IRMS Bulletin 202

THE INTERACTIVE HUB OF THE INFORMATION WORLD · ISSUE 202 · MARCH 2018 · £10.00

GDPR compliance We’re going to need a bigger boat Page 15

12

18

07

33

Running a GDPR project –Practical step by step guide

GDPR and FOI: How will GDPR affect the administration of Freedom of Information?

GDPR SPECIAL

How the GDPR supports better information sharing

Information Asset Registers; what are they good for? Absolutely… everything

Introducing the

IRMS Record Retention Wiki

Visit www.irms.org.uk/wiki to join and get involved

bu etin march 2018 in this issue...

2

Who’s who

3

From the Chair

4

IRMS news

45

Industry news

61

Diary dates

64

New members

GDPR building blocks 31 Data Protection Impact Assessments: Simpler and safer... Oliver Morley and Emily Meredith 33 Information Asset Registers; what are they good for? Absolutely... everything Emily Overton 35 How long is a piece of ROPA? Scott Sammons

GDPR is coming 7

12

GDPR and FOIA: How will GDPR affect the administration of Freedom of Information in public authorities? Paul Gibbons Running a GDPR project – Practical step by step guide Dominga Leone

15

GDPR compliance: We’re going to need a bigger boat Joe Chapman

18

How the GDPR supports better information sharing Lauri Almond

20

24

Personally thinking about new international IM standard: Protection and use of personal information, ISO/IEC 27552 Alan Shipman GDPR – sorting the fact from the fiction Elizabeth Denham

37 Fun with processor clauses Ed Boal 41 The GDPR and consent interfaces: A technician’s view Dale Smith

Legislation 43 MiFID II Compliance – Understanding New Expectations for Preserving Website & Social Media Records Pagefreezer

Records management 46 A case study in activating improvement: a lean approach to file shares Alison Winning

Group reports IRMS Public Sector Group GDPR events Sarah Graham 58 September 60 December

INFORMATION AND RECORDS MANAGEMENT SOCIETY 1

Information and Records Management Bulletin Issue 202 · March 2018

Bulletin Editor Catherine Burton, Tribal St Mary’s Court, 55 St Mary’s Road, Sheffield, S2 4AN Tel: 0114 281 6100 e-mail: catherine.burton@tribalgroup.com Production Editors Roy Webb, Tassell Design roy@tasselldesign.co.uk Paul Duller AMIRMS FIRMS, Tribal paul.duller@tribalgroup.com Publisher Information and Records Management Society® Chester House, 68 Chestergate, Macclesfield, Cheshire. SK11 6DY Tel: 01625 664520 www.irms.org.uk IRMS Executive Committee Scott Sammons CIPP/E, AMIRMS, Chair chair@irms.org.uk Emily Overton AMIRMS, Vice-Chair vice.chair@irms.org.uk Fiona Kearney AMIRMS, Secretary secretary@irms.org.uk David Bowen, Treasurer treasurer@irms.org.uk Reynold Leming AMIRMS, Conference Director conference@irms.org.uk Jane Proffitt FIRMS, Groups Director groups@irms.org.uk Neil Reeves AMIRMS, eDirector edirector@irms.org.uk Joe Chapman, Marketing Director marketing@irms.org.uk Shona Dunning FIRMS, Membership Director membership@irms.org.uk Roger Poole AMIRMS, FIRMS, Private Sector and Commercial Development Director pscd@irms.org.uk Sarah Norman, Training Director training@irms.org.uk IRMS Officers Paul Finnis, Information Officer informationofficer@irms.org.uk Melody Allsebrook AMIRMS, Groups and Volunteers Officer groups-officer@irms.org.uk Harvey Burgess and Chris Manson AMIRMS, Commercial Development Officers cdofficerharvey@irms.org.uk cdofficerchris@irms.org.uk Jessica Waite, Communications Officer communications@irms.org.uk

2 BULLETIN 202 · MARCH 2018

IRMS Group contacts Ireland · Chris Manson ireland@irms.org.uk Isle of Man · Rupert Leaton iom@irms.org.uk London · Bilal Ghafoor and Nicola Last london@irms.co.uk Midlands · Jaana Pinnick midlands@irms.org.uk North · Suzy Taylor north@irms.org.uk Scotland · David Paris scotland@irms.org.uk South West · Andrea Binding southwest@irms.org.uk Wales/Cymru · Patrycja Duszynska AMIRMS wales@irms.org.uk Financial Services Group · Kate Javes financial@irms.org.uk Higher Education & Further Education · Fraser Marshall & Sam Mansfield hefe@irms.org.uk Property · Jamie MacDonald property@irms.org.uk Public Sector · Elizabeth Barber AMIRMS, FIRMS psg@irms.org.uk SharePoint Practitioners Group · Melody Allsebrook AMIRMS & Michele Noad AMIRMS sppg@irms.org.uk Third Sector · Gary Shipsey thirdsector@irms.org.uk How to join the IRMS Go to www.irms.org.uk/join How to contribute Copy to the Editor catherine.burton@tribalgroup.com by 15 March for May 2018 issue; and by 15 May for July 2018 issue.

Published bi-monthly in January, March, May, July, September and November.

ISSN 2045-6581 Printed by PK In-Print Ltd, tel: 01494 452266 The Bulletin provides a wide spectrum of opinion on information and records management matters: the views of the contributors do not necessarily reflect the views of the Information and Records Management Society®.

from the chair with Scott Sammons · IRMS Chair

Great Scott!! It’s less than 2 months until our annual conference; for the very last time in Brighton (well, the Hilton Metropole at least). While it has been our home for a number of years, it is time to look to the future.

So, if you’ve seen the agenda, you’ll know we have a packed and diverse range of topics this year. Looking back at the best examples of good information and records management practice, but also looking forward to see what innovation is coming and, indeed, what the future may hold post General Data Protection Regulation (GDPR) enforcement date. Will GDPR dominate the agenda on everyone’s lips for the next few years while it beds in, or is now the time to look at Blockchain and other digital technologies on the rise? Come along and find out!

Something we are also trialling this year is having the IRMS annual general meeting (AGM) on the Sunday, rather than the Monday before the Gala Dinner. There are various reasons for this, both from our own thinking and from feedback from our membership surveys. Our aim is to make the AGM less time constrained and easier to access for those that cannot attend the conference or take time out from work to attend on a Monday afternoon. The AGM will now be on the Sunday of the conference at 16:30, at which all members are very welcome.

You may have noticed some changes going on to the website. I am pleased to say that our work to migrate content from the old website is proceeding at pace, with further work to see what other content and resources we can develop to help our members and the profession. You’ll also notice a new section looking at collating resources for members (and the public) around GDPR. We also have two records management toolkits due

out soon (but shhhhh, it’s a secret), so watch this space. If you have any suggestions for new content or guidance that other members could benefit from, please email me and I can pass it on to the content working group.

If you’ve not been to a regional group event before, I do encourage you to go. I appreciate that everyone’s circumstances are different and not everyone can, but if you’ve wanted to, but were a little unsure, please do come along. As Chair, I have travelled to most of the group events as best I can and I’ve found them all very welcoming places. It’s now ever easier to interact with our groups and book onto your local event. Through your membership online, you can join in the discussions online, as well as register to attend an event. With GDPR upcoming, as well as other developments in areas, such as Office 365 and Brexit, take a look at the groups areas on the website, join in the discussion and feel free to share your ideas.

On the subject of change, you may also have noticed a subtle change in the format of this Bulletin and that of our May edition to come. As part of our top to bottom review of costs, the Exec are running a pilot exercise to simplify the layout of the bulletin and reduce the costs of production, where it makes sense to do so. We plan to seek feedback on this both by email and at the conference to see what you think and if it is something we want to do for all future Bulletins. If you have any thoughts or comments you’d like to feedback, please email us at <communications@ irms.org.uk>.

INFORMATION AND RECORDS MANAGEMENT SOCIETY 3

irmsnews #IRMS18

There’s still time to register for the IRMS conference, this year includes another packed programme of inspirational speakers, lively discussions and unbeatable networking opportunities, centred around the latest thinking.

The 2018 theme is Back to the Future - From Best Practice to Innovation, over the three informationpacked days the topics will include: • General Data Protection Regulation (GDPR) • Office 365 • Automation • The future of IRM • SharePoint • Change management • Cybersecurity • Sustainability

march 2018

GDPR compliance. Previously, Louise was the ICO’s Head of Good Practice, responsible for the delivery of a programme of audits and advisory work aimed at educating and assisting organisations to meet their data protection obligations.

David Bowen – Audata Ltd David Bowen started his working life as a research chemist and then created so much information that he had to learn how to manage it. Since 1994, he has worked in formal information governance and management – building digital archives, implementing software solutions, and teaching courses in information management and information governance.

Elizabeth Lomas – Senior Lecturer, Information Governance, University College London Elizabeth Lomas is a Senior Lecturer in Information Governance at University College London. Her research takes her around the globe working with practitioners and academic. She is passionate about the need for records management professionals to drive and influence the research agenda. She has recently focused on the research needs for the digital evidence base (RecordDNA <https:// recorddna.wordpress.com/>) and developing tools to aid the navigating of information management and compliance challenges for society and business. She is currently developing an information governance maturity model as part of the work of the international InterPARES Trust. Elizabeth has particular expertise in information rights law and its application in practice. She undertakes smallscale consultancy projects and currently these are increasingly focusing on GDPR. She is a member of the Advisory Council on National Records and Archives and the Deputy Chair of the Forum on Historical Manuscripts and Research. Elizabeth was honoured to be one of the original cohort of IRMS fellows established in 2013.

Louise Byers – Head of Risk and Governance, ICO Louise Byers is the Head of Risk and Governance at the Information Commissioner’s Office (ICO), and the designated Data Protection Officer. She has a wide range of responsibilities, including running the Commissioner’s Private Office; the ICO’s GDPR implementation programme; and leading the Records and Information Management team, including delivering the ICO’s own preparations for

Other speakers include: Joanna Badrock - Corporate Records Manager, House of Lords Joanna is a Corporate Records Manager in the Information and Records Management Service at the House of Lords. As well as working on the Office 365 rollout, she leads on Record Officer communications for the team. Joanna previously worked as an archivist at the British Library, Harrow School and the Manchester Grammar School.

Keynote speakers for 2018

Below we have highlighted a small selection of speakers that will present at IRMS18:

4 BULLETIN 202 · MARCH 2018

Elizabeth Barber – Records Manager, Kent County Council Elizabeth Barber has been Records Manager for Kent County Council (KCC) since 1993. Originally qualifying as an archivist in 1987, Elizabeth spent the early part of her professional life helping to sort out records belonging to the GLC post abolition.

Elizabeth is now responsible for developing and implementing all aspects of corporate information and records management strategy to ensure that KCC’s recordkeeping systems are compliant within the current legislative frameworks. This includes maintaining the retention schedule and information asset register. Elizabeth was responsible for creating the Records Retention Tool which can be found in LG Inform Plus. Elizabeth’s most recent project has been managing the records management aspect of the re-let of the records management storage contract, including the safe transfer of 70,000 boxes between external storage providers. Elizabeth is an accredited member and Fellow of the IRMS and has been a Chair of the IRMS Public Sector Group since 2003. Elizabeth was the recipient of the IRMS Lifetime Achievement Award for Records management in 2009.

