naomi@naomikorn.com @nkorn www.naomikorn.com

GDPR Museums and you Copyright Unless otherwise stated, the contents of this presentation are © Naomi Korn. The ICO chart is licensed under an Open Government Licence and © Crown Copyright. This presentation may be shared and reused for non-commercial purposes, apart from any images, for which separate permission from Naomi Korn to reproduce them must be sought. Where indicated, this presentation also includes content and slides which are copyright of third parties. In these cases, the terms of any licences must be honoured and where required, permission to reuse should be sought. Disclaimer: The information provided within this presentation is an opinion and should not be construed as legal advice.

Topics Setting the scene Key Issues What you can do next Time for Questions

Setting the scene Legal compliance is a requirement of Accreditation (including copyright, data protection etc) Lots of different types of museums Lots of activities Museums should be DP compliant already Some exemptions already apply to museums LIVING IDENTIFIABLE INDIVIDUALS

GDPR and you Museums = data controllers and possibly data processors Need to take responsibility for your processing activities + those who do it for you Need to understand what you collect, why and for how long More about legal grounds for processing Sharing DPOs Good opportunity for deep data clean 

Impact Breaking the law Financial penalties Reputational impact Increased pressures on resources Discontented users who don’t visit, or cause problems for us, or tell on us Job losses/disciplinary

Copyright + Compliance = Business Critical Decisions Risk Too risk adverse – more cost, greater benefit T Cost Benefit

What you can do next Copyright & GDPR are holistic organisational issues Strategies for: legacy stuff + new stuff Rights & DP Management Balance between compliance, ethics & risk Privacy and rights by design Application of NKCC Compliance Framework

NKCC Compliance Framework

ICO recommends…

Useful Resources Free GDPR FAQs under a CC Licence www.naomikorn.com/resources ICO website: www.ico.org.uk AIM Guide: https://www.aim-museums.co.uk/wp-content/uploads/2017/10/2-Successfully-managing-privacy-and-data-regulations-in-small-museums.pdf

Questions What can we do about large quantities of donor paper files? Should user registration forms – such as copyright forms/donor forms have a consent tick box and privacy statement? Should we encrypt our collections management systems which hold personal data? What should we do about our existing mailing lists? Can museums use legitimate interests for legal processing?

@nkorn www.naomikorn.com