Draft27-12

A section in the industry-leading magazine for installers, integrators, big or small - in short, everyone who provides a
commercial supply, installation or consultancy service.
Here you can read about new standards, equipment, ideas - whatever you want to know more about.
Editor - Mark Rowe
mark@professionalsecurity.co.uk
Data deadline is ticking
54
Paul Reeve
Steve Martin
More details: For more
on the GDPR, visit the
website of the Information
Commissioner’s Office
www.ico.org.uk.
Personal data protection will
become increasingly important
with the introduction of new
rules on May 25, 2018. Known as the
General Data Protection Regulation
(GDPR), the rules are set to have
a major impact on businesses in
our industry, in two differing ways,
writes Paul Reeve, the electrical
trade association ECA‘s Director of
Business; and Steve Martin, ECA
Director of Technical.
What to know
Firstly, almost all businesses need to
take note of the broader issue of
protecting the data of individuals
when developing their company
systems and managing customer
records. At present, the Data
Protection Act 1998 (DPA) places
certain requirements on businesses,
but the GDPR will go significantly
further than the DPA. The GDPR will
apply to the processing of any
personal data within a company, and
significantly, it will give individuals
more influence over the information
organisations hold on them, and how
it is used. Businesses will need to
ensure that individuals can withdraw
their data sharing consent easily, and
significantly, also have the right to
have their records deleted promptly.
Individuals will also be entitled to ask
for a copy of all data being held in
relation to them, and an explanation
of what it is used for.
IN BRIEF
Tracking software product company
Vismo, which offers a downloadable
app for smartphones, iPhone and
Android, and satellite phones, has
gained ISO 27001 certification, the
international standard for information
security management ... The Cass
Entrepreneurship venture capital fund
has made a growth equity investment
into lone worker safety app and
cloud-based monitoring service
StaySafe. p
DECEMBER 2017 PROFESSIONAL SECURITY
Accountable
Those businesses that hold the
original data will also be accountable
for how any third parties use personal
data, and could face penalties due to
non-compliance by these others.
Another key element for engineering
services businesses is how data
protection will interplay with the built
environment, such as integrated
technology and security systems
within buildings. Crucially, the ability
to identify an individual depends
partly on data held, and partly on
other data gathered by the building
infrastructure and sensors. This
information held could well qualify as
‘personal data’.
Example
To give an example, physical access
control if installed in a building will
transmit, receive, store, and even
remotely monitor data. The data
produced from this alone may not
identify the occupants. However, if
access fobs are assigned or tagged to
employees, or even if video,
biometrics or facial recognition is
used, then that stored information will
become personal data, as individuals
and their movements would be
identifiable. Ensuring that intelligent
installations can be protected against
hacking could be significant to
contractors and installers. If a system
becomes compromised, then IT
systems could be hacked and data
stolen, destroyed or manipulated,
thereby putting constructors and
contractors at risk of non-compliance.
Many engineering services businesses
are already well placed to help clients
with cyber issues from device
selection and maintenance, to systems
integration. However, taking full
advantage of this opportunity will
mean extending skillsets.
Non-compliance
If an organisation experiences a data
breach, the GDPR requires this to be
reported to stakeholders and the
regulatory authorities within 72 hours
of the breach being discovered. The
Information Commissioner’s Office
(ICO) can audit a business at any
time from May 25, regardless of
whether a breach has occurred. Noncompliance
with the regulations could
lead to significant fines of up to four
per cent of revenue. While there is
some commercially-driven hype
about what’s needed for even small
business to comply with GDPR, the
new regulation will apply to the bulk
of small and large businesses in our
sector, and there is no room for
complacency. The clock is ticking to
May 2018 and new, practically useful
personal data protection systems will
need to be identified and set up. With
this in mind, now is the time for
businesses to consider what GDPR
means for them, and to start creating
what they need for compliance. p
NSI GOLDS
At the Plymouth-based security
contractors Securi-Guard Fire
and Security, its tech systems
and guarding divisions have
attained the new BS EN ISO
9001:2015 International Quality
Standard, after NSI audit.
Pictured left to right are David
Campbell Operations Manager
– Security Guarding Serivces;
Scott Boyd, MD Securi-Guard Fire and Security; and Bob Truesdale, Fire and
Security Systems Manager. p
www.professionalsecurity.co.uk
p54 InstallA 27-12.indd 1 17/11/2017 19:11