For the full line up, visit <http://www. irmsconference.org.uk/2018-speakers/>.

To reserve your place, which can include accommodation, visit the dedicated website: <http://www.irmsconference.org.uk/>.

IRMS Awards The IRMS Awards nominations took place in February; the main award categories were: • Professional of the Year • New Professional of the Year • Team of the Year • Supplier of the Year • Innovation of the Year Other awards: • Tribal Bulletin Content Award – also known as ‘Author of the Year’, this is presented to the best contributor to the IRMS Bulletin each year, as judged by the Bulletin Editorial Team.

• Lifetime Achievement Award – awarded to an information professional who has achieved distinction over the length of their career.

• Special Award – an occasional award for excellence made at the discretion of the Executive Team.

The IRMS also confers Fellowships and Honorary Life Memberships to individuals deemed deserving of these honours.

Nominations were received for those who have performed to the highest level, especially over the past year, or over a number of years, leading to particular achievements or milestones over the past 12 months. The awards will be presented at our glittering Gala Dinner, as part of the IRMS Conference at the Hilton Brighton Metropole on the evening of Monday 21 May 2018. More information can be found on our website: <http:// www.irms.org.uk/2018awards>.

Executive Nominations 2018 Nominations for posts on the Executive for the year 2018–19 ran until 05 March 2018. Detailed information on the nominations process, role profiles and governance of the IRMS can be found in the IRMS Constitution. As you will know, IRMS is run and led by volunteers, from running our regional group events, right the way through to our Chair as a member of the Executive Committee of the Society. You can find out more information about the work of the Committee and the Society from our annual reports, which can be found on the IRMS website.

The posts up for nomination this year were: • Chair (1-year term) • Vice-Chair (1-year term) • Director, with the remit of Digital (2-year term) • Director, with the remit of supporting our Groups (2-year term) Elections will take place where they are required.

In accordance with the Constitution, these will take place in the 8 weeks leading up to the AGM. (The AGM will be at 16:30 on 20 May 2018 at the Hilton Brighton Metropole.)

IRMS news continues overleaf >>>>> INFORMATION AND RECORDS MANAGEMENT SOCIETY 5

IRMS news continued >>>>> We are sad to announce that Jane Proffitt, Groups Director, has stood down from her role. We would like to thank Jane for all of her hard work and dedication to the Society over the years. She will be duly missed; we wish her well for the future and she will hard to replace. <http://irms.org.uk/page/2018execnominations>

Book Swap Shop

The Swap Shop forum has been created with the purpose of our members being able to swap items that may no longer have need for and which could aid someone’s learning or career eg books and study guides. The forum is only available to members who are signed in, so sharing of personal details should be safe; however, when it comes to address swapping, may we suggest you

6 BULLETIN 202 · MARCH 2018

use direct messages for that. We hope you enjoy this new member benefit. The Swap Shop currently has a number of books available for swapping, so log onto the forum for more info and to get involved. <http://www.irms.org.uk/swapshop>

Membership survey

The survey has now closed; the results will be presented in the May edition of the Bulletin.

The survey results will be invaluable in assessing what members think about the services and benefits we offer, and will shape how we improve in 2018 and beyond. Thank you to all those who took part and congratulations to Emily Gresham, who was the prize winner of the £50 gift voucher in our prize draw!

GDPR and FOI Act: How will GDPR affect the administration of Freedom of Information in public authorities?

Paul Gibbons

P

ractitioners across the UK are busy preparing for the General Data Protection Regulation (GDPR). Those working in public authorities will very likely also be responsible for managing compliance with another information-related law â&#x20AC;&#x201C; the Freedom of Information (FOI) Act. FOI Act, which has now been in force for 13 years, gives anyone the right to ask public authorities to provide information they hold.

Many of those reading this article will be familiar with their obligations under the legislation.

Preparations for GDPR will include identifying the processes that involve the handling of personal data, and gaining a full understanding of the ways in which that data is used. Some of those processes are obvious and high profile. Providing health or social care involves the collection and handling of potentially very sensitive information about individuals. The assessment and payment of benefits; enrolment of students by schools, colleges and universities; and recruitment and management of employees are all further examples of processes that will already have been identified by public authorities as needing attention in their preparations for this May. >>>>>

7

>>>>> What practitioners might have forgotten is that in meeting their FOI Act obligations they will also be handling personal data. Just as with those other, more obvious, processes, they will need to assess what personal data is collected, whilst administering requests for information. They will also need to ensure that their handling of that data is consistent with the data protection principles, and that they can justify its processing by reference to the lawful conditions set out in article 6.

Justify what you do with applicants’ data At first sight, it appears obvious how the processing of applicants’ data can be justified. Public authorities are legally obliged

8 BULLETIN 202 · MARCH 2018

to answer FOI Act requests, so the collection of applicants’ data to answer requests is a process “necessary for compliance with a legal obligation to which the controller is subject” (Art. 6(1)(c)).

If applicants’ data – their name, address and the information requested – is recorded purely to facilitate a response to their request being provided, then this of course provides sufficient justification.

Anyone who is responsible for managing FOI Act requests will, with a few moments of reflection, be able to list a number of other ways that applicants’ data are used.

None of the following are necessary to meet the basic legal obligation set out in the FOI Act.

• Routinely sharing the identity of the applicant with colleagues, even where they will not be responding directly; • categorising applicants (eg journalist, campaigner, private individual); • ‘flagging’ particular applicants for special treatment (eg notifying the Press Office that a request has been received from a journalist); • using search engines to look up applicants; or • discussing ‘round-robin’ requests with other practitioners or authorities.

in the controller”. This presents other challenges – individuals have the right to object to processing on this basis under article 21.

Ensure you meet the data protection principles The above activities will also need to be consistent with the principles. In particular, public authorities will need to be transparent about them by providing information to applicants and potential applicants. They will need to minimise the data that they collect and the circumstances in which they do so – as suggested above, it will be difficult to Each of these activities can be justified in specific justify carrying out all of these activities routinely. cases. Where it is suspected that a request is They will need to limit how long they keep vexatious, it may be necessary to discuss the applicant data for, and keep identity of the applicant with a it securely. The principles will specific service area to establish Perhaps the most also apply to the handling of the wider context, for example, important principle in personal data that might need whether the requests are to be collected together to part of a wider campaign of GDPR – certainly the answer a particular request. harassment by an individual. one that distinguishes An argument can be made Perhaps the most important that there is a public interest in the regulation from its principle in GDPR – certainly press officers being prepared predecessor – is the the one that distinguishes the to present the authorities’ side accountability regulation from its predecessor of any potential story that a – is the accountability request may unearth. Similarly, principle. principle. Not only is it there will be occasions where important for authorities to it will be appropriate for public ensure that their FOI Act processing complies authorities to compare notes on a request that with the other principles; it is essential now to has been sent to multiple authorities. It might be document how this is being done. If practitioners that such discussions will unearth the potential for have given thought to how they will ensure that the applicant or others to piece together sensitive principles and conditions are met, they should information through a ‘jigsaw’ effect that might ensure that this is reflected in FOI Act procedures not otherwise have been obvious to individual and guidance. practitioners. It might even lead to authorities disclosing information that before consultation Does this really matter? with colleagues they would have been nervous If this sounds abstract, let’s consider some realto release. None of these activities are inherently world examples. In 2016, journalist Matt Burgess wrong. discovered that his name and details of his FOI Act requests were being shared with hundreds of staff However, as part of public authorities’ preparations across central government departments. He raised for GDPR, they will want to carefully consider the concerns with the Information Commissioner’s various ways in which applicants’ data are used and Office who indicated that: decide which of the conditions at article 6 can be used to justify them, and in which circumstances. “... we are not satisfied that the current The most likely condition in many cases will be arrangements satisfy the ‘first principle’ requirement Art. 6(1)(e) that the “processing is necessary for set out in Paragraph 2 of Part II of Schedule 1 of the performance of a task carried out in the public the [Data Protection Act 1998] ... “ >>>>> interest or in the exercise of official authority vested

INFORMATION AND RECORDS MANAGEMENT SOCIETY 9

>>>>> had not been removed before the information was They added: sent out.

“We do not consider the general public sufficiently aware of the [Cabinet Office]’s circulation of the Accidental disclosures of data under FOI Act Round Robin list for it to be presumed that all are data breaches. Given the significantly higher requestors whose details are included on the sanctions under GDPR, Round Robin list are going to practitioners would do well to be aware of the Round Robin Meeting FOI Act ensure that their disclosure list and the possibility that their procedures include suitable details may be both passed obligations involves approval measures. to the [Cabinet Office] by handling personal the public authority to whom data, sometimes in Conclusion they made their request, and then be added to the Round significant quantities. Meeting FOI Act obligations involves handling personal Robin list to then be circulated data, sometimes in significant around particular public quantities. This means that FOI Act processes authorities.” will need to be taken into account in GDPR preparations. Practitioners need to consider: Under GDPR, there is even more of an emphasis • what applicants are told about how their personal on transparency than under the Data Protection data will be used in the handling of their request Act. It is therefore essential to give thought to how – there should be no nasty surprises; applicants can be informed of activities that they • whether all current processing of applicant data is would be unlikely to expect. necessary, and if it is, whether it can be justified; • what precautions are in place to ensure that the It is possible to have too much bare minimum of data is recorded and shared transparency. In 2013, the London about applicants, that it is kept no longer than Borough of Islington received a monetary necessary, and that it is kept securely; penalty of £70,000 from the Information • what safeguards are in place for handling Commissioner’s Office after a and disclosing personal data collected to spreadsheet was sent out in answer answer FOI Act requests; to a FOI Act request. Unfortunately, • whether colleagues understand their the spreadsheet had a pivot table obligations when handling FOI Act requests; containing the personal data of • how compliance can be evidenced.

Islington residents, which

The Author Paul Gibbons is an independent trainer and consultant specialising in FOI Act, GDPR and records management.

<www.foiman.com>

10 BULLETIN 202 · MARCH 2018

Apply for IRMS Accredited Membership AMIRMS â&#x20AC;&#x201C; Accredited Member of the Information and Records Management Society. The benchmark of information and records management excellence.

Show employers and clients that you meet the standard www.IRMS.org.uk/accreditation

INFORMATION AND RECORDS MANAGEMENT SOCIETY 11

Running a GDPR project: Practical step-by-step guide Dominga Leone

S

Step 1: Records of processing activities tart by documenting your records of processing activities; they are a key deliverable of the General Data Protection Regulation (GDPR) and must be provided to the supervisory authority on request, but they also act as a perfect basis for your planning.

Use the purpose of processing as the basis for the template and everything will grow organically from there. Make sure you don’t have too many purposes of processing. I recommend trying to keep it to under 30, but ideally under 15.

