Category Archives: Market Intelligence

GDPR: STOP THE PRESSES! (PART XII)

Today’s guest post is from Tony Bridger, an experienced provider of Procurement Consulting and Spend Analysis services across the Commonwealth (as well as a Lean Six Sigma Black Belt) who has been delivering value across continents for two decades. He is currently President of UK-based TrainingWorx Ltd, a provider of a wide range of Procurement and Analytic business training programs (inc. GDPR, spend analysis, project management, process improvement, etc.) and focussed short-term consulting solutions. Tony can be contacted at tony.bridger@data-trainingworx.co.uk.

It had to happen. In fact, almost inevitable really.

Within a week of the GDPR being implemented, the news story broke.

‘Embarrassing’ leak shows EU falls short of own GDPR data law

Without access to the full article on the UK Daily Telegraph Premium, it is difficult to assess the details of the breaches.

However … the response from a Commission spokesperson suggested that:

The European Commission is not subject to the strict new data protection law that it has imposed across Europe”.

Well, no surprises there. Given no published EU Commission accounts and constantly changing legislation it does appear somewhat Orwellian.

Ironically, the approach that many EU member state governments have deployed specifically rules them out of breach fines. The Irish government being one. (Source)

There is some logic in this approach.

It makes little or no sense to fine public bodies –- after all, they will pay the fine, reach a point in the annual budgeting cycle where they have a significant deficit –- and be topped up by central government. Take funding from one hand, pass it back with the other.

The United Kingdom has chosen not to follow this option — yet. However, one could predict that it will not take long for prosecutions to occur given government departments track record of personal date and cyber security breaches (within the National Health Service for example).

Not much of a deterrent and a massive public cost to prosecute and collect a revolving door fine.

Like much legislation the EU creates, it is clumsy, lacks detail and confusing. But it’s the law.

Taking a far more cynical approach, the GDPR appears to be legislation that is a Tax Collectors dream ticket.

There is the pretence of “protecting the rights and freedoms of EU citizens” –- whereas the reality is that it is a foolproof way of collecting what is essentially a data-tax from businesses for breaches.

A classic case of a cast iron fist in a velvet glove.

Will post more if the story evolves.

Thanks, Tony!

GDPR: The “Contract” (Part XI)

Today’s guest post is from Tony Bridger, an experienced provider of Procurement Consulting and Spend Analysis services across the Commonwealth (as well as a Lean Six Sigma Black Belt) who has been delivering value across continents for two decades. He is currently President of UK-based TrainingWorx Ltd, a provider of a wide range of Procurement and Analytic business training programs (inc. GDPR, spend analysis, project management, process improvement, etc.) and focussed short-term consulting solutions. Tony can be contacted at tony.bridger@data-trainingworx.co.uk.

Marvin Ammori, the US innovation lawyer suggests that:

one goal of law — as we learn in Law School from the first day of Contracts, is to deter bad behaviour”.

There is some truth in this statement. The GDPR has largely been a response to the failure of legislation to control data privacy issues. The UK Data Protection Act (1998) was deemed, in many respects, to have a series of major shortcomings — as did other EU member state privacy legislation. There was also the issue of Commission wide inconsistency between member states. So, the GDPR was born and ratified quickly by all 27-member states – a miracle in its own right.

So how are contracts likely to be framed?

There has been much dialogue on supervisory body sites around the notion of model clauses. The UK ICO website contains a range of links that have been carefully and studiously followed. The site makes very clear that any model clauses cannot be altered if they are used by organisations.

Eventually, despite searching, it is clear that there are still no model clauses that have been agreed and issued by the EU. The ICO website clearly states:

The GDPR allows for standard contractual clauses from the EU Commission or a supervisory authority (such as the ICO) to be used in contracts between controllers and processors – though none have been drafted so far.Source

Implementation of the regulation is history — and yet there is still little guidance for companies on these contracts.

However, the site does provide a broad and wide-ranging series of guidance states for processors (we covered these in the last posting).

The guidance is confusing. However, over the next few posts we will attempt to try and provide some of the core elements that processors, both within and outside of the EU should provision for contractually during this transition period.

Given the impact and wide-ranging nature of the regulations it does tend to communicate that the implementation of the detail of the EU legislation is still underway — but is still literally an unfinished symphony (or cacophony).

However, over we will try and rationalise some next steps while the clauses are drafted. In many respects, most companies can take the available guidance – and create compliant contracts. Like most of the posts — we suggest you take legal advice if you are in doubt.

We did say it wasn’t easy.

Thanks, Tony!

GDPR: Processor obligations (Part X)

Today’s guest post is from Tony Bridger, an experienced provider of Procurement Consulting and Spend Analysis services across the Commonwealth (as well as a Lean Six Sigma Black Belt) who has been delivering value across continents for two decades. He is currently President of UK-based TrainingWorx Ltd, a provider of a wide range of Procurement and Analytic business training programs (inc. GDPR, spend analysis, project management, process improvement, etc.) and focussed short-term consulting solutions. Tony can be contacted at tony.bridger@data-trainingworx.co.uk.

In the last post, we looked at some of the conditions and responsibilities that processors have regarding personal data that is exported outside of the European Union – we will continue with that theme and then move on to start examining the contractual elements. There’s a lot to digest, even if we are breaking this series into digestible chunks — so grab some coffee first if you must.

The GDPR is quite clear on the responsibilities of processors – in addition to the responsibilities itemised in my last post, they must:

  • assist the data controller in providing subject access and allowing data subjects to exercise their rights under the GDPR – this means that a processor may have to help identify and report any data that is part of a data subject access request (DSAR);
  • Data Subject Access Requests will be the focus of a separate post – DSARs are likely to create a lot of overhead for some types of company;
  • assist the data controller in meeting its GDPR obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments;
  • delete or return all personal data to the controller as requested at the end of the contract;
  • submit to audits and inspections, provide the controller with whatever information it needs to ensure that they are both meeting their Article 28 obligations, and tell the controller immediately if it is asked to do something infringing the GDPR – or another data protection law of the EU or a member state.

Be aware that each member state within the EU may have local country specific conditions. You would be well advised to check especially if you operate across multiple EU member states.

For example, the UK ICO (Information Commissioners Office) warns that processors should be aware that:

  • they may be subject to investigative and corrective powers of supervisory authorities (such as the ICO) under Article 58 of the GDPR;
  • if they fail to meet their obligations, they may be subject to an administrative fine under Article 83 of the GDPR;
  • if they fail to meet their GDPR obligations they may be subject to a penalty under Article 84 of the GDPR; and
  • if they fail to meet their GDPR obligations they may have to pay compensation under Article 82 of the GDPR.

It’s a lot of potential fails – and a lot of potential penalties.

How enforceable this is for non-EU suppliers has yet to be attempted – but there is a high probability that an EU test case will emerge quickly post GDPR implementation. Like most commercial relationships, it will also revolve around the notion of a contract.

The ICO makes two points on this with its own data processing contracts:

  • that nothing within the contract relieves the processor of its own direct responsibilities and liabilities under the GDPR; and
  • the contract will enforce any indemnity that has been agreed (upon).

We will look at the contractual obligations in the next post. We cannot promise that the guidance gets any clearer from any other Supervisory Bodies across the EU.

Thanks, Tony!

GDPR: The Legal Side of the Equation (Part IX)

Today’s guest post is from Tony Bridger, an experienced provider of Procurement Consulting and Spend Analysis services across the Commonwealth (as well as a Lean Six Sigma Black Belt) who has been delivering value across continents for two decades. He is currently President of UK-based TrainingWorx Ltd, a provider of a wide range of Procurement and Analytic business training programs (inc. GDPR, spend analysis, project management, process improvement, etc.) and focussed short-term consulting solutions. Tony can be contacted at tony.bridger@data-trainingworx.co.uk.

As they used to say at the start of the Star Wars Movies, the saga continues. Having explored the physical options of minimisation and anonymisation, information security standards and certification –- we have the option of just, well … complying.

So, what has to be done? If you are a large global vendor in the analytics space -– binding rules is the key option as we have already suggested. For smaller, niche vendors, the regulations are a little more complex. However, not insurmountable. As we have highlighted in several posts, for US providers –- Privacy Shield is a great start.

