking attempts, with

Business detections increasing by about 7% during the first quarter of 2019.

Source: https://cointelegraph.com/news/firefox-quantum-offers-anti-cryptojacking-feature

Continue Reading
Advertisement

Trending

%d bloggers like this: