GDPR & Accountability ISACA Ireland Annual Conference 2018 Ultan O’Carroll, Assistant Commissioner (Technology) November 2018 @DPCIreland

Regulations Universal Declaration on Human Rights (1948) European Convention on Human Rights (1950) Constitution of Ireland (1937; case-law) Convention 108 (Council of Europe, 1981) Data Protection Act, 1988 EU Directive 95/46/EC Data Protection (Amendment) Act, 2003 GDPR - 2018 ePrivacy Regulation? EU Charter of Fundamental Rights – Art.7: “Everyone has the right to respect for his or her private and family life, home and communications.” Art.8: “Everyone has the right to the protection of personal data concerning him or her.” + to be processed fairly for specified purposes and on a legitimate basis + subject to control by an independent authority

Data Protection Principles Obligations Fair obtaining & processing Transparent Data minimisation Specified purpose - Relevant, not excessive Non disclosure Accurate Safe & Secure Specified Retention period Accountability : demonstrate compliance with principles. DP by Design & Default Risk Management User rights

Accountability by… Transparency Record Keeping Codes of Conduct Certification Impact Assessment Governance and Data Protection By Design & Default Contract, transfers, agreements, BCRs User rights Data Protection Officer

Data Protection by Design Start to finish – business case to end-of-life Design and Non Functional Requirement Whole organisation to engage Delete means delete Security – encryption and pseudonymisation are not anonymization Know your data, processes, configuration, deployment and risks – Data Protection Impact Assessment [35,36] Default settings observing principles must be used

Impact Assessment (Art 35) Prior Assessment (audit) for high risk processing Screening & record keeping (Art 30) Structured & Methodical approach Documents processing, inherent and residual risk Determines whether processing can take place Prior Consultation - Art 36?

Accreditation & Certification 765/2008 still applies but Art 43(1) also applies ISO 17065 basis – products and services INAB will accredit, DPA to approve criteria – GDPR based DPA to specify “additional requirements” – expertise etc. Legal, Technical, Security, Evaluation, Assessment skills Cross border – “EDPB Seal” Other certification still possible

GDPR Opportunities Skills needed across organisations to demonstrate and be accountable for processing – compliance Documentation & record keeping; DP by Design; Governance; Internal audit; Process, change & risk management; DPO support; Certification; Contracts Technical, legal, communications expertise Enjoy the day!

www.dataprotection.ie www.GDPRandyou.ie @DPCIreland