Unless you have been living in a darkened room for a long time, you will know the countdown for the EU’s General Data Protection Regulation is dramatically coming to a head. May 2018 is when the regulation really takes hold, and organisations are fast in the act on putting plans, processes and personnel in place, in order to comply.
Whilst many organisations are looking at employing a Data Privacy Officer (DPO), reading through all the legalese and developing data analytics and tagging processes, many need to embrace and understand the requirements with how their consumer identity and access management platform can and should be used in this new regulatory setting.
My intention in this blog, isn’t to list every single article and what they mean – there are plenty of other sites that can help with that. I want to really highlight, some of the more identity related components of the GDPR and what needs to be done.
Personal Data
On the the personal data front, more and more organisations are collecting more data, more frequently than ever before. Some data is explicit, like when you enter your first name, last name and date of birth when you register for a service for example, through to the more subtle – location, history and preference details amongst others. The GDPR focuses on making sure personal data is processed legally and data is only kept for as long as necessary – with a full end user interface that has the ability to make sure their data is up to date and accurate.
It goes with out saying, that this personal data needs to have the necessary security, confidentiality, integrity and availability constraints applied to it. This will require the necessary least privileged administrative controls and data persistence security, such as the necessary hashing or encryption.
Lawful Processing
Ah the word law! That must be the legal team. Or the newly appointed DPO. That can’t be a security, identity or technology issue. Partially correct. But the lawful processing, also has a significant requirement surrounding the capture and management of consent. So what is this explicit consent? The data owner – that’s Joe Blogs whose data has been snaffled – needs to be fully aware of the data that has been captured, why it is captured and who has access.
The service provider, also needs to explicitly capture consent – not an implicit “the end user needs to opt out”, but more the end user needs to “opt-in” for their data to be used and processed. This will require a transparent user driven consent system, with sharing and more importantly, timely revocation of access. Protocols such as User Managed Access may come in useful here.
Individuals Right to be Informed
The lawful processing aspect, flows neatly into the entire area of the end user being informed. The end user needs to be in a position to make informed decisions, around data sharing, service registration, data revocation and more. The use of 10 page terms and conditions thrust down the end user’s screen at service startup, are over.
Non-tech language is now a must, with clear explanations of why data has been captured and which 3rd parties – if any – have access to the data. This again flows into the consent model – with the data owner being able to make consent decisions, they need simple to understand information. So registration flows will now need to be much more progressive – only collecting data when it is needed, with a clear explanation of why the data is needed and what processing will be done with it. 20 attribute registration forms are dead.
Individuals Right to Rectification, Export and Erasure
Certainly some new requirements here – if you are a service provider, can you allow your end users to clearly see what data you have captured about them, and also provide that data in a simple to use end user dashboard where they can make changes and keep it up to date? What about the ability for the data owner to export that data in a machine readable and standard format such as CSV or JSON?
Right to erasure is also interesting – do you know where your end user data resides? Which systems, what attributes, what correlations or translations have taken place? Could you issue a de-provisioning request to either delete, clean or anonymize that data? If not you may need to investigate why and what can be done to remediate that.
Conclusion
The GDPR is big. It contains over 90 articles, containing lots of legalese and fine grained print. Don’t just assume the legal team or the newly appointed DPO will cover your company’s ass. Full platform data analytics tagging will be needed, along with a modern consumer identity and access management design pattern. End user dashboards, registration journeys and consent frameworks will need updating.
The interesting aspect, is that privacy is now becoming a competitive differentiator. The GDPR should not just be seen as an internal compliance exercise. It could actually be a launch pad for building closer more trusted relationships with your end user community.