up

2020-02-17 - GDPR

• snapshot of GDPR
• Preview of Lab due in 2 weeks ish

the fines for this are crazy, like billions scale.

Went into effect in 2016

EU has different laws:

• Regulation
  • binding law for all of EU
• Directive
  • Requires a result, without specifying how, binding only to addressed states

“GDPR applies to companies based in the EU and companies who have EU citizens as customers”

So, even though the UK is leaving the EU, UK companies may still be bound by GDPR.

If you get arrested, your mugshot will be scraped by websites that demand payment to take them down. This is bad.

GDPR says people should have the ‘right to be forgotten’. This used to exist, but no longer.

GDPR addresses ‘processing personal data’ of subjects who live within the European economic area.

processing includes storage.

GDPR also regulates the export of data out of the EU.

Compliance

Controllers and processors of personal data must “put into place appropriate technical and organizational measures” to implement data protection principles.

Systems must be designed with privacy in mind

• Using highest privacy settings my default
• datasets cannot be public by default
• datasets cannot be used to identify a subject

No personal data may be processed unless under one of these things:

• Consent
  • customer consents
  • consent can be revoked at any time
• Contract
  • if you sign a contract saying so
• Public Task
• Vital Interest
• Legitimate interest
  • what do these mean?
• legal requirement
  • government requires it

other reqs

• all collected data must be disclosed
• purpose must be declared
• data retention and sharing disclosed
• subjects may request a portable copy of data in a common format
• subjects have the right to have their data erased under certain circumstances

There must be a Data Protection Officer responsible for GDPR compliance

Data breaches must be disclosed within 72 hours if they have an adverse effect on user privacy.

Time of breach to time of notification averages 6 to 7 months in the US.

lab preview

• part 1 - determine how MT can best position themselves to pass a PCI audit
• part 2 - recommendations for other audits