Metanav

Tag Archives | gdpr

GDPR will Help Enhance Cyber Security

GDPR cyber securityOn May 25, 2018, the EU General Data Protection Regulations (GDPR) go into effect. This broadly-reaching set of regulations related to how personal data is collected, processed, and stored, is causing fundamental shifts in the way organizations approach personal data. And rightly so: the fines for non-compliance are significant, at 4% of annual global turnover or €20 Million (whichever is greater). GDPR cyber security will greatly impact internet of things (IoT) device developers, as these devices typically collect and transmit a great deal of personal data. It will no longer be acceptable to create IoT devices with weak security measures, as the manufacturers themselves may be held liable for data breaches caused by poor design.

The good news for consumers is that organizations must take the cyber security of personal data into account as part of their efforts to comply with GDPR cyber security requirements. Data privacy and data security, long considered separate things, are becoming intertwined thanks to these new regulations. Andrew Burt, Chief Privacy Officer and Legal Engineer of Immuta, states, “2018 will prove that cyber security without privacy is a thing of the past.” (Forbes) Article 32 of GDPR provides specific guidance related to data security and breach notification. Among other things, data controllers and processors are advised to include:

  • The pseudonymisation and encryption of personal data.
  • The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
  • The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
  • A process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing. (Heimes)

It is advisable for organizations to begin now to make data privacy a part of their operational GDPR cyber security strategy. No matter where your organization falls within the process, from creating devices that collect and transmit personal data, to collecting personal data, to processing or storing data locally, on the edge, or in the cloud, the cyber security of personal data is a pressing concern. Hackers regularly target this type of information, and news stories about large data breaches are becoming commonplace. Every organization that falls within range of the EU GDPR requirements must reevaluate their cyber security strategy.

Does your organization need to begin implementing a cyber security strategy? Start with the IEEE online course program Cyber Security for Today’s Environment.

 

References

Olivi, G. (2017, Nov 24). Cybersecurity and GDPR: Where We are Heading. DLA Piper Privacy Matters.

Press, G. (2017, Nov 26). 60 Cybersecurity Predictions for 2017. Forbes.

Heimes, R. (2016, Jan 6). Top 10 Operational Impacts of the GDPR: Part 1 – Data Security and Breach Notification. IAPP.

 

Continue Reading 0

IoT and Data Privacy

IoT Data PrivacyThe Internet of Things (IoT) can produce massive amounts of data. This data has to be transmitted, processed in some way, and then potentially stored somewhere, hopefully securely. (Pollmann, 2017) Much of this data is personal data, and some can be quite sensitive. This brings data privacy questions to the forefront. How secure is the data that is generated by IoT devices? How is it used? What happens to that data once the process is complete? IoT data privacy is key.

When considering data privacy regulations around the world, particularly those required by the EU’s General Data Protection Regulations (GDPR) that go into effect in May of 2018, the amount of data generated by the growing IoT is a pressing concern. Both developers and consumers of IoT devices will be held responsible for their use of personal data.

Questions to Consider for IoT Data Privacy

Some of the questions that IoT developers and consumers need to consider:

  • What personal data does my IoT device collect about others?
  • Where is that data sent?
  • How is the data used?
  • Is all of the data collected used, or is there information the device should not collect?
  • Does anyone else have access to the data?
  • Where is the data ultimately stored?
  • How long is the data kept?
  • Do we need to build in an expiration time frame for data storage?
  • How secure is that data during transfer and storage?
  • How will consumers be notified if there is a data breach?

The fines for non-compliance with personal data regulations can be millions of dollars/euros, so it is essential that IoT device manufacturers, as well as those that use them, take the time to understand these regulations, and then consult with attorneys on an approach to personal data use, transfer, and storage. IoT data privacy needs to be built into these devices from the ground up, so that personal information remains secure.

Is your organization developing IoT devices? How do you take IoT data privacy into account? Please share your thoughts and experiences in the comments.

And to learn more about the Internet of Things, check out IEEE Guide to the Internet of Things. This course program will provides the foundation that you need to understand the Internet of Things and some of its industry applications.

 

References

Pollmann, M. (2017, September 25) IoT data is growing fast, and security remains the biggest hurdle. IoT Agenda.

EU General Data Protection Regulation Portal.

Continue Reading 3