|
|
| (2 intermediate revisions by one other user not shown) |
| Line 14: |
Line 14: |
| | | | |
| | --Marc Paré & Bob Jonkman | | --Marc Paré & Bob Jonkman |
| − |
| |
| − | ==== Talking Points ====
| |
| − |
| |
| − | * General Data Protection Regulation (GDPR)
| |
| − | ** European Commission
| |
| − | *** set the GDPR standards
| |
| − | ** Data Protection Agencies (DPA) (e.g. Information Commissioners Office ICO in the UK)
| |
| − | *** In charge of administering the GDPR in their respective countries
| |
| − | ** In force as of 25 May 2018
| |
| − | *** primarily applies to controllers and processors located in the European Economic Area (the EEA) with some exceptions
| |
| − | *** applies to any site servicing or selling goods to European users
| |
| − | *** all sites must adhere to GDPR except any personal websites
| |
| − | ** Types of data
| |
| − | *** clear reason for data collection
| |
| − | ** Consent
| |
| − | *** requires use of positive opt-in consent and NOT pre-ticked consent or use of double-opt-in
| |
| − | *** requires site's statement of consent must be clear and explicit
| |
| − | **** cannot re-purpose consent to another statement
| |
| − | *** user ability to remove consent should be easily accomplished
| |
| − | *** requires storage of consent for possible future audit trails
| |
| − | ** Data Storage
| |
| − | *** clear defined use and length needed to store information
| |
| − | *** storage of personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes
| |
| − | *** data collection must be necessary
| |
| − | *** users have the right to access, rectify, erase, restrict, restrict portability of data
| |
| − | *** restricts the transfer of personal data to countries outside the EEA, or international organizations
| |
| − | ** Types of data collection groups (2)
| |
| − | *** Controllers and Processors
| |
| − | ** Data Protection Officers (DPO)
| |
| − | *** individual in charge of data storage and adherence/compliance to GDPR for companies over 250 employees or if collecting large personal sensitive data
| |
| − | *** DPO must be independent, an expert in data protection, adequately resourced, and report to the highest management level
| |
| − | *** DPO may be shared amongst multiple organizations
| |
| − | *** you must appoint a DPO if
| |
| − | **** your site requires large scale tracking
| |
| − | **** you are a public authority or body
| |
| − | **** your site collects data on criminal convictions/offences
| |
| − | **** appointing a DPO is suggested as best practice
| |
| − | ** Data Breaches
| |
| − | *** requires that data is stored securely
| |
| − | *** encryption is suggested
| |
| − | *** breaches reported withing 72hrs
| |
| − | *** keep record on any breaches
| |
| − | *** have breech policy
| |
| − | ** Non-compliance fines
| |
| − | *** up to 20 million euros or 4% of annual revenues
| |
| − | ** GDPR Certification
| |
| − | *** framework is still not available but forthcoming
| |
| − |
| |
| − | ==== GDPR and Canadian Privacy Laws ====
| |
| − | ** Personal Information Protection and Electronic Documents Act (PIPEDA)
| |
| − | *** aligns more or less with GDPR
| |
| − | *** updated as of 01 November 2018
| |
| − | *** mandatory reporting of breeches to users and to Privacy Commissioner
| |
| − | **** more fine grained reporting on breech policy and record keeping
| |
| − | *** fines up to $100,000
| |
| − |
| |
| − | ==== Resources ====
| |
| − | * [https://www.zdnet.com/article/dutch-government-report-says-microsoft-office-telemetry-collection-breaks-gdpr/ Dutch government report says Microsoft Office telemetry collection breaks GDPR | ZDNet]
| |
| − | ** Investigators said they've identified the "large scale and covert collection of personal data" through Office's built-in telemetry collection capabilities.
| |
| − |
| |
| − | ::They said Microsoft engages in this telemetry collection covertly and without properly informing users.
| |
| − |
| |
| − | ::The report said investigators didn't find any official documentation about what information Microsoft collects through Office and no way of turning Office telemetry off, raising a serious privacy concern for all current Office users, regardless of geographical location.
| |
| | | | |
| | | | |
