Protecting Consumer & Employee Data In The Cloud

Cybersecurity has quickly emerged from a technical task to a problem that keeps executives up at night.

Why is that? Consumers expect to interact with businesses through a multitude of channels. Organizations do not only need to offer more and more online services, but also want to collect behavioral data about how users navigate, what are their shopping preferences etc. To do so comprehensively, organizations depend on vendors to provide the necessary technology.

Given the usual push for functionality while security is an afterthought, it is only a matter of time until vulnerabilities of such an ecosystem are exposed and exploited. May this be inadvertently caused by employees or vendors, may this be intentionally pursued by bad guys outside.

Remote working has only exacerbated the risk as employees now work in environments that – from a security perspective – are even less under control of the organization. Employees working from home may copy data about consumers or fellow employees to their computer or to their personal cloud (which may not be secured at all) or fall prey to a phishing email that they deem to be authentic and inadvertently disclose their credentials.

This been said, I want to emphasize that Cybersecurity is not a mere technical issue, but requires a culture where the organization, its employees as well as its suppliers collaborate in lock-step and follow the same charter of data protection.

Furthermore, I’d like to point out that whenever we talk security, we need to accept that higher security comes with a price, and perfect security is not possible. So it becomes critical for any organization to define its risk appetite and its level of risk tolerance. Therefore, data protection issues in general and cybersecurity issues in particular can only be tackled in a risk-based approach.

If you like to hear more about this approach, please join the upcoming non-technical webinar “Quantifying And Managing Cloud Risk For Consumer & Employee Data” on December 9, 2020 at 11 am EST. Being one of the panelists, I will take on a compliance perspective for protecting personal information in the Cloud. You are welcome to register here.

A Privacy Regulation Applying in the USA and Canada (and Everywhere)

Although the General Data Protection Regulation (GDPR)* was passed more than three years ago and entered force more than one year ago, there is still confusion and misconception about the regulation’s sphere of impact.

In a new series of posts, I will share some advice** drawn from experience in projects that I have conducted since the inception of the regulation, but also include updated guidelines that the European Data Protection Board (EDPB) recently published*** regarding the regulation’s territorial scope (Art.3 GDPR). To avoid amendments and editorial notes to my original post under this subject, I offer below a complete rewrite.

Although I encourage everyone to read the provisions of the GDPR as well as the above mentioned EDPB guidelines (which illustrate typical cases by example), here are the major takeaways regarding the GDPR's territorial scope:

• GDPR is a regulation to protect personal data of individuals ("data subjects") who are physically present – and may it only be temporarily - in the EEA (European Economic Area – which includes all EU member states plus Iceland, Liechtenstein and Norway). Data subjects’ protection rights are not dependent on their citizenship or residency.
• All organizations worldwide whose activities "intentionally, rather than inadvertently or incidentally, target" individuals being in the EEA are obligated to comply with the GDPR.
• Organizations established in the EEA have additional obligations: They must comply with GDPR regardless of where in the world data subjects are located.

The following matrix shows under which conditions GDPR applies:

However, in a world of international trade and high mobility of individuals, organizations can obviously not control the data subjects’ whereabouts while a business transaction takes place or thereafter. (Even data subjects’ IP addresses captured during electronic communications do not prove presence in or absence from a certain territory since individuals can legitimately – and will increasingly – hide their real geographical location by employing Virtual Private Networks.) Therefore, I recommend that organizations as of row B conduct all their activities related to processing personal data in a GDPR-compliant manner.

From a practical perspective, the above matrix can then be simplified as follows:

In conclusion, any organization offering products or services worldwide must presume, by default, that GDPR applies to them. On the complementary, non-EEA businesses whose commercial target area is outside of the EEA will be exempt from GDPR compliance.

 

* Published at https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1528874672298&uri=CELEX%3A32016R0679
** Legal disclaimer: This blog post is not intended to be legal advice, but to raise awareness that it is recommended to consult a lawyer.
*** Published at https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en.pdf

Personal Data - a Universal Definition Applying in the USA and Canada (and Everywhere)

In my previous post A Privacy Regulation Applying in the USA and Canada (and Elsewhere), I alluded to the worldwide impact of the General Data Protection Regulation (GDPR)*. In this post, I like to clarify** the GDPR’s definitional scope of personal data.

The GDPR considers data to be personal if they relate to an identified or identifiable natural person (“data subject”). Although the term “identifiable” tends to consume all the attention here, actually the term “relate” carries more weight as it widens the definition in a way that it resonates with common sense.

So while e.g. a Social Security Number, International Bank Account Number (IBAN) or passport number uniquely identify an individual and are therefore unquestionably personal data, the GDPR includes as well non-identifying attributes such as weight (at a given point in time), height or eye color to be personal data if they can be assigned to an identifiable individual.

But the term “relate” even pertains to more than a natural person’s attributes. A prominent example is a civic address register which certainly is public and does in no way constitute personal data in and by itself. However, if a register entry, e.g. “123 Main Street, Newcastle, Fantasyland”, relates to an individual “Jane Doe” whereas the relationship is “is residential address of”, that entry, by common sense and GDPR, becomes part of Jane Doe’s personal data.

You will find a more complete approach in my post GDPR & Personal Data - Context is Key and (Foreign) Key is Context underscoring that data modeling is a mandatory discipline in any medium or large organization being in need to get their head around personal data.

* Official publication of GDPR at https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1528874672298&uri=CELEX%3A32016R0679

** Legal disclaimer: This blog post is not intended to be legal advice, but to raise awareness that it is recommended to consult a lawyer.