I started addressing privacy risk within a large multinational financial and health care organization around 1993 when, generally, no legal requirements for addressing privacy existed, but certainly many privacy risk factors and concerns did indeed exist. (Note: Just because there are no laws governing privacy, it does not mean there is no privacy risk or potential privacy harms; there could be many.) How times have changed.
Now the need to address privacy to meet legal obligations has expanded, and so have the privacy risk factors that are emerging in everyday use of new technologies, which continue to expand exponentially, as more personal information is created and shared daily. Additionally, the drivers for protecting privacy to address these risk factors have evolved throughout the countries that have been implementing data protection laws, and the ways in which these views are addressed also continue to develop. For example, in some parts of the world, privacy laws were generally created to address and reflect sectoral issues, such as in the United States. In other parts of the world, privacy laws were created to reflect the issue of protecting each individual citizen’s rights for all the industries within which their associated personal data are used, such as throughout the European Union countries.
Early in the creation of privacy laws, this tactic seemed to work, at least from a nation-based view. However, economic globalization and online sharing of data from all parts of the world has emerged to digitally make country borders disappear, particularly online. Now those regional differences in laws have become a significant challenge for all businesses in general (with individuals traveling the world to do business anywhere with a press of a keyboard button), and information assurance professionals in particular are challenged to meet multiple compliance requirements with all those digital international travelers visiting their online storefronts and using their apps.
Business leaders with responsibilities that include information security, privacy and compliance need to identify not only the data protection laws with which they must comply, but also the privacy risk applicable to their organizations, along with the privacy harms possible to the associated data subjects, and then utilize effective frameworks to help them to address and appropriately mitigate, on an ongoing basis, the privacy risk. One current focus for a large number of worldwide organizations is how to get ready and meet the new EU data protection law next year.
GDPR Background
In 2016, the European Union General Data Protection Regulation (GDPR) 1 (effective on 25 May 2018) was adopted to replace the Directive 95/46/EC to implement a legally binding regulation that will be considered the EU data protection law. The purpose of this article is not to provide in-depth coverage for the GDPR. However, for readers who are not familiar with the massive breadth of topics covered, it is beneficial to provide, as a reference, a high-level outline listing the wide range of topics covered within the 11 chapters, consisting of 99 articles with hundreds of specific requirements in total that make up the law. They include:
- Chapter 1—General provisions includes Articles 1 through 4 covering : Subject matter and objectives; Material scope; Territorial scope; Definitions
- Chapter 2—Principles includes Articles 5 through 11 covering : Principles relating to processing of personal data; Lawfulness of processing; Conditions for consent; Conditions applicable to child's consent in relation to information society services; Processing of special categories of personal data; Processing of personal data relating to criminal convictions and offences; Processing which does not require identification
- Chapter 3—Rights of the data subject includes Articles 12 through 23 covering : Transparency and modalities; Transparent information; Communication and modalities for the exercise of the rights of the data; Information and access to personal data; Information to be provided where personal data are collected from the data subject; Information to be provided where personal data have not been obtained from the data subject; Right of access by the data subject; Rectification and erasure; Right to rectification; Right to erasure ‘right to be forgotten’; Right to restriction of processing; Notification obligation regarding rectification or erasure of personal data or restriction of processing; Right to data portability; Right to object and automated individual decision-making; Right to object; Automated individual decision-making, including profiling; Restrictions
- Chapter 4—Controller and processor includes Articles 24 through 43 covering : General obligations; Responsibility of the controller; Data protection by design and by default; Joint controllers; Representatives of controllers or processors not established in the Union; Processor; Processing under the authority of the controller or processor; Records of processing activities; Cooperation with the supervisory authority; Security of personal data; Security of processing; Notification of a personal data breach to the supervisory authority; Communication of a personal data breach to the data subject; Data protection impact assessment; Prior consultation; Data protection officer; Designation of the data protection officer; Position of the data protection officer; Tasks of the data protection officer; Codes of conduct and certification; Codes of conduct; Monitoring of approved codes of conduct; Certification; Certification bodies
