Privacy Insights 2020 2
Total Page:16
File Type:pdf, Size:1020Kb
AN OFFERING FROM BDO’S GOVERNANCE, RISK & COMPLIANCE PRACTICE PRIVACY INSIGHTS 2020 2 FOREWORD This whitepaper is focussed on global data privacy regulatory insights. The other megatrend is the mass move globally to working from home. However, given the current global COVID-19 pandemic situation it would This brings internal and external challenges. Internal considerations include be injudicious to not mention some of the considerations for data privacy the rapid shift to remote working with increased use of personal devices during these unprecedented times. There are two global megatrends to and dependence on key individuals as well as the need to understand more monitor developments of. about the personal health situation of not only employees but those they are co-habiting with. Additionally, timelines for responding to Data Subject The first is the global race to develop contact tracing applications. These are Access Requests can be strained. External challenges include the emergence being designed and developed by large corporations, national governments of increased opportunities for fraudsters and criminals to illegally obtain and private companies. Significant work is underway by Data Protection personal data as well as the potential impact of an impaired service from Authorities, lawyers, politicians and privacy advocates to balance citizens external providers which may result in increased data breaches. privacy rights with the urgent need to manage the pandemic. There is also significant concern that even if privacy rights can be balanced for this specific use, governments and companies may retain too much control over citizens data post the pandemic as a result. Karen A. Schuler, Principal and National Governance, Risk & Compliance Leader, BDO USA Koen Claessens, Partner Risk Advisory, BDO Belgium 3 INTRODUCTION BDO’s clients operate in multiple jurisdictions around the world. As such, we are pleased to provide a summary of current data privacy obligations along with contact details and commentary, from a sample of jurisdictions where BDO has substantial privacy expertise. Over the last several years BDO formalized its global privacy program by defining and operationalizing data privacy services that complement data governance, information governance and cybersecurity. Core services that BDO offer includes: assessments, legal support, technology support, implementation and remediation, and managed services. A comprehensive view of our offerings are outlined below. Managed Services Legal Support • Individual Rights Administration • Ad hoc legal advice (e.g. video surveillance, DSARs, Data • Privacy by Design Operations Sharing) • Maturity Assessments • Advice on data subject requests and data breaches • PrivacyWatch DATA • Advice on interpretation and applicability • Data Protection Acadamy PRIVACY • Advice on contractual arrangements with third parties • External DPO or internal DPO support • Legal representation vis a vis Data Protection Authorities • Representative as a Service • International data transfers policies and registers development Assessment Technology Support • Data Privacy readiness assessment Implementation and Remediation • Design and review of planned and existing architecture. ‘Data Privacy by design’ • Data Privacy audit / due diligence • Data privacy strategy and implementation • Data Privacy Impact Assessments & implementation of technical measures • Annual Privacy Healthcheck • Privacy project management • Data subject rights management • Data mapping / data flow diagramming • Privacy notices, policies and procedures development • Data privacy management tools: Tool / software selection Plan, design & • Records of processing register development • Technical controls implementation implementation of tools • Data Protection Assurance / Certification • Third-party processor remediation • Data masking & Data encryption tool • Data minimization, retention, erasure and classification • Security assessments: Vulnerability scanning, Penetration testing, policies, and process development Ethical hacking & social engineering 4 GLOBAL INSIGHT Although there are varying patterns globally, The dreaded fines which were the oft-cited driver for typically lead to investigations. Those investigations common themes exist across jurisdictions. For GDPR compliance in the run up to May 2018 have not may result in fines; however, the fees to complete example, companies serving European markets are made the impact many expected, leading to many these investigations range from $50,000 to millions. required to comply with the General Data Protection (inaccurate) comparisons to Y2K (the millennium bug). Regulation (GDPR). Those same companies operating It is true that although some hefty fines have been Regulators have been ‘complaint led’ and focused in California, United States or in Brazil will be required issued, the frequency or magnitude that were predicted on core principles such as fairness, lawfulness and to comply with their new regulations, which only in some quarters have not come to fruition. However, transparency as exemplified in the Cambridge compounds privacy program obligations. That, in penalties were far greater than under existing European Analytica/ Facebook scandal, where personality addition to the global pandemic driving regulatory data protection regulations. And, the GDPR is driving tests were used to gain access to data used for updates and guidance makes it difficult for companies other jurisdictions to conduct investigations. Therefore, targeted adverts, allegedly influencing the outcome to sustain a business-as-usual state. even though GDPR penalties have been in the order of the U.S. election and the UK Brexit referendum. of thousands rather than millions and most entities This reflects the fact that in general, scrutiny and In 2017 and 2018 companies rushed to attain have (so far) remained unscathed, data breaches are publicity has been focused on the social media giants compliance in time for GDPR in May 2018. Thousands being investigated in regions outside of the European and larger multinational companies. Resting on one’s of readiness assessments were conducted, resources Economic Area (EEA). That said, the fine of 50 million laurels however is not an option. It is worth noting were mobilised, only to wait to see if a regulator EUR issue by the French DP against Google in January that the big cases take time to bring to fruition would call upon them to evaluate their state of 2019 (for lack of transparency, inadequate information and progress through the court system. They may compliance. Following this, in 2019, there were limited and lack of valid consent regarding targeted adverts) not have hit the headlines yet, but there are cases GDPR activities across Europe, however companies certainly caused companies to take notice. waiting in the wings. In purely pragmatic terms, the based in the United States experienced an uptick Data Protection Authorities have had a significant in activity – in particular, they were called upon Data breaches are not region-dependent - data knows workload to examine. Not only that, they also to demonstrate compliance. And, if a data breach no boundaries. For example, a company operating in the have to manage ongoing issues that pre-dated the occurred, then regulators from jurisdictions like the United States may service consumers in more than 50 GDPR. Both the UK’s Information Commissioner’s European Union, China, India, Turkey, United States, jurisdictions. That company experiences a data breach Office (ICO) and the Irish Commissioner have Hong Kong, Australia, Canada and many others were where consumers are impacted in 20 jurisdictions and indicated that there are cases in the pipeline for keen to scrutinise what occurred and demonstrate 15 of them have data protection laws or regulations. The 2020. Now more resources have been allocated and their new powers. Regulators are also more impacted organization will likely receive an enquiry from experience gained, it is predicted that regulatory sophisticated than ever before; often calling in outside each of those jurisdictions, which then could lead to five activity will ‘step up’- and the highest fines and most experts and lawyers to ensure they are thoroughly or more investigations. Some jurisdictions ask specific significant enforcement notices are yet to come. investigating such cases. questions about the incident and will surmise that the Data controllers and processors who have become company operated in good faith to protect the rights complacent in 2019 may well regret their lack of of individuals. However, the other five inquiries will action. 5 It has also become apparent that ‘GDPR compliance’ data protection cases”. The EDPB plans to release is by no means a simple or binary matter. Sub- guidance on the certification and Codes of Conduct as In the EEA over 160,000 data processors are a good example of this. Although a tool for transfers, as well as international transfers one of the compulsory ‘GDPR clauses’ requires that between public bodies for administrative cooperation breach notifications have processors cannot deploy sub-processors without purposes. They will also continue to provide opinions been reported to date express consent, it is difficult (if not impossible) to from certain Supervisory Authorities on standard implement this in practice. In particular, multinational contractual clauses for international transfers under Total Number of GDPR Fines companies who have ‘take