It is illegal from 25th May to move personal data outside of Europe without the right data controls and contractual agreements in place. The UK based Information Commissioners Office (ICO) as the supervisory authority of the UK is a good place to start for detail. The ICO has written several key documents on how commercial relationships are supposed to work if personal data is moved outside of the EU. The most common arrangement is likely to be the Controller-Processor relationship. In effect, data is controlled within the EU — but processed externally. As we mentioned in a previous post, processors must have representation within the EU if they reside outside of the European Union. This is for notices from client — this contact must be published and available.

The second group of conditions relates to processor operations. The ICO documentation on this is clear. Processors must:

  • only act on the written instructions of the controller (unless required by law to act without such instructions). This means that controllers need to be clear what operations and processing will take place on the supplied data;
  • ensure that people processing the data are subject to a duty of confidence. This means that supplier organisations cannot simply state that staff “stole the data”. This means that data access in processor organisations needs to be contractually managed;
  • must take appropriate measures to ensure the security of processing. This is where the notion of certification and standards becomes prevalent.
  • must only engage a sub-processor with the prior consent of the data controller and a written contract.

None of these conditions are insurmountable –- many procurement practitioners within the European arena will have started to scrutinise a wide range of non-EU supplier contracts. Many vendors may have already been engaged on this process.

In the next post we will continue the controller-processor theme. There are several additional conditions that are required for processors.

We will post these in small doses — this keeps reading and understanding the changes a little more digestible.

We do need to warn you that from here, the GDPR starts to appear somewhat incomplete.

However, it’s a big change that has yet to be combat tested.

Thanks, Tony.

GDPR 8 – Security

Today’s guest post is from Tony Bridger, an experienced provider of Procurement Consulting and Spend Analysis services across the Commonwealth (as well as a Lean Six Sigma Black Belt) who has been delivering value across continents for two decades. He is currently President of UK-based TrainingWorx Ltd, a provider of a wide range of Procurement and Analytic business training programs (inc. GDPR, spend analysis, project management, process improvement, etc.) and focussed short-term consulting solutions. Tony can be contacted at tony.bridger@data-trainingworx.co.uk.

One of the key changes in the GDPR is around the clauses and legal framework that surrounds the processing of personal data.

We will cover this in some detail in the next post (although we did hint at this one!). However, please bear with us as we also have to address cyber security to complete the background for displaying the processing requirements. Security will be a key component of the overall legal framework.

One of the key requirements in processing data is the cyber security that surrounds managing this type of information. The UK Supervisory Authority, the ICO (Information Commissioners Office) issues a wide ranging, practical advice for companies on their website. Given that many procurement analytics providers are now mature IT companies, many will have little to do cyber security wise. Many companies (including high volume email suppliers) have certified to the EU-U.S. Privacy Shield Framework and the Swiss-U.S Privacy Shield Framework. This is an excellent start as we have mentioned previously. The cost of doing this is comparatively small – and we understand that many small US companies have managed to achieve this – around 3000 software enterprises.

On a broader security level, the ICO recommends that companies implement at least the ten steps to Cyber Security model. This can be found on their website. For much smaller UK based data companies, they can achieve Cyber Security Essentials plus certification. This is around $400 USD.

However, it is highly likely that many web analytics provider security arrangements are already in place and exceed the basics. Logically, it may be worth pursuing ISO 27001 accreditation or higher. Like most certification, it can become an expensive and a time-consuming exercise. Many large suppliers may already have CCMv3 (Cloud Controls Matrix), NIST CSF (National Institute of Standards and Technology Cyber Security Framework) or PAS 555.

Is it really worth it? If we had a crystal ball, companies both within and outside of the European arena will come under increasing pressure to prove these controls are in place – and standards are likely to become a key selling point for winning European business. To that end – it is going to be part of the cost of doing business. The alternative is a breach and investigation. Cyber criminals have all the key attack elements in their favour – a confirmed breach could become a costly and damaging PR disaster.

Once vendors combine cyber controls and certification with the extensive legal requirements, it is likely to become a major differentiation point between suppliers. Question is … are vendors ready?