If you are sending templates to business people to complete, then make the templates in advance and use drop-downs for most elements. It requires

12 BULLETIN 202 · MARCH 2018

some upfront work, but it is beneficial in many ways. It helps because: • The business will not feel overwhelmed and they will complete it more easily • You will have consistency in response • It requires fewer hours/days analysis and you will be able to summarise it more easily • No doubt you will have to be willing to allow the template to develop, but this approach works really well Although not part of the records of processing requirement, I usually ensure my records of processing template capture an element of high-level data flows, volumes of data processed and an assessment of whether there are any high-risk elements. This will be removed from the final document issued to the Information

Commissioner’s Office (ICO) if they request it, but it is information that will help assess whether a data protection impact assessment (DPIA) is required and also help prioritisation later on. Finally, at this point, I also capture third-party names (rather than just categories) because I will need them later. I don’t capture retention periods now, unless I think the businesses are already exactly where they need to be with this aspect.

When I issue these templates, I usually run workshops or web meetings to demonstrate how to complete them and work through any concerns. In my view, getting this bit right is the most important part of the project, if you want it to run smoothly.

Step 2: Define your lawful bases for processing Now you have completed a first draft of your records of processing, you will be aware of all your purposes of processing. Assign a lawful basis to each of these, but remember that the lawful basis will differ, depending on whether or not you are processing special categories of data or criminal convictions.

Choose your lawful basis wisely, ensuring they are the right ones; each lawful basis will have a different operational impact because they affect which data subject rights can or can’t be fulfilled. For example, in the (unlikely) event you are deciding whether to use legitimate interests or performance of a contract as your lawful basis for processing, consider that for legitimate interests you will need the tools to assess and execute objections to processing, but the data would not be in scope for a portability request. If you choose the performance of a contract, the data will be in scope for portability, but you won’t need the tools to handle an objection to processing.

If you find you do not have a lawful basis for any of your purposes of processing, you should stop that processing or seek to anonymise it. If it is the special categories that are stopping you from having a lawful basis, consider whether those special categories are imperative. Define any requirements arising from this activity.

Step 2a: Legitimate interest assessments Next, ensure you undertake and document legitimate impact assessments (aka the balancing

test) for all purposes you choose to use legitimate interests as a lawful basis for. If you find that your legitimate interests do not outweigh those of the data subject, then go back to step 2.

Step 3: Data protection impact assessments (DPIAs) Undertake DPIAs for areas where you identified risks when you did your records of processing – remember DPIAs are only needed where there is a high risk to the rights and freedoms of data subjects; the Article 29 Working Party has issued some helpful guidance on this. Also, document your DPIA process (outlining how to assess when it is required and how to do it) and review schedule.

On the DPIA itself, document a mitigation plan and separate solution requirements for risks identified, including consideration for third-country transfers.

Step 4: Data subject rights and consent management Assess which data subject rights apply to your business: you can gauge these by looking at which lawful bases for processing you are reliant on and listing which data subject rights align to them. For example, subject access requests will apply to most organisations, but portability only applies to organisations using performance of a contract and consent, so you don’t have to prepare for portability, unless you are using a lawful basis affected.

Develop processes for your data subject rights and consent management and, where applicable, define solution requirements. You will have gauged volumes and risks from the previous steps, so you will be able to prioritise accordingly. As part of this activity, don’t forget special consideration for minors, SLAs and the ability to demonstrate compliance – everything the business does should have an audit trail and reporting. Your documentation should also define where you will be reliant on third parties to help fulfil these rights, as well as internal and external training needs.

Step 5: Breach framework Define your breach framework. You need to be able accommodate the tight timeline for reporting a breach, so you must have the right processes to support this, including channels for breaches to >>>>> INFORMATION AND RECORDS MANAGEMENT SOCIETY 13

>>>>> be reported, a plan for quick assessment, people responsible for swiftly coordinating the escalation and response, templates for contacting the supervisory authority, just to name a few. I think this framework should look similar to a disaster discover/business continuity plan.

Step 6: Record retention Define your retention periods based on a maximum time you will keep data, rather than a minimum. The GDPR sets out requirements for data minimisation and storage limitation, but does not give you the periods. In order not to make this too complicated, it is best to base retention on your purposes of processing, flagging exceptions only if necessary. Don’t dream of defining it by data field. Update your records of processing with the retention periods or logic.

Next define the requirements for a process or tool to erase or anonymise this data at the end of the retention period. You could arguably do this part quite early on without yet having retention periods, but the benefit of waiting is that your solution requirements identified as part of your data subject rights will be similar to some of the requirements here, so it then makes a better case for investing in a solution.

Step 7: Fair processing notices and privacy policies Prepare your fair processing notices and privacy policies based on the information you gathered by completing your records processing, lawful basis for processing and retention records. Decide how you are going to make these available to your data subject at the time you collect their data. Regardless of the channel, you should opt for layers of information, so the data subject can delve to the level of detail that suits them (consent must always be upfront), don’t forget to consider minors. You will also need to document any requirements for third-party responsibilities.

Step 8: Solution options Now you will have solution requirements gathered from the activities above. You can pass these to your technical team, but first supplement them with any additional requirements from GDPR principles article 5 and privacy by design 14 BULLETIN 202 · MARCH 2018

and default, article 25. IT can start investigating solutions.

Step 9: Third parties In the meantime, start serious discussions with third-party partners, ensuring they will fulfil everything you have identified above. It is ok to talk to them before this point, but the discussion won’t be meaningful, unless you have a good understanding of your needs. Third-party discussions will be supplemented by contract changes, so you will need to draw these up, along with data processing agreements. If you rely on third-party applications, you would pass on your solution requirements.

Step 10: Governance framework Document your governance framework, including roles and responsibilities of the Data Protection Officer (DPO) and any support team. Here you may identify resource needs for your future operating model. This step should also include the updating of company policies and reporting required to assess and provide evidence.

Step 11: Solution implementation Once you have a clear idea of solutions, work towards implementing them. Where solutions cannot be automated, revisit steps 4 and 5 to develop and embed manual processes, where possible.

Step 12: Training Document your training plans and material based on the information you captured to date, and roll out training.

Step 13: Run a mock breach exercise As per the title, and update the framework if there are issues.

Step 14: Start again Not quite, but plan to review all of the above regularly. GDPR is for life, not just for May.

The Author Dominga Leone is an Independent Senior Business Analyst and Project Management Consultant.

Dominga can be contacted at <dominga@domingale oneconsulting.co.uk >

GDPR compliance: We’re going to need a bigger boat Joe Chapman

T

he information management profession covers a broad spectrum of roles and issues, but right now it seems there’s only one show in town – the impending enforcement of the General Data Protection Regulation (GDPR). And, boy, it is quite a circus.

A casual search of Google, LinkedIn, Twitter and the like brings up countless self-proclaimed GDPR experts – whether they be vendors promising technological solutions delivering compliance with little or no effort, or so-called ‘certified GDPR practitioners’, whose credentials

appear to rest almost entirely on having passed a crash course that was probably sold to them on similarly dubious terms.

Look a little closer and you’ll see those who have actually worked in the field, since long before this latest bandwagon came along – done the hard yards, racked up the hours, studied the case law, delivered the training, and so on – trying valiantly to quell the mayhem and set the record straight.

You can follow much of the to-ing and fro-ing on social media using the hashtag #GDPRubbish.

Mostly, though, such efforts appear both admirable and in vain. >>>>>

A casual search of Google, LinkedIn, Twitter and the like brings up countless selfproclaimed GDPR experts.

INFORMATION AND RECORDS MANAGEMENT SOCIETY 15

>>>>> Though we may try to steer the conversation away from a focus on the maximum penalties for breaching the new GDPR, in the boardroom, money talks, and it’s not hard to imagine that it is those headline-grabbing numbers that have made senior execs sit up and take notice of data protection requirements in ways that they haven’t before. This isn’t ideal, but it’s a start.

It follows that those with the right contacts, an impressive-sounding resume and a smooth (or perhaps hysterical) sales pitch will find many a golden handshake in the resulting frenzy.

Of course, it’s important that we as a profession try to assert ourselves in the face of this onslaught.

However, there is an inherent danger of adopting a ‘holier than thou’ attitude that will hinder the achievement of our ultimate aim – the effective protection of personal data and of individuals’

Yes, the onset of the new GDPR is being exploited by some sharks for short-term, self-centred, commercial and financial gain.

16 BULLETIN 202 · MARCH 2018

privacy – by alienating those who genuinely seek to understand how to get it right, or to help others to do likewise, but who may make the odd misstep along the way.

If someone gives advice about consent that is mostly correct, but which ignores other lawful bases for processing, let’s make them betterinformed, not hammer them for misleading their audience.

If someone wants to prepare guidance that helps a layperson navigate the labyrinth of privacy law, let’s help them ensure that advice is accurate, not berate them for trying to override official sources.

Above all, if someone gets it wrong, let’s show them the right way, not shame them into submission.

The privacy profession must also open its doors wider than it has ever done before – the GDPR

may only be an evolution of long-standing data protection legislation, but its requirements are undoubtedly more onerous and will inevitably require more manpower, in 2018 and far beyond.

If organisations seeking to fill GDPR-related posts limit themselves to those with explicit data protection experience, they will never find enough people or – as in the case of the Information Commissioner’s Office (ICO) itself, among many others – offer sufficient incentives to entice and keep those with such sought-after skills.

In the words of Elizabeth Denham, information management is key to compliance… but that doesn’t mean compliance should be the preserve of information managers. We all know that engaging with the whole business is essential to our work, so perhaps there are others in the business who have something to offer, if given the opportunity to join us in our endeavours.

Here, I must declare an interest. I stumbled into the information profession when I had the good fortune to be recruited for a legislative compliance project by a manager who specifically sought to build a team with diverse and largely unrelated experience – no two people in the group had the same educational or career background and only one had ever done similar work before.

I can’t help feeling that there should, and probably will, be many similar cases around the country in the wake of the GDPR. Yes, the onset of the new GDPR is being exploited by some sharks for short-term, selfcentred, commercial and financial gain, but we must recognise that for many others it presents an attractive opportunity to work in what is a growth industry, with noble ideals and increasing relevance within wider society.

This status is something that we should be proud of and that we should embrace, pitfalls included.

But, if, on the other hand, we make our sector seem exclusive and distant, then that it is exactly what it will become. If we get bogged down in pedantry and mud-slinging, we will be doing ourselves and our work a disservice.

We mustn’t deter this new wave of information and privacy professionals. Soon enough, the storm will pass, the bandwagon will move on and the new regime will be bedded in.

Then, it will be left to those who really get it – and who really care about it – to sustain the momentum, to ensure that data protection remains a corporate priority, and above all to continue to meet the legislation’s exacting standards.

To avoid the Jaws of noncompliance, we’re going to need a bigger boat.

The Author Joe Chapman works in Information Assurance for Police Scotland with a specific focus on GDPR compliance, and is also the Marketing Director of the IRMS.

