EU General Data Protection Regulation

Transcription

1

2 EU General Data Prtectin Regulatin Sally Ubnske, Senir Business Systems Analyst, Sean MacRae, Business Systems Analyst,

3 GDPR Summary The Eurpean Parliament, the Eurpean Cuncil, and the Eurpean Cmmissin intend t strengthen and unify data prtectin fr individuals within the Eurpean Unin (EU) It als addresses the exprt f persnal data utside f the EU The primary bjective is t return cntrl f persnal data t citizens and t simplify the regulatry envirnment f internatinal business It applies t any entity prcessing data abut EU residents, wherever that entity is lcated in the wrld

4 Data Cntrller vs. Data Prcessr Data Cntrller the entity that determines the purpses, cnditins, and means f prcessing persnal data Data Prcessr prcesses persnal data n behalf f the Data Cntrller Under these terms, The Publisher, Sciety, r Jurnal is the Data Cntrller (Jurnal staff implement Data Cntrller plicies) Aries Systems Crpratin is a Data Prcessr

5 Key Changes vs. Data Prtectin Directive Applies t all cmpanies prcessing persnal data f EU residents regardless f the cmpany s lcatin Organizatins in breach f GDPR can be fined up t 4% f annual glbal turnver r 20 millin (whichever is greater) Cnditins f cnsent have been strengthened cmpanies can n lnger use illegible terms and cnditins full f legalese Cnsent must be clear and distinguishable and prvided in clear and easily accessible frm Cnsent must be as easy t withdraw as t give

6 Persnal vs. Sensitive Persnal Data Persnal Data Any infrmatin relating t an identifiable persn wh can be directly r indirectly identified in particular by reference t an identifier Sensitive Persnal Data The special categries include medical r genetic data, and bimetric data where prcessed t uniquely identify an individual Additinal safeguards are required fr such data

7 Persnal Data Must Be... Prcessed lawfully, fairly and in a transparent manner in relatin t individuals Cllected fr specified, explicit and legitimate purpses Adequate, relevant and limited t what is necessary Kept in a frm which permits identificatin f data subjects fr n lnger than is necessary fr the purpses fr which the data are prcessed Prcessed in a manner that ensures apprpriate security f the persnal data using apprpriate technical r rganizatinal measures (Aries, as Data Prcessr, prvides this while in EM)

8 Data Subject Rights Right t Access Clear Cnsent Right t be Frgtten Data Prtability Privacy by Design Data Prtectin Officers Breach Ntificatin

9 Right t Access Data subjects have the right t btain cnfirmatin frm the Data Cntrller as t whether persnal data abut them is being prcessed, where, and fr what purpse The Data Cntrller shall prvide a cpy f the persnal data, free f charge, in an electrnic frmat GDE and reprts allw this via tab-delimited text frmats This is a dramatic shift t data transparency and empwerment f data subjects

10 Clear Cnsent Cnsent shuld be given by a clear affirmative act establishing a freely given, specific, infrmed and unambiguus indicatin f the data subject's agreement t the prcessing f persnal data relating t him r her Cnsent can be given by a written statement, including by electrnic means, r an ral statement. This may include ticking a bx when visiting an internet website The data subject shall have the right t withdraw his r her cnsent at any time. It shall be as easy t withdraw cnsent as t give it.

11 Als knwn as Data Erasure Right t be Frgtten Entitles the data subject t have the data cntrller erase r annymize his/her persnal data and cease further disseminatin f the data May require that third parties halt prcessing f the data The cnditins (per Article 17) include that the data is n lnger relevant t its riginal purpse if a data subject withdraws cnsent Data Cntrllers are required t cmpare data subjects rights t the public interest in the availability f the data Authr and Reviewer details may need t be retained fr use in ptential scientific fraud cases

12 Data Prtability Data subjects have the right t receive the persnal data cncerning them in a cmmnly used and machine readable frmat Data subjects have the right t transmit their persnal data t anther Data Cntrller

13 Privacy by Design Privacy by Design has existed as a cncept fr years but is nly nw part f a legal requirement with the GDPR It calls fr the inclusin f data prtectin frm the nset f designing systems, rather than as an additin Per Article 23, the Data Cntrller can hld and prcess nly the data that is abslutely necessary fr the cmpletin f its duties Access t persnal data is limited t thse needing t perfrm the prcessing. This is handled via RleManager permissins that limit Editr access t assigned submissins nly, Reviewer blinding, etc.

