COMP3357 Managing Cyber Risk Richard Henson University of Worcester May 2018

Week 13: Internet Law, around the World Objectives: Look at differences in Data Protection & Computer Misuse Laws in different countries round the world Compare similarities between laws in different countries, and scope for an International agreement on e.g. good Data Protection legislation Look at GDPR and future developments. Is it enough?

Summary of UK IT Law Computer Misuse Data Protection Investigatory Powers

EU Law & Directives Directive EU Law produced by EU turned into law within sovereign state e.g. Data Protection Act (DPA) EU Law passed by EU and policed by EU has to be implemented by each country’s own Information Commissioner e.g. General Data Protection Regulation (GDPR)

The EEA (European Economic Area) NOT the same as the EU European “free” trading area Includes non-EU European countries Iceland Switzerland Norway Some non-European countries

US Laws on Privacy of Data Sarbanes-Oxley (SOX) HIPCA Data Breaches further evolution of SOX covers all customer data customers must be informed of the breach…

The new GDPR Catching up with US Data Breaches legislation Released in 2016… goes much further than DPA or US data breach legislation… https://staffweb.worc.ac.uk/hensonr/GDPAfactsopinions.pdf

Implementing GDPR 25th May 2018 (very soon…) Excellent resources… much confusion! 99 articles 175 recitals (advice sections) Excellent resources… ICO (see later) EU www.gdpr-info.eu GDPR in bite-sized chunks

Can the Digital Single Market (DSM) go further? DSM developing since 2012 (first draft of what became GDPR) Joint standard across all EU countries just EU? Rest of EEA? UK? many other countries showing an interest https://www.technomag.co.zw/2018/05/09/kagame-pushes-for-african-single-digital-market/

International Standards as a driver for International Law Known in all countries Understood by professionals in all countries Upholding good practice/standards through regulation is a long accepted principle…

Reasons to look after Data: 1. The Law All UK organisations that hold data on people must register with the Information Commissioner's Office (ICO) criminal offence not to do so... Personal and sensitive data must be kept in accordance with eight principles of the Data Protection Act (1984, updated 1998) not to do so can result in hefty fines or even imprisonment

Reasons to look after Data: 1. The Law - continued Financial data also covered under the law, through the Financial Services Authority (FSA)… rebadged to becomeFCA in 2013 much more severe penalties than the ICO… e.g. Nationwide fined in 2007 approx £1million e.g. HSBC fined in 2009 £ several MILLION e.g. Zurich Insurance fined 2010 £ >1 million

2. Data losses do not look good for the business! Depending on which data a business loses… it may not be able to trade efficiently, or even at all! Worst case scenario: 10 days maximum to recover, or out of business! If business data is stolen, they may ALSO lose trade secrets, customer image, supplier information, market share…

Data Losses & not-for-profit organisations Personal data often not regarded as so important, other than in legal terms hence the catastrophic sequence of errors that led to 25 million records being lost by HMRC HOWEVER… customers do expect their personal data to be safeguarded increasing concern about privacy in recent years source of great embarrassment if data lost

Differences between Public & Private Sectors? Is there a difference regarding data? if strategic business data is lost, with no back up cannot do new business cannot fulfil existing business the business will fold If public organisation data similarly lost service level drops or becomes zero people get angry, write to media public sector body gets lots of bad publicity system gets patched up and limps on enquiry suggests deficiencies & changes to be made…

Economics of Information Security Academic research area seeks to produce economic models for organisations to attribute value to data Back to basics of Information Security: Confidentiality – relationship between confidentiality & intrinsic value? Integrity – very difficult to quantify Availability – if loss of particular data: causes system failure puts the business temporarily out of business must have intrinsic value

Moving forward… Or catching up (!) EU legislation comes into effect 2018. requires organisations to take a risk-based approach to privacy (DPIA)

Further Research Business-oriented recent white papers: http://www.findwhitepapers.com/security/security What SHOULD have happened as the 1998 DPA was implemented…: http://management.silicon.com/government/0,39024677,11015799,00.htm Information Commissioner’s current website – huge collection of documents: http://www.ico.gov.uk