- Chapter 5—Transfers of personal data to third countries or international organisations includes Articles 44 through 50 covering : General principle for transfers; Transfers on the basis of an adequacy decision; Transfers subject to appropriate safeguards; Binding corporate rules; Transfers or disclosures not authorised by Union law; Derogations for specific situations; International cooperation for the protection of personal data
- Chapter 6—Independent supervisory authorities includes Articles 51 through 59 covering : Independent status; Supervisory authority; Independence; General conditions for the members of the supervisory authority; Rules on the establishment of the supervisory authority; Competence, tasks and powers; Competence; Competence of the lead supervisory authority; Tasks; Powers; Activity reports
- Chapter 7—Cooperation and consistency includes Articles 60 through 76 covering : Cooperation; Cooperation between the lead supervisory authority and the other supervisory authorities concerned; Mutual assistance; Joint operations of supervisory authorities; Consistency; Consistency mechanism; Opinion of the Board; Dispute resolution by the Board; Urgency procedure; Exchange of information; European data protection board; European Data Protection Board; Independence; Tasks of the Board; Reports; Procedure; Chair; Tasks of the Chair; Secretariat; Confidentiality
- Chapter 8—Remedies, liability and penalties includes Articles 77 through 84 covering : Right to lodge a complaint with a supervisory authority; Right to an effective judicial remedy against a supervisory authority; Right to an effective judicial remedy against a controller or processor; Representation of data subjects; Suspension of proceedings; Right to compensation and liability; General conditions for imposing administrative fines; Penalties
- Chapter 9—Provisions relating to specific processing situations includes Articles 85 through 91 covering : Processing and freedom of expression and information; Processing and public access to official documents; Processing of the national identification number; Processing in the context of employment; Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; Obligations of secrecy; Existing data protection rules of churches and religious associations
- Chapter 10—Delegated acts and implementing acts includes Articles 92 through 93 and covers : Exercise of the delegation; Committee procedure
- Chapter 11—Final provisions includes Articles 94 through 99 and covers : Repeal of Directive 95/46/EC; Relationship with Directive 2002/58/EC; Relationship with previously concluded Agreements; Commission reports; Review of other Union legal acts on data protection; Entry into force and application 2
The EU GDPR does not impose data transfer restrictions on data flows within the European Union (registration and notification requirements still apply). However, the EU GDPR does regulate transfers of personal data to and from non-EU countries. Personal information can be transferred only to jurisdictions outside of the European Union that can demonstrate an “adequate level of protection” 3 for the personal information or have another basis for the transfer.
EU data protection law provides data subjects with a wide range of rights that can be enforced against organizations that process personal data. These rights will limit the ability of organizations to lawfully process the personal data of data subjects in many of the ways that they had regularly done in the past. These new rights could significantly impact an organization's business model. This change to an individual-focused protection model represents a major transformation for how organizations must now protect the personal data of individuals throughout Europe.
GDPR Has Global Impact
Given the significant financial penalties for non-compliance 4 and what appear to be more proactive compliance efforts planned from the EU data protection supervisor, 5 the GDPR truly compels action from all organizations not only doing business across Europe (including the United Kingdom post-Brexit, along with the European Union and European Economic Area countries), but also all organizations with offices in Europe, workers in Europe (even if they are not there permanently), clients, customers, patients and any type of consumer in Europe. Does an organization have a website? Do individuals from Europe interact with that organization through its website? Do they use its applications (apps)? If so, then GDPR most likely impacts that organization. All organizations that act as controllers 6 are directly affected by the rights the GDPR establishes for data subjects. Organizations that act as processors (e.g., contracted vendors, third parties) must also be aware of GDPR requirements, and most will need to comply with all requirements, generally. This can be facilitated by establishing a privacy management framework that considers all the organization’s applicable legal requirements for personal data protection.
Using ISACA Privacy Principles for GDPR Compliance
The recently released ISACA Privacy Principles and Program Management Guide can be used by information assurance professionals, in conjunction with COBIT 5, to implement a privacy program within the COBIT 5 governance and management framework construct to establish such a privacy risk management framework. The recently released ISACA publication, Implementing a Privacy Protection Program: Using COBIT 5 Enablers With the ISACA Privacy Principles describes in detail how to accomplish this.
This article provides one example using a current, common, worldwide initiative for compliance with one of the 99 Articles within the GDPR, Article 34, “Communication of a personal data breach to the data subject,” 7 a challenge faced not only by any organization located in the European Union, but also by any organization with offices, workers, patients, clients, customers, or any personal data of anyone in or from the European Union.