Joe can be contacted at <marketing@irms.org.uk>

INFORMATION AND RECORDS MANAGEMENT SOCIETY 17

How the GDPR supports better information sharing Lauri Almond

A

s we move ever nearer to ‘D-day’ for implementing the General Data Protection Regulation, or GDPR as it’s known (25 May 2018, in case you need a reminder!), I have been reflecting on the positives in the new legislation in regard to information sharing (yes, there are some, honest!).

I, like others, have experienced concern at the sheer volume of preparatory work to get into a fully (or even a ‘mostly’) compliant state. In an organisation the size of Essex County Council, this is particularly challenging. However, despite the continual scaremongering and creeping panic, I took the opportunity to step back and look at what the GDPR and the revised Data Protection Act can deliver in terms of supporting better information sharing.

In Essex, we have the Whole Essex Information Sharing Framework (WEISF) which is open to all organisations, irrespective of sector, to support lawful and ethical information sharing. With evershrinking budgets, information sharing is critical to achieving service transformation, bringing better outcomes and better use of funds. The Centre of Excellence has been a great source of support, as we develop and grow the framework, acting as critical friends and giving great insight into similar work in other areas. More detail can be found in their case study on the WEISF <http:// informationsharing.org.uk/clients/weisf/>.

18 BULLETIN 202 · MARCH 2018

I, like others, have experienced concern at the sheer volume of preparatory work to get into a fully (or even a ‘mostly’) compliant state.

So, why do I think GDPR will help, you might ask?

Well, one of the biggest barriers to information sharing is the varied levels of information management maturity with your various partners.

It is incredibly difficult to get best value from data, if you don’t know what data you have, and how

• Refreshed privacy notices required by the GDPR affords the opportunity to explain all of the purposes you wish to make of data (where you have an appropriate legal basis), and potentially expand these, eg, to include service improvement/evaluation/research/prevention and detection of crime and fraud. This then enables more data sharing in the future that is fair and fully compliant.

• Existing data-sharing protocols should be discovered as you carry out your data audit to compile your Records of Processing Activity, enabling better management and a central repository.

I understand that it looks like a mountain of work, and that is quite probably because it IS a mountain of work.

• The GDPR requires a deeper understanding of the conditions for processing, and this again will support better information sharing.

• Privacy Impact Assessments (PIAs), which are a legal requirement for high-risk processing, will help to embed their use into an organisation – I would recommend a PIA for any processing of personal data, as it really helps to identify risks.

• Greater focus on accountability underpins clearer responsibilities for Data Controllers and Data Processors and contract management.

you are currently using it, and what the gaps are that could be filled by information sharing. The requirements of the GDPR should help to deliver some of these outcomes by: • Article 30 – Records of Processing Activity. This combines your information asset register with information mapping to document what data you have and how you are using it and safeguarding it. Once this has been created, you will have visibility of how you use your data, and any potential gaps that could be filled by sharing data.

I could go on (and run the risk of sending you to sleep!), but it’s quite an impressive list as it is!

I understand that it looks like a mountain of work, and that is quite probably because it IS a mountain of work, but there is a clear pay-off down the line, as it better supports us to share information more easily and protect personal information, and that has to be a good thing, right?

The Author Lauri Almond, BA Hons (1st), Certified Data Protection Practitioner, FOI Practitioner, HCISPP, CISP.

Lauri can be contacted at <lauri.almond@essex.gov.uk>

INFORMATION AND RECORDS MANAGEMENT SOCIETY 19

Personally thinking about new international IM standard: Protection and use of personal information, ISO/IEC 27552 Alan Shipman

A

lmost every organisation stores and uses (processes) personal information, which can include names, addresses, contact details, and staff and medical records. The quantity of personal information is growing, too, as is the number of situations where organisations need to co-operate with others over personal information.

Protection of the privacy of the individual in the context of personal information use is a societal need, as well as the topic of dedicated laws and regulations all over the world.

As the quantities grow, the smaller newcomers, the small- to medium-sized enterprises (SMEs), for example, increasingly need guidance on how personal information should be managed to

The new international standard will guide organisations through management of personal information throughout its life.

20 BULLETIN 202 ¡ MARCH 2018

reduce risk of privacy breaches and the impact of such breaches on the organisations and the individuals concerned.

Requirements for the protection of personal information vary, depending upon the circumstances of the organisation, in particular, where national laws and regulations apply. The purpose of a new international standard, planned jointly by the International Standards Organisation (ISO) and the International Electrotechnical Commission (IEC), called ISO/IEC 27552 – Information Technology – Security Techniques for Privacy Management – Requirements (to give its full title), is to translate these requirements into practical advice.

The new international standard will guide organisations through management of personal information throughout its life. It will apply in as many countries as possible, addressing the

requirements with attention to local laws and regulations.

Standardisation work The ISO/IEC working group1 responsible for identity management and privacy international standards has been allocated this work. The group is a sub-group of the sub-committee responsible for standardisation of IT Security Techniques, ISO/ IEC/JTC1/SC27.

At its meeting in Tampa, Florida, USA, in April 2016, the working group discussed the possibility of linking the use of personal information, known by the committee as ‘personally identifiable information (PII)’, to information security. A draft proposal was produced, setting out how such a linkage could be achieved.

The work group decided that the project would take the form of an extension to the international standard on high-level information security management, ISO/IEC 270012. This standard is part of the family of standards providing requirements for an information security management system. Providing an extension will enable organisations that wish only to follow the wider security standard to do so, while those that wish also to follow the personal information protection standard will be supported.

This proposal was approved by ISO/IEC in June 2016. Work then began on an initial draft, and the reference number ISO/IEC 27552 was allocated.

The agreed scope of the new international standard was as follows: • This document specifies the requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS), in the form of an extension to ISO/IEC 27001 for privacy management within the context of the organisation.

• In particular, this document specifies PIMSrelated requirements for PII controllers and >>>>>

1

Formally entitled ISO/IEC/JTC1/SC27/WG5.

ISO/IEC 27001 Information technology – Security techniques – Information security management system - Requirements.

2

INFORMATION AND RECORDS MANAGEMENT SOCIETY 21

>>>>> PII processors holding responsibility and accountability of PII processing.

• This document is applicable to all types and sizes of organisations, including public and private companies, government entities and not-for-profit organisations, which are PII controllers and/or PII processors processing PII within an ISMS.

terms and core definitions as defined in the ISO management system model, such that compatibility with other ISO management system standards is maintained. This common approach will be useful for those organisations that choose to operate a single management system that meets the requirements of two or more management system international standards.

Why link with information security?

One of the requirements for the processing of personal information is that it “shall be processed in a manner that ensures appropriate security of the personal information, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures”3.

What about records management?

Many of the requirements for the fair and lawful processing of personal information link to records management principles: • The processing of personal information needs to be managed.

• All uses of personal information needs to be documented.

• Retention policies need to be established for personal information.

• Destruction processes for personal information need to be established and monitored.

• Personal information needs to be processed securely and in known locations.

The high-level standard, ISO/IEC 27001, provides requirements for establishing, implementing, maintaining and continually improving information security management. The adoption of an information security management system is a Information security strategic decision for an organisation and is influenced management preserves by its needs and objectives, the confidentiality, security requirements, the integrity and processes used, and size and structure of the organisation. availability of All of these factors can be information by expected to change over time.

applying a risk

Hence, it is appropriate for organisations with records management expertise to ensure that personal information is processed in accordance with records management practices, and to involve records management facilities in the design and management of the related processes.

Information security management process. management preserves How will it work? the confidentiality, integrity The Information Security Management System and availability of information by applying a risk (ISMS) defined in the high-level security standard management process and gives confidence was designed to permit the addition of sector to interested parties that risks are adequately specific requirements. managed.

Hence, ISO/IEC 27001 provides a mechanism for identifying and adopting security controls appropriate to the processing of personal information within an organisation.

The new project will use the high-level structure, identical sub-clause titles, identical text, common 3

From EU General Data Protection Regulation (Regulation 679/2016).

22 BULLETIN 202 · MARCH 2018

ISO/IEC 27552 will define additional requirements for the protection of personal information, enabling a management system to be extended to cover both the general requirements for information security, an ISMS, and the more specific requirements for the protection of personal information, a PIMS. These additional requirements

will be written in such a way that they are practically usable for the protection of personal information by organisations of all sizes and cultural environments.

ISO/IEC 27552 will be used by companies that process personal information on their own systems or on the systems of sub-contractors.

The work group identifies these organisations as ‘data controllers’. It will also be able to be used by ‘data processors’; those organisations that process personal information for other organisations.

What about compliance and certification?

An organisation complying with ISO/IEC 27552 will be able to generate documentary evidence of how it manages the storage and use of its personal information. Such evidence could be used to facilitate agreements with business partners, where the processes are mutually relevant. This might also assist in relationships with other stakeholders. The use of this standard in conjunction with the high4

EU GDPR Articles 41 and 42.

For a list of participating countries, see <https://www.iso.org/ committee/45306.html?view=participation> 6 The UK National Standards body is BSI: <https://www.bsigroup. com/en-GB/>.

5

level standard can, if desired, provide independent verification of this evidence.

Compliance with ISO/IEC 27552 cannot simply be taken as compliance with laws and regulations.

A number of national regulations call for “the monitoring of compliance with a code of practice”4 as a method for the accreditation and certification of organisations. Potentially, ISO/IEC 27552, when published, could provide a basis for such a code of practice.

Want to get involved?

At the time of writing this article, 55 countries are participating in the committee that deals with information security projects5. Participation by individual experts is through each country’s national standards body. If you want to get involved, contact your national standards body6.

The Author Alan Shipman Director, Group 5 Training Limited.

Alan can be contacted at <a.shipman@group5.co.uk>

INFORMATION AND RECORDS MANAGEMENT SOCIETY 23

GDPR – Sorting the fact from the fiction Elizabeth Denham

T

he General Data Protection Regulation (GDPR) comes into force on 25 May 2018. That’s not new news – but it is a fact. It’s also a fact that not everything you read or hear about the GDPR is true.

For the most part, writers, bloggers and expert speakers have their facts straight. There’s a lot to take in, and what they say – and sometimes challenge – helps organisations to prepare for what’s ahead.

24 BULLETIN 202 · MARCH 2018

But there’s also some misinformation out there too, and for many who are new to data protection, it’s creating uncertainty. Organisations that want to get it right – and we know that’s the majority – can sometimes feel like rabbits in the headlights, not knowing which way to leap.

I’ve read that “GDPR will stop dentists ringing patients to remind them about appointments” or “cleaners and gardeners will face massive fines that will put them out of business” or “all breaches must be reported under GDPR”.

I’ve even read that big fines will help fund our work.

For the record, these are all wrong.

Our Information Rights Strategy – a blueprint for my 5-year term in office – confirms that commitment.

You can read it at <http://www.ico.org.uk/aboutthe-ico/our-information/our-strategies-and-plans/>.

