CS1907

GDPR
Rob Allen, Kingston Technology Europe:
GDPR is rewarding organisations that
already had solid data management
measures in place.
Wim Nauwelaerts, Sidley Austin: even if
a company is not established in the EU,
the GDPR can still apply.
networks and technologies could bring data
processing under the scope of the GDPR, as
long as the monitored behaviour takes place
within EU territory. "The guidelines provide the
example of an Indian pharmaceutical
company without a business presence or
establishment in the EU, which sponsors
clinical trials carried out by sites in Belgium,
Luxembourg, and the Netherlands. Since trial
participants in these EU countries are being
'monitored', the sponsor in India is arguably
subject to the GDPR."
It's a highly complex issue, no better
demonstrated than by the fact that the
guidelines were open for public consultation
until January 18, 2019 and expected to be
finalised shortly afterwards. "However, during
the public consultation, many stakeholders
raised questions about the interaction
between the provisions in the GDPR around
territorial scope and Chapter V of the GDPR,
which deals with data transfers outside of the
EU," explains Nauwelaerts.
"For instance, whether data transfer
safeguards, such as model contracts that have
been pre-approved by the European
Commission, should be put in place vis-à-vis
controllers/processors outside the EU that are
subject to the GDPR, because the targeting or
monitoring criterion is met. The guidelines
currently fail to address these questions. At
this point, it is still unclear when the EDPB will
publish its finalised guidelines and to what
extent they will include guidance on the
GDPR's data transfer restrictions."
ABOVE AND BEYOND
GDPR alone will not keep personal data
secure, of course, as Richard Blanford, chief
executive, Fordway, emphasises. "GDPR
may be part of every organisation's business
practices, but has it really made personal data
more secure? In my view, the answer is no.
I believe GDPR is a business issue. It has
ensured organisations know where they hold
Personally Identifiable Information (PII), and
have controls in place for how they store, use
and delete that data through what should be
a clearly defined and well-understood policy,
with appropriate business processes to ensure
compliance.
"However, GDPR does not address the actual
security of an organisation's networks and the
devices on which they store and access PII. So,
if their perimeter is breached, GDPR is
meaningless. And with data increasingly going
outside an organisation as employees and
partners tunnel through or bypass network
perimeters, good cyber security discipline is
more vital than ever."
KEY DISCIPLINES
According to Blanford, data security really
requires four key disciplines: identity and
authentication management; information
lifecycle management; network security; and
business continuity planning. "To develop an
effective data security policy, organisations
need to take a holistic look at their entire
infrastructure, from how data is created or
acquired to how it is valued, stored, accessed
and disposed of," he advises.
"This includes data that comes in from
customers, partners and suppliers as well as
data created internally. They also need to
consider their users. No technology or
regulation will be effective, unless all
employees adhere to security procedures.
"This means educating users on why security
matters, the consequences of getting it wrong
and what to do, if the worst happens. They
are much more likely to comply, if they
understand the risks, rather than simply seeing
security as a set of annoying rules which
prevent them working as they wish. Achieving
recognised security standards such as Cyber
Essentials, ISO27001 and ISO20000, will help
an organisation improve its security and,
importantly, reassure its customers that it has
done so."
See page 20 for another expert take on GDPR
and its impact.
14
computing security July/August 2019 @CSMagAndAwards www.computingsecurity.co.uk