For reference when going through this example, here are the 14 ISACA Privacy Principles defined within the ISACA Privacy Principles and Program Management Guide:
- Choice and Consent
- Legitimate Purpose Specification and Use Limitation
- Personal Information and Sensitive Information Life Cycle
- Accuracy and Quality
- Openness, Transparency and Notice
- Individual Participation
- Accountability
- Security Safeguards
- Monitoring, Measuring and Reporting
- Preventing Harm
- Third-party/Vendor Management
- Breach Management
- Security and Privacy by Design
- Free Flow of Information and Legitimate Restriction 8
The ISACA Privacy Principles and Program Management Guide provides a high-level look at how the ISACA Privacy Principles apply to COBIT 5 and provides full explanation of each privacy principle.
Figure 1 demonstrates the relationship among GDPR Article 34, COBIT 5, the ISACA Privacy Principles (the wording is slightly modified for better ease of reading in this context) and an organization’s related activities. This demonstrates how practical utilization of the ISACA Privacy Principles, in conjunction with the COBIT 5 principles, can be used to support the creation and implementation of management processes to support Article 34 compliance requirements for breach response procedures and associated actions with managing a privacy breach.
Figure 1—Mapping COBIT 5 and ISACA Privacy Principles to Compliance Requirements
|
GDPR Article 34 Requirements for Breach Response |
ISACA Privacy Principles |
COBIT 5 Principles |
Organization Activities |
| 1. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons (data subjects), the data controller must communicate the personal data breach to the data subjects without undue delay. |
Primary :
|
1. Meeting stakeholder needs: Supporting privacy needs, maintaining/building data subject trust
and providing benefits
|
A. Upon awareness of the breach, activate the breach response team that is responsible for determining
privacy harm risk levels and for providing notice to involved data subjects.
|
|
2. The communication about the breach to the impacted data subjects must describe in clear and plain language the nature of the personal data breach and contain at least the name and contact details of the data protection officer or other contact point where more information can be obtained, a description of the likely consequences of the personal data breach, a description of the measures taken or proposed to be taken by the controller to address the personal data breach, and any adverse effects of mitigation actions taken. |
Primary :
Related :
|
1. Meeting stakeholder needs: Supporting privacy needs, maintaining/building data subject trust,
and providing benefits
|
A. If there is high risk of harm to the involved data subjects, obtain the description of the
actions the breach response team has taken to date and write a description of those actions, including
the likely harms and consequences and the mitigating controls taken and planned.
|
|
3. The communication to the data subject referred to in row 1 shall not be required if any of the conditions in rows (a), (b) or (c) are met: |
Primary:
Related:
|
1. Meeting stakeholder needs: Supporting privacy needs, maintaining/building data subject trust,
and providing benefits
|
A. If the risk is not high, communications are not required to be sent to affected data subjects.
|
|
a) the controller has implemented appropriate technical and organizational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those measures that render the personal data unintelligible to any person who is not authorized to access it, such as encryption; |
Primary:
12: Breach Management
Related:
|
1. Meeting stakeholder needs: Supporting privacy needs, maintaining/building data subject trust,
and providing benefits
|
This is addressed in row 1 activities. |
|
b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialize; |
Primary:
Related:
|
1. Meeting stakeholder needs: Supporting privacy needs, maintaining/building data subject trust,
and providing benefits
|
This is addressed in row 1 activities. |
|
c) it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner. |
Primary:
12: Breach Management
Related:
|
1. Meeting stakeholder needs: Supporting privacy needs, maintaining/building data subject trust
and providing benefits
|
This is addressed in row 1 activities. |
|
3. If the controller has not already communicated the personal data breach to the associated data subjects, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met. |
Primary:
Related:
|
1. Meeting stakeholder needs: Supporting privacy needs, maintaining/building data subject trust,
and providing benefits
|
A. The breach response team will follow breach procedures to notify the supervisory authority.
Such notification will include the same information as was included in the data subject breach notifications,
if they were sent. If breach notifications were not sent, the information sent to the supervisory authority
will contain the same information as would have been included in the event notification had been given.
|
Implementing a Privacy Protection Program: Using COBIT 5 Enablers With the ISACA Privacy Principles includes details, as shown in the excerpted figure 2, to identify the management processes for incidents within the COBIT 5 process reference model. Similar tables are provided in Implementing a Privacy Protection Program: Using COBIT 5 Enablers With the ISACA Privacy Principles for the other topics within the COBIT 5 process reference model as well.