And just look at our record: last year (2016–17) But I’m worried that the misinformation is in we concluded 17,300 cases; I can tell you that danger of being considered truth – if this goes 16 of them resulted in fines for the organisations unchecked, we risk losing sight of what this concerned. Issuing fines has new law is about – greater always been, and will continue transparency, enhanced rights But it’s to be, a last resort – and for citizens and increased scaremongering to we have yet to invoke our accountability. maximum powers. suggest that we’ll be So, before the new law comes making early examples Predictions of massive fines into effect on 25 May 2018, I under the GDPR that simply feel bound to sort the fact from of organisations for penalties we’ve issued the fiction, to set the record minor infringements or scale-up under the DPA are nonsense. straight – to bust the myths. that maximum fines Because I know that most organisations want to get the will become the norm. Don’t get me wrong, the UK fought for increased powers GDPR right when it comes into when the GDPR was being force. drawn up. Heavy fines for serious breaches reflect just how important personal data is in a 21st Myth #1: The biggest threat to organisations century world. from the GDPR is massive fines Fact: This law is not about fines; it’s about But, we intend to use those powers proportionately putting the consumer and citizen first – we and judiciously, and while fines may be the can’t lose sight of that. sledgehammer in our toolbox, we have access to lots of other tools that are well-suited to the task at Focusing on big fines makes for great headlines, hand and are just as effective. but thinking that the GDPR is about crippling financial punishment misses the point – and that Like the DPA, the GDPR gives us a suite of concerns me. sanctions to help organisations comply – warnings, reprimands, corrective orders. While these will not It’s true that we’ll have the power to impose fines hit organisations in the pocket – their reputations much bigger than the £500,000 limit set by the will suffer a significant blow. current Data Protection Act (DPA). It’s also true that companies are fearful of the maximum £17 And you can’t insure against that. million or 4% of turnover allowed under the new law.

I hope that sets the record straight on our new fining powers. Now I want to tackle an equally highBut it’s scaremongering to suggest that we’ll be profile issue – consent. making early examples of organisations for minor infringements or that maximum fines will become Myth #2: You must have consent if you want the norm. to process personal data Fact: The GDPR is raising the bar to a higher The Information Commissioner’s Office’s (ICO’s) standard for consent. commitment to guiding, advising and educating organisations about how to comply with the law Consent under the DPA has always required a clear, will not change under the GDPR. We have always affirmative action – the GDPR >>>>> preferred the carrot to the stick.

INFORMATION AND RECORDS MANAGEMENT SOCIETY 25

>>>>> clarifies that pre-ticked opt-in boxes are not indications of valid consent.

The GDPR is also explicit that you’ve got to make it easy for people to exercise their right to withdraw consent. The requirement for clear and plain language when explaining consent is now strongly emphasised.

And you’ve got to make sure the consent you’ve already got meets the standards of the GDPR. If not, you’ll have to refresh it.

This has understandably created a focus on consent. But I’ve heard some alternative facts. How “data can only be processed if an organisation has explicit consent to do so”.

The rules around consent only apply if you are relying on consent as your basis to process personal data. So let’s be clear – consent is one way to comply with the GDPR, but it’s not the only way.

Headlines about consent often lack context or understanding about other lawful bases for processing personal information under the GDPR. Not only has this created confusion, it’s left no room to discuss the other options that organisations can consider using under the new legislation.

Whatever you decide, you’ll need to document your decisions, in order to be able to demonstrate to the ICO which lawful basis you are using. Data protection impact assessments (DPIAs) will be able to help you to understand how you can meet the conditions for processing and make your business more accountable under the GDPR. Next, I want to talk about another widely held misconception – that the new regime is an onerous imposition of unnecessary and costly red tape.

Whatever you decide, you’ll need to document your decisions, in order to be able to demonstrate to the ICO which lawful basis you are using.

For processing to be lawful under the GDPR, you need to identify a lawful basis before you start. Local authorities processing council tax information, banks sharing data for fraud protection purposes, insurance companies processing claims information… each one of these examples uses a different lawful basis for processing personal information that isn’t consent.

The new law provides five other reasons for processing that may be more appropriate than consent (find out more about them at <http:// www.ico.org.uk/for-organisations/data-protectionreform/overview-of-the-gdpr/key-areas-toconsider/>).

26 BULLETIN 202 · MARCH 2018

‘Legitimate interests’ is one of them and we recognise that organisations want more information about it. There is already guidance about legitimate interests under the current law on the ICO website and from the Article 29 Working Party. But there’s no need to wait for updated guidance – you know your organisation best and should be able to identify your purposes for processing personal information.

Myth #3: GDPR is an unnecessary burden on organisations Fact: Thinking about burden indicates the wrong mindset to preparing for GDPR compliance.

What must be recognised is that the GDPR is an evolution in data protection, not a total revolution.

It demands more of organisations in terms of accountability for their use of personal data and enhances the existing rights of individuals. The GDPR is building on foundations already in place for the last 20 years.

If you are already complying with the terms of the DPA, and have an effective data governance programme in place, then you are already well on the way to being ready for the GDPR. Many of the fundamentals remain the same and have been known about for a long time. Fairness, transparency, accuracy, security, minimisation and respect for the rights of the individual whose data you want to process – these are all things you

should already be doing with data and the GDPR seeks only to build on those principles.

That doesn’t mean there’s any room for complacency. There are new provisions to comply with and organisations should be making preparations now, if they haven’t done so already.

But, by and large, the GDPR regime represents a step change, rather than a leap into the unknown.

Much of the criticism about the GDPR seems to focus on the perceived burdens it will place on smaller organisations (small- and medium-sized enterprises (SMEs)). We have long recognised that SMEs may have limited time and resources for compliance and have acknowledged this in our regulatory approach.

But many of these criticisms fail to recognise the flexibility that the key principles in the DPA and the GDPR provide – they scale the task of compliance to the risk. And those principles are essentially the same, whether you are a small business or a multinational corporation.

Many of the actions that SMEs should take are practical and straightforward; our updated toolkit is a good starting point – go to <http://www.ico.org. uk/for-organisations/resources-and-support/dataprotection-self-assessment-toolkit/>.

It is not the size of the organisation that’s relevant as much as the risk that particular businesses and types of data processing pose – those handling particularly sensitive data, or processing personal data in potentially intrusive ways, for example.

Information management is key to compliance.

Under the GDPR, people will have strengthened subject access rights to the data you hold about them. This could well lead to more requests being received. So that’s a real burden, right?

Whatever the size of your organisation, the GDPR is essentially about trust. Building trusted relationships with the public will enable you to sustainably build your use of data and gain more value. Through changing their data-handling culture, organisations can derive new value from customer relationships.

Failing to get data protection right is likely to damage your reputation, your customer relationships and, ultimately, your finances. That goes way beyond increased fines – think brand damage and a subsequent loss of custom.

The ICO’s annual research on privacy and data protection consistently shows that levels of public trust remain low. Conversely, it also shows that they would be more willing to provide their data, and for different uses, if they felt they could trust organisations to handle it fairly, securely and responsibly.

And that provides a major opportunity and competitive advantage for those who can demonstrate that they get data protection right.

Next, I will set the record straight on data breach reporting.

New requirements to report serious breaches of personal data are high up on the list of issues we need to address – with not long to go until the GDPR comes into effect, we recognise that businesses and organisations are concerned.

Misleading press stories have claimed that all breaches will need to be reported to the ICO and customers alike; others say all details of the breach need to be known straightaway and some say there’ll be huge fines for failing to report.

Myth #4: All personal data breaches will need to be reported to the ICO. Fact: It will be mandatory to report a personal data breach under the GDPR if it’s likely to result in a risk to people’s rights and freedoms.

So if it’s unlikely that there’s a risk to people’s rights and freedoms from the breach, you don’t need to report.

Under the DPA, most data breach reporting is best practice, but not compulsory. And although certain organisations are required to report under other laws, like the Privacy and Electronic Communications Regulation (PECR), mandatory reporting of a personal data breach that results in >>>>> INFORMATION AND RECORDS MANAGEMENT SOCIETY 27

>>>>> a risk to people’s rights and freedoms under the GDPR will be new requirement for many.

These new reporting requirements will mean some changes to the way businesses, organisations and even the ICO identify, handle and respond to personal data breaches.

The threshold to determine whether an incident needs to be reported to the ICO depends on the risk it poses to people involved.

Pan-European guidelines will assist organisations in determining thresholds for reporting, but the best approach will be to start examining the types of incidents your organisation faces and develop a sense of what constitutes a serious incident in the context of your data and your own customers.

And organisations need to remember that if there’s the likelihood of a high risk to people’s rights and freedoms, they will also need to report the breach to the individuals who have been affected.

We’ve provided some initial guidance in our GDPR overviews that high-risk situations are likely to include the potential of people suffering significant detrimental effect – for example, discrimination, damage to reputation, financial loss, or any other significant economic or social disadvantage.

28 BULLETIN 202 · MARCH 2018

If organisations aren’t sure about who is affected, the ICO will be able to advise and, in certain cases, order them to contact the people affected if the incident is judged to be high risk.

For more information about what constitutes a breach, visit <http://www.ico.org.uk/fororganisations/guide-to-the-general-data-protectionregulation-gdpr/data-breaches/>.

Under the GDPR, there is a requirement for organisations to report a personal data breach that affects people’s rights and freedoms, without undue delay and, where feasible, not later than 72 hours after having become aware of it.

Organisations will have to provide certain details when reporting, but the GDPR says that where the organisation doesn’t have all the details available, more can be provided later.

The ICO will not expect to receive comprehensive reports at the outset of the discovery or detection of an incident – but we will want to know the potential scope and the cause of the breach, mitigation actions you plan to take, and how you plan to address the problem.

Fines issued under the GDPR will be proportionate and will not be issued for every infringement, but

organisations should be aware that the ICO will have the ability to issue fines for failing to notify and failing to notify in time.

It is important that organisations that systematically fail to comply with the law or completely disregard it, particularly when the public are exposed to significant data privacy risks, know that we have that sanction available.

Fines can be avoided if organisations are open and honest and report without undue delay, which works alongside the basic transparency principles of the GDPR. Tell it all, tell it fast, tell the truth.

That brings me to another myth about data breaches.

Myth #5: Data breach reporting is all about punishing organisations Fact: Personal data breach reporting has a strong public policy purpose. The law is designed to push companies and public bodies to step up their ability to detect and deter breaches.

What is foremost in regulators’ minds is not to punish the organisations, but to make them better equipped to deal with security vulnerabilities.

The public need to have trust and confidence that a regulator is collecting and analysing information about breaches, looking for trends, patterns and wider issues with organisations, sectors or types of technologies. It will help organisations get data protection right, now and in the future.

We understand that there will be attempts to breach organisations’ systems, and that data breach reporting will not miraculously halt criminal activity. But the law will raise the level of security and privacy protections across the board.

Data breach reporting makes sense under the new legislation, which is focused on giving consumers more control over their data and increasing the accountability of organisations. It’s also not unusual – almost all states in the US, some Canadian jurisdictions, and Australia have all successfully

tightened breach reporting as part of their legal framework.

