Implementering af EU Persondataforordningen

Transkript

1 Implementering af EU Persondataforordningen Procesforandringer og Privacy-by-design Frederik Helweg-Larsen, Principal, Devoteam 31. oktober 2016

2 2

3 Principper for behandling af personoplysninger 1.Lovlighed, rimelighed og gennemsigtighed 2.Formålsbegrænsning 3.Dataminimering 4.Rigtighed 5.Opbevaringsbegrænsning 6.Integritet og fortrolighed 7.Ansvarlighed Hvis I gør dette, så er compliance ikke noget problem. 3

4 Vigtige pointer fra EU Persondataforordningen En ny tilgang til datahåndtering Det er en ny kvalitativ tilgang til data - fremfor en kvantitativ. Sikkerhed er ikke en tilstrækkelig foranstaltning længere. Information Lifecycle Management er en meget central proces. Virksomhedens data er også dem der ikke ligger på egne systemer. Processer og systemer skal hænge sammen for at lykkes med dette. Det er ikke muligt at implementere uden teknologiunderstøttelse. Forordningen handler om at følge principperne og gøre det rigtige - ikke om at skrive en masse dokumenter... 4

5 I teorien er der ingen forskel mellem teori og praksis. I praksis er der. 5

6 Legal Compliance EU GDPR Technical Capabilities Governance & Processes Contract management 5, 1a) Lawfulness, Fairness and Transparency 5, 1b) Purpose Limitation Data Protection policies and procedures 5, 1c) Data Minimisation 5, 1d) Accuracy Data Discovery & Shadow IT 5, 1e) Storage Limitation 5, 1f) Integrity and Confidentiality 5, 2) Accountability Review of legal basis and consent 6 Lawfulness of processing 7 Conditions for consent 8 Conditions applicable to child's consent in relation to information society services 12 Transparent information, communication and modalities for the exercise of the rights of the data subject 13 Information to be provided where personal data are collected from the data subject 14 Information to be provided where personal data have not been obtained from the data subject Compliance review of internal processes 28 Processor Legal review of agreements 29 Processing under the authority of the controller or processor Chapter V Transfer of personal data to third countries or international organisations 16 Right to rectification 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing 17 Right to erasure ('right to be forgotten') Information Lifecycle Management 18 Right to restriction of processing 25 Data protection by design and by default 32 Security of processing Identity and Access Governance Data Security Architecture 24 Responsibility of the controller 26 Joint controllers 30 Records of processing activities Organization and design of the DPMS 31 Cooperation with the supervisory authority 33 Notification of a personal data breach to the supervisory authority Business Process & Dataflow Analysis 37 Designation of the data protection officer 38 Position of the data protection officer 9 Processing of special categories of personal data 15 Right of access by the data subject 27 Representatives of controllers or processors not established in the Union 34 Communication of a personal data breach to the data subject 39 Tasks of the data protection officer 10 Processing of personal data relating to criminal convictions and offences 20 Right to data portability 35 Data protection impact assessment Risk & Privacy Impact Assessment 11 Processing which does not require identification 21 Right to object 36 Prior consultation 22 Automated individual decisionmaking, including profiling 23 Restrictions

7 Business Process & Dataflow Analysis Business Processes, systems & data Governance & Processes Technical Capabilities Legal Compliance Organization and design of the DPMS Risk & Data Privacy Impact Assessment Data Protection policies and procedures Information Lifecycle Management Data Discovery & Shadow IT Data Security Architecture Identity and Access Governance Contract management Legal review of agreements Review of legal basis and consent Long Term Compliance Assurance Data types & Risk Assessment Information Lifecycle, Rights Mngt, Security, Compliance, Communication Retention, portability and deletion (right to be forgotten) Sensitive data in unauthorized systems Data storage, it-security, vendor assessments, privacy by design Verify access to sensitive data Aggregation of all contracts and agreements Legal entities, suppliers and contractors Lawfulness of processing 7 Compliance review of internal processes Coverage of data subject rights in policies and procedures

8 Principper for dataflow analyse Overblik over processer, systemer og juridiske enheder Corporate HQ Corporate Company Customer Customer Datacenter Office Local CRM 1 Hosted CRM Legal agreement Local CRM 2 8

