RiskXtraSeptember2018

x
RISKXtra
Smart GDPR Assurance for a Smarter World
Something needs to
change when you’re
confronted by the
present situation
whereby devices
professing to be
‘Smart’ or part of a
‘Smarter System’ ask
for personal data, but
are then easily hacked
into by criminals such
that valuable personal
information can be
stolen. In an exclusive
article for Risk Xtra,
James Willison and
Sarb Sembhi examine
stakeholder roles in
achieving data
protection (and
security) by design
and default in ‘Smart
Projects’ with Internet
of Things (IoT) devices
We’ve just published a new approach to
the European Union’s General Data
Protection Regulation (GDPR) for
security professionals and the stakeholders
whom they deal with on a daily basis. The 40-
page White Paper, which is sponsored by Axis
Communications, stands out because, until
now, many colleagues in the security world
have lived under the mistaken assumption that
GDPR compliance isn’t something that falls
within their remit, but is instead managed
either by legal, IT or compliance professionals.
At least in part, this is based on the belief
that their security teams are not data
controllers or processors. As far as they’re
concerned, the lengthy 200-plus pages of
legislation issued by the EU isn’t something
they need to worry about.
However, the in-house security manager can
often be described as a project manager in a
large-scale surveillance system
implementation, for example, and will therefore
need to ensure that the devices and systems
duly deployed are secure by both design and
default. He or she should also work closely
alongside others involved with the project to
guarantee that the systems and devices
employed harbour data protection (ie privacy)
by design and default.
In the first half of the White Paper, which is
entitled ‘Smart GDPR Assurance for a Smarter
World’, we cover in some detail the different
ways in which the Internet and the increasing
volume of data which connects to IoT systems
has meant that personally identifiable
information is now placed at a higher risk than
it was back in the 1990s.
As Professor Klaus Schwab, CEO of the World
Economic Forum, has stated on page 59 of his
book entitled ‘The Fourth Industrial Revolution’
(published in 2016): “The digital
transformations of industry mean that
businesses will need to invest heavily in cyber
and data security systems in order to avoid
direct disruption by criminals and activists or
unintentional failures in digital infrastructure.”
This has led to the GDPR being written for
the protection of the individual’s data privacy
and security. It also usually means that the
systems involved – and, indeed, those who
manage them – often need to demonstrate
compliance through the transaction of Data
Protection Impact Assessments (DPIA) because
of their large-scale nature and the use of
innovative technologies such as biometrics and
CCTV in ‘Smart Buildings’.
IoT ‘Smart’ environments
In our new White Paper, we’ve deliberately
dedicated a chapter to those technologies,
products and services related to large-scale IoT
‘Smart’ environments and briefly outline some
that have provided greater functionality, but
that have also created increasing concerns in
terms of the data collected (or around what
that data is used for).
This includes a consideration of key areas
such as Big Data analytics, cloud computing,
Artificial Intelligence, machine learning,
sensors, medical devices, physical security
systems, surveillance monitoring and Security
Information and Event Management services.
We then proceed to introduce scenarios such
as ‘Smart Vehicles’ and ‘Smart Buildings’
because these are prime examples of how
stakeholders are involved in the protection of
high volumes of data and, given the connection
here to the individual (whether that’s a
passenger or consumer), their privacy and
security is vulnerable to attack from those with
criminal intent on their minds.
For the various owners of large IoT
installations such as ‘Smart Buildings’ or
‘Smart Cities’, for instance, processing data in
compliance with the GDPR becomes something
of a complex procedure since there’s a vast
number of suppliers who contributed to the
final working solution and may not have known
20