Gregory Campbell from IBM walks us through the General Data Privacy Regulation.

2. gregory
campbell
IBM

3. © IBM Corporation 2016
October 2016
These presentations are intended to provide friendly and helpful advice only, not a definitive statement of law
General Data Protection Regulation
Findability Day
Maria Sunnefors – Findability Business Consultant, Findwise
Gregory Campbell – Governance, Regulatory and Legal Consultant, IBM Analytics

4. © IBM Corporation 2016
Gregory Campbell – Governance, Regulatory and Legal Consultant, IBM Analytics
gcampbell@uk.ibm.com
Maria Sunnefors – Findability Business Consultant, Findwise
maria.sunnefors@findwise.com
General Data Protection Regulation
Findability Day

5. © IBM Corporation 2016
General Data Protection Regulation
Background and Overview
These presentations are intended to provide friendly and helpful advice only, not a definitive statement of law
Gregory Campbell – Governance, Regulatory and Legal Consultant, IBM Analytics

6. © IBM Corporation 2016
 The General Data Protection Regulation
(GDPR) was published on 4 May 2016,
and will be immediately applicable after a
2 year transition period on 25 May 2018
to any organisation which operates in the
EU market
 Introduces cross-industry 72H breach
reporting to regulators and without undue
delay to individuals with associated risk
of severe reputational harm
 Non-compliance has the potential to lead
to huge fines of up to €20m or 4% of
total annual worldwide turnover, so now
is the time to build on the foundations
you already have to ensure you
Protect, Govern and Know Your Data
The General Data Protection Regulation (GDPR)
Applies from 25 May 2018

7. © IBM Corporation 2016
General Data Protection Regulation
Technical Preparedness
These presentations are intended to provide friendly and helpful advice only, not a definitive statement of law
Gregory Campbell – Governance, Regulatory and Legal Consultant, IBM Analytics

8. © IBM Corporation 2016
GDPR Technical Preparedness
Key Duties, Obligations & Sanctions
Archiving
Legal
Curation
Records &
Retention
Administrative Fines
for Non
Compliance
Rights of EU
Data Subjects
Security of
Personal Data
Lawfulness
and Consent
Accountability
of Compliance
Design
and Default

9. © IBM Corporation 2016
GDPR Technical Preparedness
Key Duties, Obligations & Sanctions
Archiving
Legal
Curation
Records &
Retention
Administrative Fines
for Non
Compliance
Rights of EU
Data Subjects
Security of
Personal Data
Lawfulness
and Consent
Accountability
of Compliance
Design
and Default
Rights of EU Data Subjects
• Enhanced rights for data subjects in the EU
including erasure, access and portability
 Maintain data quality, amending, manipulating,
erasing and exporting it into usable formats in
both structured and unstructured environments
Security of Personal Data
 Need to ensure a level of security appropriate to
the risk including 72H breach reporting
 Implement pervasive and intelligent internal and
external network defences and restrictions to
reduce data risks, including data minimisation,
pseudonymisation and encryption techniques
Lawfulness and Consent
• Processing is only lawful if there is one of consent, necessity, legal obligation, protection, public interest, official authority or legitimate interest
 Keep data subjects informed and manage requests in a transparent, efficient and effective manner, and consider appointing a DPO
Accountability of Compliance
• Need to demonstrate compliance with the
principles relating to personal data processing
pervades throughout the GDPR
 Consider how compliance can be proven,
including data protection impact assessments,
codes of conduct and proactive certification
By Design and By Default
• Data controllers must implement technical and
organisational measures which demonstrate
compliance with GDPR core principles
 Plan for this in the long term e.g. instrument and
manage data syndication and data lineage
Administrative Fines for Non-Compliance
 Regulators can impose Administrative Fines of up to €20m or 4% of total annual worldwide turnover, whichever is higher
 Additional powers also/ alternatively available to regulators, including gaining access to data and premises, and to auditing

10. © IBM Corporation 2016
General Data Protection Regulation
Architectural Preparedness
These presentations are intended to provide friendly and helpful advice only, not a definitive statement of law
Gregory Campbell – Governance, Regulatory and Legal Consultant, IBM Analytics

