PrivacySpΞc | GDPR & Data Protection

What is less talked is the paths to solution. --why is tracking possible in the first place? ..generally, there's only 1 identity provider. At birth. What if the original identity provider also enables aliases as in ProtonMail? Layered protection for identity and comms. Temp aliases, nuke when necessary. Ensure legal accountability of a person with core identity, but different layers for irl/digital realms, where core identity is not important. For example a country with 10M population could have 10M core and 80M alies identities in different layers.

Reminder to spread the reminder. People forget, new joiners etc.

Start the year with simple reminder ✅Awareness actions

Evergreen reminder

Basic data protection compliance: Configuring and making available technical deletion and retention policies for emails. Retention policy: to make sure email is kept for certain amount of time. (user can not delete it sooner) Deletion policy: to make sure email is deleted after certain amount of time

Few automation flows have nice ROI to legal, compliance and data protection professionals when business is scaling: 😶NDAs: check and rely on industry standards. Avoid nitpicking in terms, generally no practical effect if sanctions are 50k or 100k. 📄Data Processing Agreements - standard descriptions and templates for legal/sales/tenders. The money is not in the DPA. 📥Basic user requests (download data, delete data/account). Generally users don´t know what they want or what is possible. Providing simple access to their data and option to delete data/account (while keeping stuff that is necessary) enables to grow and scale w/o getting buried with AI generated slop requests which need decoding.

Data CIA (conf-integrity-availability) incidents have different resource cost to handle them. For business/ops side: Availability is high priority (losing business when service/data not accessible). Legal/compliance impact generally small (unless in high regulated area where health/finance or similar critical impacts) For legal/compliance POV: Confidentiality is demands most planning, often external notification etc. What was in place before the breach matters. However post factum little to do from business point of view. Integrity breaches can be a b***h however, creating similar level of time critical pressure on all sides with a lot of unknowns and combination with impact to C and A as well.

Some functions and areas can be (semi)automated. In addition to infosec (depending on your team/company/situation), data protection or GDPR compliance main efforts are:

B2C and usually in highly regulated biz (like finance or healthcare), proper Privacy Notice has massive ROI in terms of reducing time spent on GDPR related requests and inquiries.

Proper internal documentation (policies, SOPs, business processes) ftw for providing AI context and building flows. ✅New metadata unlocked - specific summary of the document. Doesn´t have to be polished with corporate politeness. For data retention policy, a description can be: Complete overview data retention periods. Includes mandatory retention periods and expiry time for documents, customer and employee personal data and other information that the company stores for a certain period of time. ℹ️Include whether this document only applies to PII or also for other types of information and data, such as usual business related documents, contents of users´ mailboxes, company tax records. If specific data retention is described in another document, add the info to the other document´s description. credit to @tyler_agg for the practical content

Places to add the reminder: a) internal website b) training sessions c) meeting calls when awaiting joiners d) internal tv/screens e) printouts for office f) regular email reminders g) company slack/teams channel h) ... 😉

Share during online meetings when idle/instead talking about the weather

challenges to verify, select and secure are different per user/department. SOPs help to keep the baseline requirements for all. Add exception rule for escalating. Managing SOPs + exceptions > hands on managing standard situations, being "helpful"

SOP or 2 will keep provide step by step guidance

only what is necessary

Video surveillance vs public event video "surveillance"? ℹ️In public events (sport games, concerts, shows etc), it is generally considered legit for guests/visitors to be filmed by event organizers or similar. Artists can also claim the video footage to be used in their music videos (see the fine print when purchasing tickets).

Incident management is agile/fluid - unknowns at first, time pressure for teams. Preparation solves a lot of stress factors and helps to avoid easy mistakes. Formal plans -> practice (mock and real) -> lessons learned.

darkmode

Quick reminder content for use in your team