First of all some basic facts about the General Data Protection Regulation (GDPR). If you haven’t heard about it, you should now pay attention and get some further information by visiting https://www.eugdpr.org/ or https://dsgvo.tips (for german readers). The GDPR will affect everybody working with personal data and is one of the major aspects of Human Data Responsibility (HDR).
The Facts:
- The enforcement date of the GDPR is 25th May 2018. So you have little over one year of time to introduce the new rules to your company.
- There will be extremely heavy fines for organizations who don’t work within the law. This can be up to 4% of the global annual turnover or 20 Million € (whichever is greater).
- The rules affect every organization working with personal data of citizens of the European Union. So this is a worldwide topic.
I also want to point out, that IMHO the GDPR is a good thing. It is historically based on the CHARTER OF FUNDAMENTAL RIGHTS OF THE EUROPEAN UNION from the year 2000 (https://www.europarl.europa.eu/charter/pdf/text_en.pdf) where the protection of personal data (Article 8) is on the same level like Human Dignity (Aricle 1), the Right to life (Article 2) or Freedom of thought, conscience and religion (Article 10). People who work in data science know about the power and value of data. Think about how your IT-Administrator protects, encrypts and stores his passwords (or at least he should). He knows what can happen, if this precious goods gets lost. But now we need to tell everybody else.
Let’s look at some rights of the GDPR:
- Accuracy (Article 5, 1d)
Personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ( accuracy’);
Yes “ that is what HDR data quality means. Having up to date data, without errors. This also means typing errors of names, streets and so on, can be really expensive. Find solutions to check and validate data “ and get in dialogue with your customer to really have all the data in a correct way.
- Privacy by design (Article 23)
The controller shall..implement appropriate technical and organisational measures..in an effective way.. in order to meet the requirements of this Regulation and protect the rights of data subjects . That means the controllers has to hold and process only the data absolutely necessary for the completion of its duties (data minimisation), as well as limiting the access to personal data to those needing to act out the processing.This surely needs an upgrade to your organizational structure, like it is recommended in the HDR Manifest at Security / Operations. Don’t give everybody access to all of your data. Log access and ensure data is deleted (or pseudonymised) after the workflow.
- The right to be forgotten “ data erasure (Article 17) . The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay ¦
It gives people the possibility to have all their records in a company’s database cleaned. Now think about the workflow in your company. In how many systems, lists, tables, and documents the record of somebody is stored? And what about duplicates? Yep “ now you can panic!
These are just three examples why your company should take care about the GDPR and use HDR for your own advantage. Living HDR in your organization doesn’t only mean working within the laws of the GDPR “ it also means giving your client the good feeling that his precious data is stored and processed in a mindful way.