Figure 2—COBIT 5 Management Process Set DSS02
DSS02 Manage Service Requests and Incidents |
Area: Management
|
|
COBIT 5 Process Description
|
|
|
COBIT 5 Process Purpose Statement
Achieve increased productivity and minimize disruptions through quick resolution of user queries and incidents. |
|
|
Primary Privacy Principles Involved
• Principle 3: Personal Information and Sensitive Information Life Cycle
|
|
DSS02 Privacy-specific Process Goals and Metrics |
|
|
Privacy-specific Process Goals |
Related Metrics |
|
A privacy breach and incident response program including actions to ensure that responses are effective, efficient and appropriate is established and maintained. |
|
DSS02 Privacy-specific Process Practices, Inputs/Outputs and Activities |
|
|
Management Practices |
Privacy-Specific Activities (in Addition to COBIT 5 Activities) |
|
DSS02.01 Define incident and service request classification schemes.
|
|
|
DSS02.02 Record, classify and prioritize requests and incidents.
|
|
|
DSS02.03 Verify, approve and fulfill service requests.
|
|
|
DSS02.04 Investigate, diagnose and allocate incidents.
|
|
|
DSS02.05 Resolve and recover from incidents.
|
|
|
DSS02.06 Close service requests and incidents.
|
|
|
DSS02.07 Track status and produce reports.
|
|
Source: Based on ISACA, Implementing a Privacy Protection Program: Using COBIT Enablers With the ISACA Privacy Principles , USA, 2017, chapter 2
As author and lead developer for the book, this author wanted to demonstrate how the ISACA Privacy Principles could be mapped into the full set of COBIT 5 processes. The ISACA International Privacy Task Force, along with approximately 450 additional ISACA member reviewers, supported that idea and approved of the mappings. Mapping the requirements in this way helps to ensure that all requirements are addressed and shows how each activity is related to the COBIT 5 framework and associated ISACA Privacy Principles and, in the example here, ensures compliance with this particular requirement of the GDPR.
Now that the mapping exercise has been outlined, one can look at how one subset of the associated breach management process goals, metrics and practices can be established using COBIT 5 and the corresponding privacy principles, as shown in figure 2. It includes some sample metrics to the goals specific to GDPR requirements. An organization could use any of these that are applicable and add others that are more specifically applicable to the organization’s business environment.
Rebecca Herold, CISA, CISM, FIP, CIPM, CIPP/IT, CIPP/US, CISSP, FLMI
Is chief executive officer for The Privacy Professor and president and cofounder, SIMBUS, LLC, Information Security and Privacy Management Services. She served on ISACA’s Project Development Team to create ISACA’s Privacy Framework and authored the 2 volumes of ISACA Privacy Principles books released in 2017.
Endnotes
1
The European Parliament and the Council of the European Union,
Article 34 Communication of a personal data breach to the data subject, General Data Protection Regulation, European
Union, 2016
2
The European Parliament and the Council of the European Union,
Regulation (EU) 2016/679 of the European Parliament and of the Council 27 April 2016 on the protection of natural persons
with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
(General Data Protection Regulation),
Official Journal of the European Union, European Union, 2016
3
Ibid. This concept is discussed in 10 places within the GDPR text.
4
Ibid. Article 83. Fines can be up to EUR €20 000 000 or, in the case of an undertaking, up to 4% of the total worldwide
annual turnover of the preceding financial year, whichever is higher.
5
European Commission,
European Data Protection Supervisor
6
Op cit, General Data Protection Regulation. Per the GDPR, “‘Controller’ means the natural or legal person, public
authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing
of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller
or the specific criteria for its nomination may be provided for by Union or Member State law.”
7
Ibid. Article 34
8
ISACA,
ISACA Privacy Principles and Program Management Guide
, USA, 2017
9
European Commission,
Questions and Answers—Data protection reform package, press release, 24 May 2017