9 Centrale processer der skal fungere Data Protection Management System 9

10

11 11

12 De 8 trin mod forandringen Hvordan du forbereder dig 12

13 Business Process & Dataflow Analysis Business Processes, systems & data Governance & Processes Technical Capabilities Legal Compliance Organization and design of the DPMS Risk & Data Privacy Impact Assessment Data Protection policies and procedures Information Lifecycle Management Data Discovery & Shadow IT Data Security Architecture Identity and Access Governance Contract management Legal review of agreements Review of legal basis and consent Long Term Compliance Assurance Data types & Risk Assessment Information Lifecycle, Rights Mngt, Security, Compliance, Communication Retention, portability and deletion (right to be forgotten) Sensitive data in unauthorized systems Data storage, it-security, vendor assessments, privacy by design Verify access to sensitive data Aggregation of all contracts and agreements Legal entities, suppliers and contractors Lawfulness of processing 13 Compliance review of internal processes Coverage of data subject rights in policies and procedures

14 Problemet med den uopfordrede ansøgning - og hvorfor processer ikke gør det alene 14

15 Persondata skal have et livsforløb Der er aldrig nogen der rydder op Data skal have de rette parametre når de modtages eller skabes. Det er typisk for sent efter dette punkt. Automate Anvendelsen og tilgangen til data skal hænge sammen med formålet. Det skal være muligt at ændre dette. Deling af data med tredjepart skal hænge sammen med de aftaler der er indgået. Data lækage skal kunne opdages. 15

16 Fem niveauer af Information Governance Maturity Tag udgangspunkt i det nuværende niveau 16

17 Få vished for hvor data er opbevaret Stol ikke på processer og interviews alene En scanning giver ofte et helt andet billede af processerne. Software, MSP eller konsulentydelse? Det er ikke trivielt at finde følsomme persondata. Scanninger er eksplorative og baseret på viden og erfaringer. Stiller krav til sikkerheden. Et relevant værktøj for revisorer - og datatilsynet. 17

18 Data der er udenfor virksomhedens kontrol er ikke fritaget Hvor mange af medarbejdernes IT services er leveret af virksomheden? Store virksomheder har i gennemsnit over (forskellige) aktive cloud services. Små virksomheder ligger på gennemsnitligt 500 cloud services. I gennemsnit findes der 47 højrisiko tjenester i undersøgte virksomheder. I gennemsnit findes 100 filer der indeholder ordet password. Cloud service discovery kan anvendes til Sanktionering af it-tjenester Licensmæssig compliance Data leakage Efterlevelse af EU Persondataforordningen 18 Kilde:

19 Indretning af it-systemer og arkitektur Det muliges kunst Hvordan håndteres decentrale systemer og distribuerede data? Hvilke egenskaber har de enkelte systemer? Er det relevant at undersøge en mulig konsolidering af arkitekturen? Hvordan påvirker dette it-afdelingen? Hvad med vores leverandører? 19

20 Overblik over brugeradgange (IAG) Det er ikke det samme som provisionering (IAM) Logisk gennemgang af brugerrettigheder viser ofte Brugerkonti med for mange nedarvede rettigheder Brugerkonti der burde være slettet Brugerkonti der ikke overholder politikkerne Systemkonti der ikke anvendes Et mønster i systemanvendelsen Kan anvendes som analyseværktøj. Kan implementeres som workflow og selvbetjeningsportal uafhængigt af provisionering. Til styring af vidtgående rettigheder kan anvendes Priviledged Account Management (PAM). 20

21 Business Process & Dataflow Analysis Business Processes, systems & data Governance & Processes Technical Capabilities Legal Compliance Organization and design of the DPMS Risk & Data Privacy Impact Assessment Data Protection policies and procedures Information Lifecycle Management Data Discovery & Shadow IT Data Security Architecture Identity and Access Governance Contract management Legal review of agreements Review of legal basis and consent Long Term Compliance Assurance Data types & Risk Assessment Information Lifecycle, Rights Mngt, Security, Compliance, Communication Retention, portability and deletion (right to be forgotten) Sensitive data in unauthorized systems Data storage, it-security, vendor assessments, privacy by design Verify access to sensitive data Aggregation of all contracts and agreements Legal entities, suppliers and contractors Lawfulness of processing 21 Compliance review of internal processes Coverage of data subject rights in policies and procedures