You should be preparing now by ensuring you have the roles, responsibilities and processes in place for reporting; this is particularly important for medium to large organisations that have multiple sites or business lines.

We’ve been gearing up for the changes by introducing a new phone reporting service to enable businesses and organisations to report current personal data breaches and future breaches under the GDPR. It sits alongside a web reporting form and provides organisations with a quicker and easier way of reporting to the ICO, enabling them to receive immediate advice.

To report a breach, visit <http://www.ico.org.uk/ for-organisations/report-a-breach/>.

Just to be absolutely clear – between now and 25 May, all personal data breaches will be assessed under the DPA. As we passed the turn of the year and entered the last few months before the GDPR enforcement date, another myth came to mind.

Myth #6: GDPR compliance is focused on a fixed point in time – it’s like the Y2K Millennium Bug Fact: GDPR compliance will be an ongoing journey I’m still picking up a lot of concern from organisations about preparing for the GDPR by May. Much of that is understandable – there’s work required to get ready for the new legislation, and change often creates uncertainty.

However, some of the fear is rooted in scaremongering because of misconceptions or in a bid to sell ‘off the shelf’ GDPR solutions. I’ve even heard comparisons between the GDPR and the preparations for the Y2K Millennium Bug. In 1999, there was fear that New Year’s Eve would see computers crash, planes to fall out of the sky and nuclear war accidentally start. >>>>> INFORMATION AND RECORDS MANAGEMENT SOCIETY 29

>>>>> In the run up to 25 May 2018, there have been anxieties too, albeit on a less apocalyptic level. I want to reassure those that have GDPR preparations in train that there’s no need for a Y2K level of fear.

has a right to know what’s happening with their information • Understand the information you have – document what personal data you hold, where it came from and who you share it with; this will involve reviewing your contracts with third-party processors to ensure they’re fit for the GDPR Here’s why: unlike planning for the Y2K deadline, • Implement accountability measures – GDPR preparation doesn’t end on 25 May 2018 including appointing a data protection officer if – it requires ongoing effort, and no business necessary, considering lawful bases, reviewing stands still. You will be expected to continue privacy notices, designing and testing a data to identify and address emerging privacy and breach incident procedure that works for you security risks in the weeks, months and years and thinking about what new projects could beyond May 2018. need a DPIA • Ensure appropriate security – you’ll need That said, there will be no ‘grace’ period – there continual rigour in identifying and taking has been 2 years to prepare and we will be appropriate steps to address regulating from this date. security vulnerabilities and This will benefit not cyber risks But we pride ourselves on just your customers, • Train your staff – your being a fair and proportionate organisation’s employees regulator and this will continue but your organisation are your best defence and under the GDPR. Those who too, as it reaps the greatest potential weakness, self-report, who engage with us to resolve issues, and who reputational rewards, so regular and refresher training is a must can demonstrate effective allowing it to thrive in accountability arrangements With this certainty comes can expect this to be taken into the new privacy an opportunity for good account when we consider any landscape. data protection practice to regulatory action. pervade your organisation.

This will benefit not just your customers, but That means being able to show you have been your organisation too, as it reaps the reputational thinking about the essential elements outlined rewards, allowing it to below and who is responsible for what within the thrive in the new privacy business. landscape.

By now you should be putting in place key Yes, budgets can be building blocks to ensure your organisation tight, technology is implements responsible data practices, like those moving fast and there’s listed in our ‘12 steps’ document at <http://www. a race to keep up with ico.org.uk/media/1624219/preparing-for-thecompetitors. But if you gdpr-12-steps.pdf>.

The Author can demonstrate that Elizabeth Denham, you have the appropriate The key actions here are: Information Commissioner. systems and thinking in • Secure organisational commitment – place, you will find the preparation and compliance must be crossICO to be a proactive organisational, starting with a commitment The ICO has a range of guidance, tools and pragmatic regulator at board level; there needs to be a culture of and resources to help aware of business needs transparency and accountability as to how you organisations prepare and the real world. use personal data – recognising that the public

for the GDPR available at <www.ico.org.uk>.

30 BULLETIN 202 · MARCH 2018

Data Protection Impact Assessments: Simpler and safer...

Oliver Morley and Emily Meredith

A

t DVLA, our core responsibilities are to maintain over 45 million driver records and over 39 million vehicle records and collect around £6 billion a year in Vehicle Excise Duty. In order to fulfil these responsibilities, a significant amount of personal data is processed across multiple channels.

Data security is a primary consideration in the processing of this data and providing unrivalled safety, security and compliance is one of the key principles underpinning our strategic plan for 2017–2020.

The new General Data Protection Regulation (GDPR) is applicable and enforceable from 25 May this year. The primary aims of the GDPR are to provide data subjects with increased transparency and control over how and why their personal data is processed.

As an Executive Agency of the Department for Transport with statutory powers covering many of our core functions, the majority of our processing activities are not reliant on an individual’s consent and that won’t change under GDPR. We do, however, make every effort to ensure we are transparent with data subjects about the processing of their data and proactively publish information about when we will lawfully disclose data from our records.

GDPR requires organisations to provide additional fair processing information to data subjects at the point of collection and we are revising our many forms, telephone scripts and online services to ensure that we meet these new requirements.

This work is just one work stream within our GDPR

implementation programme to ensure compliance with all of the requirements by May. Another work stream has been tasked with looking at the GDPR requirements for data protection impact assessments (DPIAs). DPIAs have been best practice for a while in the public sector and are already well embedded within our organisation, but GDPR makes them mandatory in certain circumstances.

What are they, when are they mandatory under GDPR, and how can they help you on your compliance journey?

A DPIA is a tool that will help identify the most effective way to comply with your data protection obligations and meet individuals’ expectations of privacy and must include: • A systematic description of the envisaged processing operations and purposes for processing; • An assessment of the necessity and proportionality of the processing operation in relation to the purposes; • An assessment of the risks to the rights and freedoms of data subjects; and • The measures taken to address these risks, ensure the protection of personal data and demonstrate compliance with the GDPR. When are they required?

They need to be carried out prior to processing, but only when the processing is likely to result in a high risk to the rights and freedoms of individuals. GDPR provides some examples of processing activities that are likely to result in high risks: • A systematic and extensive evaluation of personal data based on automated processing, >>>>> INFORMATION AND RECORDS MANAGEMENT SOCIETY 31

>>>>> including profiling, on which decisions are based that produce legal effects or similarly affect the individual; • Large-scale processing of special category data or personal data relating to criminal convictions and offences; or • Systematic monitoring of a publicly accessible area on a large scale.

It will also support the requirement to maintain a record of all processing activities involving personal data. As a former Chief Executive and Keeper of The National Archives, I understand the value of proper recordkeeping.

Get DPIAs embedded in your change and data sharing governance processes, if you haven’t already, as carrying out a DPIA early in the project life cycle will help evidence compliance with your data protection by design and default obligations.

It also ensures that privacy considerations are incorporated into the solution design upfront and not bolted on at a later stage, resulting in increased costs and delays.

Article 29 of the Data Protection Working Party guidance provides additional criteria that you may want to consider when determining whether a processing activity is likely to result in high risks or not. They are particularly relevant when considering the use of new and innovative technological solutions and, from a DVLA Carrying out a DPIA should minimise the potential perspective, we strive to make our services for a personal data breach, as it should identify, simpler, better, and safer for our users and assess and treat any risks increase the range and take associated with a loss of up of our digital services, A DPIA, if done confidentiality, availability and so we actively consider properly, can take a integrity to the personal data opportunities to innovate. being processed. If the worst little time, but the were to occur, it would also A DPIA, if done properly, can provide you with a systematic take a little time, but the good good news is that a description of the processing news is that a single DPIA can single DPIA can be operation and controls in be used to assess multiple used to assess multiple place to inform the resulting processing operations that are similar in nature and risk processing operations investigation. profile. Data processors can that are similar in Finally, if you implement a also assist in carrying out nature and risk profile. process to periodically review a DPIA, if the processing is DPIAs to re-assess levels of wholly or partly performed by compliance with the GDPR and the risks to the them. data subjects presented by the processing activity, it could form the basis of a wider process to test, How can a DPIA help you? assess and evaluate the ongoing effectiveness Firstly, failure to perform a DPIA when of any technical and organisational controls appropriate, perform it properly or consult with implemented. The threat landscape is everthe Information Commissioner’s Office (ICO) in changing, so this will ensure you continue to have cases where the data controller cannot identify a level of security appropriate to the risks. sufficient measures to mitigate the risks to an acceptable level constitutes a breach of the GDPR To sum up, whilst not and could attract enforcement action and an necessarily a quick win, administrative fine. carrying out a DPIA is a The Authors relatively simple way to On a more positive note, it will help you Oliver Morley CBE, Chief Executive demonstrate compliance demonstrate how the processing activity complies Emily Meredith with a number of GDPR with the GDPR. Under the accountability principle, Corporate Information requirements and keep documenting how you comply with your data Manager. you and the data safe! protection obligations will be key.

32 BULLETIN 202 · MARCH 2018

Information Asset Registers: What are they good for?

Absolutely everything Emily Overton

B

ut they are not quick and they are not necessarily easy. This depends on how big they become and how much information you choose to put into them.

Information assets are the lifeblood of any organisation: without information, a business simply cannot run, and thus, it is vital that they are managed appropriately. The National Archives defines an information asset as “a body of information, defined and managed as a single unit, so it can be understood, shared, protected and exploited efficiently. Information assets have recognisable and manageable value, risk, content and life cycles.” What’s more, an asset can be an actual thing, such as a filing cabinet, a network drive, a server or a singular piece of paper such as an invoice. Generally, singular pieces of paper are categorised into larger assets, such as ‘XYX Invoices’, unless the singular invoice is part of a bigger process because an asset can also be a process. For a process such as the ‘Violent Patient Scheme’, the majority of this as an asset is made up of phone calls, e-mails, and feedback forms, but

without it you may not have the ability to offer a service to a patient.

Information asset registers (IARs) are usually found in an Excel spreadsheet; this is because they have quite a lot of information that needs to be entered per item and it’s the easiest layout possible. They can have hundreds to thousands of lines on them, depending on how large and complex your organisation is. You cannot do it alone as a single member of staff; you will need assistance. A point to note, though, is that it’s also okay not to have many assets. People try to over-complicate the IAR at times, for fear they’ve missed something, but if you set your register up correctly and you undertake the audit thoroughly, you cannot go wrong. The easiest way to keep an IAR up to date is for an information asset owner (IAO) to hold a local copy that they constantly update, or have it in a collaboration zone, so that it can be accessed regularly.

