EU regulations on the traceability of your data is looming on the horizon

Yesterday I attended Adaptive Ireland’s breakfast seminar “EU Data Protection becomes law! What is your next move?” The three speakers EU Data protection specialist, Daragh O’Brien, Adaptive Ireland’s MD, Brendan Cannon and Pete Rivett who is considered the father of Data Governance in the US spoke about the new EU regulations on the traceability of your data.

The new EU General Data Protection Regulations (GDPR) are set to come into play sometime in 2018 and you could be facing fines or jail time. The fines could be €20m or 4% of annual worldwide turnover for groups of companies, whichever is greater and they are paid to the country where the non compliance occurs.

What you should do to be compliant
You have to know the full history of your data since it was created, as you are now responsible for any changes made to it since creation.
You also have to keep track of all the data and copies of data that you are holding.
Once you are no longer using a specific program or database, shut it down for good and make sure that it can no longer be accessed.
Map where the data resides and is used.
Measure how is the data used and what data do you not need.
Traceability is important and you have to know who has access to your data and how it is used and shared.
The lineage of your data is very important i.e. copies of your data and if the copies are modified from the original source file.
Accountability must be a high priority, and you have to make sure that you know who has control of the data as well as who is responsible for it.
Make sure that all data is secure and that it can’t’ be a security risk.

The most common places where data resides
Data can reside in floppy disks, local hard disks or usb keys.
Data can also reside in various databases and software you may use.
Data can reside locally or in the cloud.

Daragh mentioned that as of last week a well known American cloud computing company still references Safe Harbor in some of their model clauses which makes that cloud company illegal under EU law. There may possibly be other companies who are still referencing Safe Harbor, so please check thoroughly all your suppliers model clauses to ensure you are compliant with EU Law.

So when it comes to the new EU data regulations being compliant is one thing but it always helps to go the extra mile and be ethical. Your customers will thank you for it and you will be happy knowing that no big fines or data breaches will be heading your way.