Data Protection Officers, a valuable commodity, Carey Olsen conference told
When the EU’s General Data Protection Regulation (GDPR) and the corresponding Guernsey law come into force in May 2018, the role of the Data Protection Officer (DPO) will be paramount. Even if businesses are not obligated by the GDPR to appoint a DPO, it will be good practice to have someone primarily responsible for information security.
Matt Thornton, Guernsey director of professional services at C5 Alliance, said that staff were the cause of the majority of breaches. Technological solutions could only go so far and solid training was a necessity.
“The weakest link in everything when it comes to security is the humans at the end of the keyboard and tablet,” he said.
Mr Thornton said that passwords were often “flimsy at best” and routines such as password change rules may be counter-productive as users become resistant and lazy, for example using password1, password2 etc. The key is the appropriate use of control mechanisms.
Sharing information with colleagues and taking information out of the office were common yet careless practices and employees often failed to understand their duties and obligations regarding security. Organisation-wide awareness is a requirement.
“It is too easy to assume that something that sounds complicated is a problem for IT,” he said.
The coming regulations would require “appropriate technical and organisational measures to ensure and be able to demonstrate that processing is performed securely”. It was likely that business organisations of a certain size would need to hire a DPO and appropriately-qualified and experienced people are quickly becoming a rare commodity.
DPOs will need expert knowledge of data protection laws and practices. They will need to be involved early and in all privacy-related matters and will be bound by confidentiality. They will need to have appropriate resources to enable them to fulfil their role and conflicts of interest will not be permitted. They will have an advisory role and will be responsible for risk assessment, the monitoring of legislation and policies and training of staff.
Other speakers at the over-subscribed conference were Callie Loveridge-Newey, States of Guernsey lead officer for data protection governance, Data Protection Commissioner Emma Martins and Phil Hunkin, from the financial investigation unit of the Guernsey Border Agency.
The EU’s GDPR will be enforced from May 2018. Work has begun on drafting a Guernsey law which will be broadly equivalent to GDPR and is designed to maintain Guernsey’s current adequacy status, allowing data flows between the island and Europe.
It was acknowledged that Guernsey is ahead of competitor jurisdictions in proactively preparing for GDPR.