The governance of IARs is usually by IAOs, who report to a committee headed up by the Senior Information Risk Owner >>>>>

INFORMATION AND RECORDS MANAGEMENT SOCIETY 33

of Information >>>>> (SIRO); other roles common to have • does it contain any market-sensitive information on this committee are a Departmental Security • is it legally privileged Officer (DSO), an Information Technology Security • does it hold any exemptions, and more Officer (ITSO) and a Department Records Officer (DRO). These are not full-time roles for most So, are IARs useful for the General Data Protection organisations; they tend to be a role undertaken Regulation (GDPR)? Yes, because you can use it by someone such as a Records Manager, who may as a way to tease out your records of processing well be the DRO. The DRO is who looks after the activities. You are also documenting your reasons main IAR on behalf of the IAO, but IAOs may keep for processing, the purpose local copies of the IAR. This of the records, the retention governance is brought down What an IAR does is period and the earliest by having senior management document you have. By buy in. These roles are typically give you a fantastic undertaking an IAR, you are found in the public sector, dashboard and also showing accountability but there’s nothing to say overview of all of your for the information you that they couldn’t be used in other sectors – it’s about information assets and hold. This means that it helps towards articles role definition: ensure that their statuses.

5.1(a), (b), (d), (e), (f) and each area is covered and it’s 5.2, along with helping to about having a position with comply with article 30. It doesn’t tick the list off, Information Management that you can escalate if because naturally at the end of the day if you’re something goes wrong. filling it out and you notice that you’re using an information asset for a purpose it wasn’t intended So what do IARs do? They are a graceful way for, then there are further actions to be considered. of controlling the information within any one Moreover, if there hasn’t been a DPIA undertaken, organisation. IARs are multifunctional spreadsheets and it needs one, you can covering records management, data protection, start addressing it. What freedom of information, information security and an IAR does is give you a information risk. fantastic dashboard and overview of all of your They cover topics such as: information assets and • who owns it their statuses. This means • which directorate it belongs in you no longer have to • what is its purpose keep it all in your head!

• who to contact for an issue The Author • what format it’s in Emily Overton The only thing I can • where is it located (RMGirl) is currently an information and honestly suggest is • how long it’s kept for records manager in that you don’t rush • what’s the earliest record you have Central Government filling it out. If you feel • does it contain personal data and a Director of the yourself only adding one • does it contain special category data IRMS, with a decade’s processing condition • what processing condition(s) are you using experience in the field.

However, the views, per hour that you’re sat • when it was first created/implemented/first opinions and advice are working, then that’s fine. started to be used not on behalf of either Sometimes it’s really • whether a data protection impact assessment organisation but that of not easy but, equally, (DPIA) has been undertaken and when her own personal and you’re on your way to • whether privacy by design was addressed and business as RMGirl. improving information the outcome management throughout • is there a risk to the asset Emily can be contacted at your organisation just by <emily@rmgirl.co.uk> • is it published and who has access to it @rmgirluk starting.

• when was it last requested under Freedom 34 BULLETIN 202 · MARCH 2018

How long is a piece of ROPA? Scott Sammons

W

henever I speak to someone about General Data Protection Regulation (GDPR) implementation, the majority of people seem to overlook Article 30 and the records of processing activities (ROPAs) And, to be honest, I can see why.

At face value Article 30 of the GDPR requires organisations (both controllers and processors) meeting certain conditions to keep records about what personal data they are processing (including the hows and whys). This sounds very similar to what we record currently in the UK on our registrations with the Information Commissioner, so should just be a tick box exercise.

I would, however, disagree.

According to the GDPR Article 30(1) outlines that controllers are required to capture: 1. the name and contact details of the controller and, where applicable, the joint controller, the controllerâ&#x20AC;&#x2122;s representative and the data protection officer; 2. the purposes of processing; 3. a description of the categories of data subjects and of the categories of personal data; 4. the categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organisations; 5. where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards; >>>>> INFORMATION AND RECORDS MANAGEMENT SOCIETY 35

>>>>> 6. where possible, the envisaged time limits for erasure of the different categories of data; 7. where possible, a general description of the technical and organisational security measures referred to in Article 32(1). Article 30(2) the further outlines that processors are required to capture: • the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller’s or the processor’s representative, and the data protection officer; • the categories of processing carried out on behalf of each controller; • where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards; • where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

Point 3 states that the records should be electronic or written form, that it should be made available to the supervisory authority, where requested (point 4), and you don’t need to have one if you employ fewer than 250 employees and your processing isn’t likely to result in high risks to the rights and freedoms of individuals (point 5).

As someone that’s currently working with various organisations on GDPR implementation, if you don’t have more than 250 employees, I still recommend you do the requirements of article 30 as, in my opinion at least, it is the core of your GDPR compliance.

With any regulatory compliance regime, you want to be able to have an overview of what you are putting in place and, with the limited resources you have available, focus in on the areas that are of genuine legitimate concern. The larger you are, the more complex this becomes. But, if you have a good and robust record of your processing that evolves as the business evolves, then it can be a tool to help you and not just a tick box exercise.

36 BULLETIN 202 · MARCH 2018

For me, I see an information asset register (IAR) and a ROPA-type register as being two elements of the same thing. Yes, your IAR will have far more information in it than just personal data assets, but the things it asks and looks at are very similar to ROPA. All you need to add in are fields around grounds for processing, any consent obtained, sharing arrangements and technical measures (plus possibly some more, depending on how you do information asset management in your organisation).

Once you have your assets and your data flows of where things are coming from, being used for, then going to, what’s to stop you then linking them to privacy impact assessments? Or risks that are associated with those assets? Or even records of other controls you put in place, like training for staff that use those assets, the policies that cover them, or even the contracts and sharing agreements that may cover them.

‘Record of processing activities’ is such an offputting name for something that, in my mind at least, is something that proves to be really useful to your compliance regime, if you engage with it. Yes, you can just get away with a word document that documents all this, just as our current registration forms do, but why do tick box when you can do innovation and take ROPA for what it was meant to be: a way to manage all this and bring it together into something that works for you! So, why not try to find ways to make this something that you can add to your toolkit of things to help you?

The Author You can find all references to ROPA requirements in: • GDPR Article 30; • Data Protection Bill Part 3 (Law Enforcement) Chapter 4 Section 59; • Data Protection Bill Schedule 1 Part 4 (32) (a)–(c).

Scott Sammons CIPP/E, AMIRMS is an experienced Data Protection & Information Risk practitioner and blogs under the name @privacyminion. He is on the Exam Board for the GDPR Practitioner Certificate.

Scott can be contacted at <scott@privacyminion.com>

Fun with processor clauses Ed Boal

E

d Boal reflects on his early experiences of negotiating processor clauses in anticipation of the General Data Protection Regulation (GDPR) coming into force.

This article was first published on the Society for Computers and Law (SCL) website on 10 January 2018 and in Computers & Law and has been republished with SCL’s permission.

It is, of course, far too early to establish ‘standard market practice’ when it comes to processor clauses under Article 28(3) of the GDPR. However,

in the rush towards 25 May, the drafting, review and negotiation of such clauses is becoming routine and this article takes a look at some of the early patterns that are beginning to emerge from the author’s experience.

Processors taking the lead Although Article 28(3) leaves open the question of whether entering into a binding contract, with regards to the processing of personal data is an obligation on the controller or processor (Article 83(4)(a) suggests it is both), the expectation has been that controllers would ultimately take the lead as part of their compliance initiatives. >>>>> INFORMATION AND RECORDS MANAGEMENT SOCIETY 37

>>>>> However, on simple analysis of the number of enquiries and instructions received from controllers versus processors, it seems that processors are taking the lead.

For some processors, taking the lead enables them to define the allocation of responsibilities and risks and provides an opportunity to establish the most favourable commercial position on the appointment of sub-processors under Article 28(2) (see below) and on some of the areas where Article 28(3) is less prescriptive, for example, regarding the format and timescales for the return of personal data under Article 28(3)(g) and the frequency, notice periods and other conditions for audits and inspections under Article 28(3)(h). For other processors, taking the lead is more about demonstrating that they are a proactive and reliable service provider that is ahead of the game.

Appointment of sub-processors This is where the real fun starts (if you can call it fun) and where supply chain assurance can start to break down very quickly. Article 28(2) provides two options for the appointment of sub-processors:

• general written authorisation, subject to an obligation on the processor to inform the controller of any intended changes, so that they have an ‘opportunity to object’; or • specific authorisation of named sub-processors to undertake discrete processing tasks.

In practice, it seems that there is little to be gained from favouring one option over the other, as the addition or replacement of other processors will invariably require the controller’s consent. However, the general written authorisation option seems to be preferred by the processor because: • unless the controller makes a specific enquiry, the processor does not need to share a list of its sub-processors at the outset (though in practice many cloud service providers do, as seen from the examples below); and • it provides flexibility in the event that a controller objects to any proposed change: either the customer can pay more for the processor to maintain an existing arrangement for that controller’s benefit, or either or both parties may have a right to terminate the agreement before such change is implemented.

This is where the real fun starts (if you can call it fun) and where supply chain assurance can start to break down very quickly.

38 BULLETIN 202 · MARCH 2018

In terms of examples, ‘in the wild’ (ie data processing clauses that can be found via a Google search - some vendors choose not to publish them): • Google takes the specific authorisation approach, with a separate page listing all of the Google and non-Google sub-processors authorised by the controller. Google will give 30 days’ prior notice of any changes, from which point a controller is given 90 days to terminate the agreement immediately on written notice; • Salesforce takes a hybrid approach: customers can request a current list of sub-processors at any time and subscribe for notifications of new sub-processors before they are authorised by Salesforce. If a customer wishes to object to any proposed changes, they have 10 business days from the date of Salesforce’s notice to do so and if Salesforce cannot agree a “… commercially reasonable change to Customer’s configuration or use of the Services…”, the customer can terminate the affected services (a similar approach is taken by Cloudflare, IBM and Microsoft);

• Oracle and VMware appear to adopt the general authorisation approach, but without appearing to give controllers a right to object if any changes are proposed.

Of course, Article 28(2) does not require a processor to identify each sub-processor with a specific processing activity (the only provider mentioned above that does is Microsoft). This makes it difficult for controllers to undertake more than a superficial level of due diligence of the processing supply chain at the point of purchase/ subscription, though one would expect a processor to explain the purposes of any change and related (sub-)processing activities when giving notice of any proposed changes to its customers.

Sometimes sub-processing clauses will give a controller the right to request copies of the agreements between a processor and its subprocessors, subject to the redaction of any commercially sensitive provisions. However, on one occasion, in my experience, the processor refused to provide the same until the customer signed up for the service. Often, therefore, the controller will have to rely on the processor’s obligation to ensure that agreements with any sub-processors reflect the GDPR’s requirements and that the processor will remain liable for the performance of its subprocessor’s obligations (Article 28(4)).

Recovery of costs and expenses There is often negotiation over the extent to which a processor may recover its ‘reasonable costs and expenses’ for fulfilling the requirements set out in sub-paragraphs (e) to (h) (inclusive) of article 28(3). However, some provisions tend to be more contentious than others, for example: • Depending on the nature of the processing, a controller may argue that the processor’s obligation to provide assistance, in relation to responding to the requests of data subjects (see sub-paragraph (e)), is an intrinsic part of the service for which they should not have to pay anything further (though it is generally helpful to break down the rights laid down in Chapter III and deal with them individually where possible).