22 Legal Compliance EU GDPR Technical Capabilities Governance & Processes Contract management 5, 1a) Lawfulness, Fairness and Transparency 5, 1b) Purpose Limitation Data Protection policies and procedures 5, 1c) Data Minimisation 5, 1d) Accuracy Data Discovery & Shadow IT 5, 1e) Storage Limitation 5, 1f) Integrity and Confidentiality 5, 2) Accountability Review of legal basis and consent 6 Lawfulness of processing 7 Conditions for consent 8 Conditions applicable to child's consent in relation to information society services 12 Transparent information, communication and modalities for the exercise of the rights of the data subject 13 Information to be provided where personal data are collected from the data subject 14 Information to be provided where personal data have not been obtained from the data subject Compliance review of internal processes 28 Processor Legal review of agreements 29 Processing under the authority of the controller or processor Chapter V Transfer of personal data to third countries or international organisations 16 Right to rectification 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing 17 Right to erasure ('right to be forgotten') Information Lifecycle Management 18 Right to restriction of processing 25 Data protection by design and by default 32 Security of processing Identity and Access Governance Data Security Architecture 24 Responsibility of the controller 26 Joint controllers 30 Records of processing activities Organization and design of the DPMS 31 Cooperation with the supervisory authority 33 Notification of a personal data breach to the supervisory authority Business Process & Dataflow Analysis 37 Designation of the data protection officer 38 Position of the data protection officer 9 Processing of special categories of personal data 15 Right of access by the data subject 27 Representatives of controllers or processors not established in the Union 34 Communication of a personal data breach to the data subject 39 Tasks of the data protection officer 10 Processing of personal data relating to criminal convictions and offences 20 Right to data portability 35 Data protection impact assessment Risk & Privacy Impact Assessment 11 Processing which does not require identification 21 Right to object 36 Prior consultation 22 Automated individual decisionmaking, including profiling 23 Restrictions

23 The GDPR program (high level) Business Process & Dataflow Analysis Organization and design of the DPMS Risk & Data Privacy Impact Assessment Data Protection policies and procedures Establish The EU GDPR Program Gapanalysis of of data protection maturity Risk Assessment Information Lifecycle Management Data Discovery & Shadow IT Data Security Architecture Identity and Access Governance Review & Audit Correct & Improve Contract management Legal review of agreements Review of legal basis and consent Compliance review of internal processes PLAN DO CHECK ACT

24 Technical Governance Roadmap for implementering af EU Persondataforordningen Eksempel på etablering af et program 2H H H H Review & Audit 1. Business Process & Dataflow Analysis 2. Organization and design of the DPMS 3. Risk & Privacy Impact Assessment 4. Data Protection policies and procedures 1. Information Lifecycle Management 2. Data Discovery & Shadow IT 3. Data Security Architecture 4. Identity and Access Governance 2 1. Contract management 2. Legal review of agreements 3. Review of legal basis and consent 4. Compliance review of internal processes Legal 24

25 Tre gode råd Få overblik over helheden og tag ét trin af gangen. Erkend forandringen i databehandlingen. Skab et levedygtigt program med fungerende processer. Det er en fejl at begynde med slutningen. Compliance kommer når man gør det rigtige. Det er ikke et compliance projekt - men en langsigtet tilpasning af databehandling. 25

26 Copyright Devoteams signatur Enkelhed Anvendelighed Vi efterlader aldrig vores kunder med en leverance uden at sikre os at effekten er langvarig. 26 Helhed Vi tilstræber altid at forenkle det komplekse og kommunikere på modtagerens præmisser. Vi træder altid et skridt tilbage fra den konkrete opgave og ser på den større sammenhæng. Kobling Balance Vi sørger for at enhver leverance hænger sammen med eksisterende processer og værktøjer. Ingen parallelle eller isolerede løsninger. Forandring Puls Vi hjælper vores kunder med at finde et passende og afbalanceret sikkerhedsniveau. Vi måler vores resultater ud fra den forandring vi skaber. Vi vurderer altid om vores løsninger er levedygtige på længere sigt.

27 27 Spørgsmål

28 Hvis du vil vide mere Frederik Helweg-Larsen Principal Consultant, Risk & Security T :

29 Devoteam Group - Entrepreneurs in disruptive technology 3600 Professionals 20 Countries 443M Turnover in 2014 At Devoteam we deliver innovative technology consulting for business, to make our clients win their digital battle 20 years of transformation experience Digital Business Models Digital Efficiency Digital Business Transformation IT Service Management Operating Model Agile IT Management Transformation Networks Data Centres Security Sourcing & Cloud Data IT Infrastructure Transformation 1995 Listed on 2005 Euronext

30 Devoteam i Danmark Etableret i Danmark i 1978 Devoteam bruger indsigt i og erfaring med digital teknologi til at skabe nye muligheder og fremgang til det danske samfund og dets virksomheder fra rådgivning til anvendelse. Devoteam Gruppen siden konsulenter i Danmark +10 års konsulenterfaring kunder Kontorer i København og Skanderborg 30

31 Aktuelle Risk & Security projekter Bredt erfaringsgrundlag