14 Data Prtectin Officers The appintment f a Data Prtectin Office (DPO) is mandatry when mnitring data subjects n a large scale r f special categries f data, i.e. criminal ffenses The DPO must have expert knwledge n data prtectin law and practices The DPO may be a staff member r external service prvider They must be prvided with apprpriate resurces They must reprt directly t the highest level f management They must nt carry ut ther tasks that result in a cnflict f interest

15 Breach Ntificatin Mandatry where breach is likely t result in a risk fr the rights and freedms f individuals Ntificatin t the data subjects must cme within 72 hurs f first becming aware f the breach Data Prcessrs must ntify their custmers, the Data Cntrllers, withut undue delay

16 Hw des EM supprt Publishers with the GDPR?

17 Key Existing Design Features Existing design restricts access apprpriately by Rle Use Rle permissins t restrict access t persnal data t apprpriate users Restrict View and Edit Peple permissins Restrict Search Peple Restrict View All Submissins, use Search Only Assigned Submissins GDE and Custm Reprts allw exprt t CSV a cmmn interchange frmat (Data Prtability) Reprting Permissins are brad Restrict t key persnnel Publishers can restrict admin rights

18 Cnsent and Right t Access Users typically chse t self-register n an Editrial Manager site Aries is implementing functinality t prevent users frm being prxy-registered withut being ntified This functinality applies where the prxy-registratin is likely t be the pint-f-entry int the Publisher s systems Users can view their peple-related infrmatin at any time, by lgging int an EM site

19 Right t Access Update My Infrmatin

20 Cnsent New Frced Registratin Questin New Frced Registratin questin t cnfirm that users have reviewed the Privacy and Data Use Plicies frm the Publisher and Aries When users agree t the questin, the date/time and IP address is stred in their Peple table recrd

21 Cnsent Prxy Registratin Users need t be ntified when they have been registered in EM Currently, new users can be prxy registered in ne f the fllwing ways: Prxy Register New User Register and Select New Reviewer Register and Invite New Authr Reviewer Discvery EM-t-EM Submissin Transfer fr publicatins that are nt in a Peple Sharing Grup

22 Mandatry Ntificatin f Prxy Registratin New prxy registratin restrictins are enabled at upgrade t versin15.0: The Register User and D NOT Send Letter buttn is suppressed and the Editr must enter an address The new user is prxy registered but is set t INACTIVE until the Prxy Register New User letter is sent The prxy registered user s recrd is deleted during the nightly Batch jb if they are still INACTIVE, i.e. have nt been sent a letter Prxy registratin that ccurs fr Reviewer Discvery sends the Prxy Register New User letter. If the candidate des nt have an address, they cannt be selected as a Reviewer

23 Right t be Frgtten / Data Erasure New fter text will be added t all letters sent frm EM/PM/CM in versin 15.0 The fter will direct users t cntact the Jurnal Office if they wish t request that their infrmatin be remved / annymized Aries will prvide guidance regarding the steps t annymize the user s data Additinal functinality will be added in versin 15.1 t include an embedded hyperlink in the fter Clicking the link will send a letter t the jurnal ffice t ntify them f the user s request t be remved. The jurnal ffice will see a new buttn n the Search Peple Update Infrmatin page Clicking the new buttn will annymize the user s data. An ptin t retain the user s Given Name and Surname will be available fr cases where the user s Reviewer r Editr Rles are still relevant

24 Right t be Frgtten / Data Erasure (EM Versin 15.0)

25 Right t be Frgtten / Data Erasure (EM Versin 15.1)

26 Right t be Frgtten / Data Erasure (EM Versin 15.1)

27 (EM Versin 15.1)

28 EM and GDPR Cmpliance Right t Access/Data Prtability Clear Cnsent Right t be Frgtten EM users can access their infrmatin at any time by lgging int a site where they are registered. Admins can supply data via GDE Mandatry Registratin Questin Can n lnger be prxy-registered withut ntificatin New fter text is added t all EM s 15.0 users cntact the JO and infrmatin is annymized manually 15.1 users click link and the JO clicks buttn t annymize autmatically

29 EM and GDPR Cmpliance Privacy by Design Data Prtectin Officer Breach Ntificatin Aries develpment fllws best practices with regard t data prtectin and privacy Aries Data Prtectin Officer can be reached by sending an t privacyfficer@ariessys.cm In the event f a detected data breach, Aries Client Services will ntify Publishers

30 Why wait? Aries can already turn n enfrced prxy ntificatins fr individual jurnals Yu can set up yur wn Frced/Required Registratin Questins fr cnsent Yu can set up a Custm Merge Cde t insert instructins/cntacts fr requesting remval Yu culd cnsider restricting the ability t prxy register new reviewers Yu shuld review Editr permissins, cnsidering wh shuld be able t: View every submissin in the system Search the entire peple database Generate reprts and ptentially exprt bulk data

31 What are the Publisher s Respnsibilities?

32 Data Use and Privacy Plicy Publisher Respnsibilities EM will include links t the Data Cntrller s Data Use and Privacy Plicy; this is yur pprtunity t explain hw user data will be used/transferred during the publishing prcess Publishers must prvide Aries with a URL/URI fr their Data Use and Privacy Plicy Data Lads Publishers and/r Jurnals are respnsible fr ntifying data subjects that they have been registered via a Data Lad Data Prtectin Officer Larger Publishers may need t identify a Data Prtectin Officer The Publisher must ntify Aries f the DPOs Cntact Details (in the event f a data breach)

33 Questins Publishers are encuraged t cntact their apprpriate legal representatives with any questins r cncerns Aries Systems Crpratin des nt represent its interpretatin f GDPR requirements as being definitive with respect t the Data Cntrller s bligatins under the GDPR.

34