New data protection rules that will take effect on May 25, 2018 will allow all of us to increase control over the processing of our data. The single set of rules will apply to all companies doing business in the European Union, regardless of their headquarters. What does this mean for small and medium-sized companies, which also make up the majority in Poland?
Definition of protected data
Since the regulation came into effect, sensitive data is considered to include your name, home address, public media profile, information in your medical records or company revenue. Whether you process data for third-party companies or use the data solely for your own use, you must follow appropriate security procedures.
Why is there a change?
The change is triggered by several key factors:
- Lack of confidence in current systems and outdated procedures, often different for each country,
- The inability of private institutions to control every piece of information they process,
- Need to unify the data protection code for easier oversight and control in each EU member country,
- Reducing management costs, excessive documentation and maintaining, often disjointed and unadapted, systems to meet new requirements,
- The new regulations are expected to increase public confidence in data protection, thereby stimulating business to invest in new technologies.
Financial penalties and company liability
In each country, overarching control over personal data protection is exercised by a dedicated public entity. In Poland, this will be the Regulator for Personal Data Protection (RODO), which will replace the currently functioning GIODO. This entity, in the event that violations are detected, can take action in the form of:
- Warnings,
- Official reminder,
- An order to suspend the company's data processing activities,
- Financial penalty - up to €20 million or 40% of the company's annual turnover.
ISCG advises: It is a good idea to get an idea of the RODO/GDPR requirements now and start preparing appropriate procedures supported by training and employee education. ISCG combines expertise in critical data protection with solution implementations to secure critical IT infrastructure.
I am a small company. What to do? How to live? - ISCG recommends:
- Protect the rights and data of those entrusted to you,
- Build a clear system of information about your data sources, how you process them, how long you store them, and who has access to them,
- Provide the ability to update, change and completely delete data upon request ("Robinson's right" - the right to be forgotten),
- If you process data from social networks, especially on children's data, make sure they are of age or have the appropriate consent from their legal guardians to process sensitive data,
- Inform in case of data leakage and serious threats
resulting from it, - If you use profiling algorithms that stem from the domain of your business (e.g., a financial institution), you must: inform your customers, check the data in the process of refusing to verify the data preferably with a second person, inform the party disclosing the data
About the possibility of objecting to their processing, - For marketing systems, make available the ability to unsubscribe from all communication channels at any time,
- Implement additional systems and safeguards to protect sensitive data, i.e.: medical information, nationality, sexual orientation, religion or political beliefs,
- Create documentation and apply relevant legislation
In case you send data to countries outside the European Union, - If you are processing data on behalf of a third-party company make sure you have a contract that clearly spells out the rights and obligations of each party in terms of data turnover.
Source:http://ec.europa.eu/justice/smedataprotect/index_en.htm
Do you need support? Get a free consultation with an ISCG expert and learn how to enhance your security experience.