11. © IBM Corporation 2016
GDPR Architectural Preparedness
Broad Requirements & Broad Capabilities
Lawfulness
and Consent
Design
and Default
Rights of EU
Data Subjects
Lawfulness
and Consent
Accountability
of Compliance
Security of
Personal Data
Administrative Fines
for Non
Compliance
Rights of EU
Data Subjects
Security of
Personal Data
Lawfulness
and Consent
Accountability
of Compliance
Design
and Default

12. © IBM Corporation 2016
GDPR Architectural Preparedness
Solution Framework
Dynamic Policy
Management:
Define what, why,
how long
Data
Infrastructure:
Control use,
align cost to
value
Implementation
Services:
Distribute policies
to data sources
Data Management
Email
Servers
User
Devices
& File
SharesECM &
Collaboration
Archive
Platform
Master
Data
Cloud &
Social
Databases &
Data Warehouse
Hadoop
Platform
Lawfulness
and Consent
Design
and Default
Rights of EU
Data Subjects
Lawfulness
and Consent
Accountability
of Compliance
Security of
Personal Data
P o l i c i e s R u l e s A u d i t
P r o c e s s e s An a l y s e s
Security&ComplianceMonitoring

13. © IBM Corporation 2016
IBM Case Manager
GDPR Architectural Preparedness
Solution Framework – IBM Technology
Dynamic Policy
Management:
Define what, why,
how long
Data
Infrastructure:
Control use,
align cost to
value
Implementation
Services:
Distribute policies
to data sources
Data Management
Email
Servers
User
Devices
& File
SharesECM &
Collaboration
Archive
Platform
Master
Data
Cloud &
Social
Databases &
Data Warehouse
Hadoop
Platform
Lawfulness
and Consent
Design
and Default
Rights of EU
Data Subjects
Lawfulness
and Consent
Accountability
of Compliance
Security of
Personal Data
P o l i c i e s R u l e s A u d i t
P r o c e s s e s An a l y s e s
Security&ComplianceMonitoring
InfoSphereIBM Atlas
Optim

14. © IBM Corporation 2016
General Data Protection Regulation
First Steps
These presentations are intended to provide friendly and helpful advice only, not a definitive statement of law
Gregory Campbell – Governance, Regulatory and Legal Consultant, IBM Analytics

15. © IBM Corporation 2016
First Steps
Towards GDPR Preparedness
 Decide on your strategy and achieve board level endorsement
 Identify and assess key areas of risk by means of an appropriate assessment
 Data mapping
 Data and Data Source Discovery including:
Identification of sensitive data
Assessment of information handling procedures

16. © IBM Corporation 2016
General Data Protection Regulation
Content Inventory
These presentations are intended to provide friendly and helpful advice only, not a definitive statement of law
Maria Sunnefors – Findability Business Consultant, Findwise

17. Content Inventory
What is where?

19. Content Inventory
What is where?
Phase 1: Scoping
Phase 2: Discovery
Phase 3: Analysis
Patterns and sources.
Explore.
Compliance?

20. Phase 1: Scoping
Where to look and what to look for?
Identify source and
content owners.
Identify and
prioritize sources.
1 2 3
Identify patterns
to look for.

21. Phase 1: Scoping
Where to look and what to look for?
Social security number
aaa-gg-ssss
Name
Aaaaa Aaaaaaa
Phone numbers
0xx - xxxx xx xx, 0xxx xx xx xx
IP address
aaa-gg-ssss
Date of birth
YYMMDD
E-mail address
aaaaa@aaaaa.aaaaa

22. Phase 2: Discovery
What is where?
display
search
index

23. Phase 2: Discovery
What is where?

24. Phase 3: Analysis
o Source by source
o Explicit consent?
o Processes and routines
o Legal advice
Risk and compliance

25. We have to care and act!
Create awareness
Know your data
Data protection is a good thing!
Allocate resources
Findwise Content Inventory

26. © IBM Corporation 2016
October 2016
These presentations are intended to provide friendly and helpful advice only, not a definitive statement of law
General Data Protection Regulation
Findability Day – Thank You!
Maria Sunnefors – Findability Business Consultant, Findwise
Gregory Campbell – Governance, Regulatory and Legal Consultant, IBM Analytics