• There is a careful balance to be struck when it comes to facilitating a controller’s compliance with its obligations under articles 32, 33 and 34 (see sub-paragraph (f)), where the identification, mitigation and remediation of a >>>>> INFORMATION AND RECORDS MANAGEMENT SOCIETY 39

measures taken by them, others will generally point >>>>> personal data breach will require to some form of marketing document that lacks close cooperation between the controller and any real detail and controllers will often insist on the processor, and where the controller will feel minimum security measures being specified (of most vulnerable. Controllers appear to be more course where the Standard Contractual Clauses relaxed when it comes to assistance with data are engaged, this detail must be set out in protection impact assessments (article 35) and Appendix 2). prior consultation (article 36).

• Sub-paragraph (g) does not adopt the Liability and indemnities ‘commonly used electronic form’ or ‘commonly Most processors refer to the limitations of liability used and machine-readable format’ conventions set out in their main services agreement/terms in used in relation to data subject rights. Often, relation to liability under the controllers will ask for data protection clauses. Often a complete copy of the Some limitation those limitations are insufficient database (as opposed to clauses bizarrely (limited to fees actually paid export in .csv, .xml or .xls/x in the preceding 12 months) formats) to enable them to attempt to apply a and/or incompatible with the transition to a replacement singular liability cap to processor’s obligations under processor with as little fuss the GDPR (in particular, ‘loss of as possible, while processors all claims made by a or damage to data’ commonly are reluctant to provide a controller and its being excluded). Some copy of the database to limitation clauses bizarrely protect the database schema affiliates, in respect of attempt to apply a singular (essentially the designs for all claims made by liability cap to all claims made the database) from being them. by a controller and its affiliates, plagiarised by competitors. in respect of all claims made Processors are generally by them, regardless of whether they arise from the wiling to achieve a compromise, subject to same event/personal data breach. being able to recover their costs and agreeing a reasonable period for delivery to the controller.

As anticipated, controllers either want an indemnity • The frequency, notice periods, and access in respect of non-compliance with the processing restrictions for audits and inspections clauses or, alternatively, more substantial liability are generally limited, except in specified caps, which are often linked to the maximum circumstances. Parties tend to confuse the sums assured under reference to audits and inspections in subrelevant insurance paragraph (h) with the powers of supervisory policies (controllers are authorities under article 58(1)(b). asking more intelligent questions about ‘cyber’ Security of processing cover as part of their Article 32(1) permits a risk-based approach, when processor due diligence, it comes to ensuring the security of processing, though larger processors which goes beyond ensuring that data are secure The Author will generally not comply at rest and in transit to those matters listed in Ed Boal is a Senior with such requests). article 32(1).

Associate and head Usually the parties of the Digital Media reach agreement on Most security provisions within processor clauses & Technology team at a liability cap, which is tend to give processors considerable latitude when Gregg Latchams; a law firm with offices in somewhere between it comes to determining what is ‘appropriate’ in Bristol and London. £/€/$1–5 million, relation to their processing tasks. While some depending on the nature processors (such as Google) go to commendable of the processing. lengths to describe the extent of the security

<www.gregglatchams.com>

40 BULLETIN 202 · MARCH 2018

The GDPR and consent interfaces: A technician’s view Dale Smith

F

rom an IT technician’s point of view, those of us tasked with operationalising mandated transparency and consent requirements from the EU General Data Protection Regulation (GDPR) before the May 25 enforcement threshold face a formidable challenge.

While EU users and regulators will be able to evaluate compliance with new GDPR rules by

simply viewing any public-facing data ingestion screens, as IT staff - who craft and maintain those screens - we lack concrete requirements as to what actually needs to be changed or added at our existing user ‘touch points’ to achieve and demonstrate compliance.

Experience tells us that IT implementations based upon ill-defined and amorphous specs often end poorly, yet the May deadline looms, and a strategy of inaction risks heavy sanctions as well as brand damage for the enterprise. >>>>>

INFORMATION AND RECORDS MANAGEMENT SOCIETY 41

>>>>> What to do?

For an answer, it is useful to step back and analyse the GDPR holistically, and from the standpoint of the EU leaders who drafted and enacted it in 2016.

What were the overriding goals they sought to achieve through this legislation? In terms of privacy protection for their EU constituents, what are the most important long-term outcomes that will act to make this regulation an unqualified success for regulators and a privacy win for EU citizens?

First, look at the negative pronouncements in the GDPR. The framers explicitly sought to eliminate the common practice of citizens having to give up personal information without first being properly informed (see article 12). They explicitly sought to eliminate the reality of citizens left without effective and informed choice (article 7). And they

No longer is personal information gathering ‘the sound of one hand clapping’.

Now the user has a seat at the table and can participate as an active party in the personal information exchange. sought to eliminate data controllers and processors acting without appropriate permission, leaving citizens with no control as their personal data was transferred to third parties and beyond (Rec. 32).

On the positive side, they created new standards for defining, obtaining, and maintaining consent (articles 4,6); codified a number of new individual privacy rights for citizens; and mandated that citizens be advised of those rights on a regular and fully visible basis (articles 12–21).

There is a common thread running through each of these initiatives. These new GDPR mandates all imply a bidirectional conversation or ‘touch-point dialogue’ between enterprise and user. No longer can an inscrutable privacy policy and a pre-ticked ‘I Agree’ box serve as adequate permission for processing personal information. No longer is personal information gathering ‘the sound of one 42 BULLETIN 202 · MARCH 2018

hand clapping’. Now the user has a seat at the table and can participate as an active party in the personal information exchange.

So, what can IT do today as the compliance deadline approaches?

I believe implementing a touch-point dialogue structure at the enterprise’s public-facing personal data ingress contact points is a practical, essential and initial step for implementing and demonstrating GDPR compliance. Implementing such dialogue capability publicly demonstrates solid commitment to the spirit of the GDPR, while putting the framework into place for expanding and optimising the enterprise’s compliant user interface/user experience as guidance and codes of conduct become better defined over time. It signals publicly that the enterprise cares about citizens’ privacy and is reaching out as a best practice to build user trust.

Some boxes to check with either an internal or external solution might include: compliant transparency and notice support; an application programming interface to facilitate integration with existing enterprise infrastructure; full article 6 processing flexibility; comprehensive consent flow support; rights presentation and negotiation support; user and administrative dashboarding; dialogue-event logging; and Data Protection Officer/Data Protection Act accountability reporting.

Privacy and IT teams will have to work together to create that dialogue framework, whether through some kind of internal development effort or through engagement with a commercial vendor.

Luckily, as we’ve seen, the privacy technology market is exploding with options. A thorough scan of the marketplace should uncover some ways for accomplishing this goal relatively quickly, if there is budget available.

The Author Dale co founded PrivacyCheq in 2013 and now focuses on building and implementing general software solutions for the privacy industry, and practical, “rubberon-the-road” solutions for implementing and operationalising GDPRmandated notice, consent, rights, and recordkeeping.

<www.privacycheq.com>

MiFID II compliance: Understanding new expectations for preserving website and social media records Pagefreezer

T

A brief MiFID history he Markets in Financial Instruments Directive 2004/39/ EC (MiFID) came into play in 2007. Established to regulate investment services, increase competition and enhance consumer protection, MiFID applies to all member states of the European Economic Area, including banks, brokers, financial service institutions and advisers.

On 20 October 2011, the European Commission adopted a legislative proposal for the revision of MiFID, which took the form of a revised directive

and a new regulation. The European Parliament and Council reached an agreement to develop MiFR, and MiFID II to further make markets more transparent and better protecting of investors.

With its implementation scheduled for earlier this year (January 2018), there are numerous changes financial services organisations must have implemented. In regards to recordkeeping, organisations are now required to have consistent means of capturing, retaining and reproducing records of all of their activity, whether through personal conversation; telephone; or electronic communications, such as social media, chat, or websites. >>>>> INFORMATION AND RECORDS MANAGEMENT SOCIETY 43

>>>>> With such an abundance of information communicated online, this paper is meant to serve as guidance on how this new law applies to websites, blogs, and social media. It also covers an exploration of archiving software as a tool for easy and efficient MiFID II compliance.

2) Increased supervision: MiFID II mentions that the NCA will use company records to ensure firms are complying with their obligations.

Marketing communications and investment research should be considered, regardless of its media, and includes websites, blogs, social media and chats.

5) Preserve electronic communications for up to 7 years MiFID II asks firms to retain records for up to 7 years

MiFID II, ARTICLE 16 (6): “An investment firm shall arrange for records to be kept of all services, activities, and MiFID I vs. MiFID II: What’s changed? transactions undertaken by it which shall be Under MiFID I, firms were expected to: sufficient to enable the competent authority to • Keep records of (a) every client order and (b) fulfil its supervisory tasks and to perform the every decision to deal taken enforcement actions under in the course of providing this Directive, Regulation With such an the service of portfolio (EU) No 600/2014, Directive abundance of management.

2014/57/EU and Regulation • Keep records of transactions. information (EU) No 596/2014, and in “A transaction should be communicated online, particular to ascertain that the recorded on the execution investment firm has complied of a client order or, where a this paper is meant to with all obligations, including firm is transmitting an order, serve as guidance on those with respect to clients after receiving confirmation or potential clients and to the how this new law that an order has been integrity of the market.” applies to websites, executed.”

• Keep records for at least 3) Required capture of all blogs, and social 5 years. “The terms of conversation types and business agreed between a media. stages: firm and its client must be MiFID II rules regarding kept for as long as the relationship lasts.” telephone and electronic conversations require • Keep relevant records in a medium and form firms to keep not only conversations that conclude that is accessible by the relevant national in a trade or confirm a transaction, but all competent authority (NCA), and in a form that is communications that may lead up to a trade in not easy to manipulate or alter. the future, including instant messages, blogs, and social media conversations.

While much of MiFID II is the same, it has been expanded to include additional recordkeeping 4) Request for durable, accessible media: rules. A few key changes to note: Records should be kept in a durable medium that allows replaying, but which prevents the file from 1) List of specific minimum requirements: being manipulated or altered. The documents Regulation 40(5) of MiFID II requires firms to also need to be readily accessible and available retain details on transactions based on a list upon request. Preventing the manipulation of of minimum records required, including “Each digital records and establishing the data integrity marketing communication addressed by the and authenticity requires the collection metadata investment firm to clients or potential clients” and of such communications and the use of digital “Each item of investment research [...] issued by signatures and timestamps to legalise the digital the investment firm in writing”. record

44 BULLETIN 202 · MARCH 2018

solution for your websites, blogs, and social media is the simplest and most flexible solution to keep trusted records for easy delivery when needed. Archiving software can offer many benefits over backup systems and multiple software solutions.

• Built for compliance Unlike regular backups, archiving software is built especially for users to meet regulatory requirements with ease. Most providers have done the work and take responsibility for staying on top of new regulations, and ensuring their software does the job to meet the rules.

• Evidentiary quality archives Archiving software is built to produce archived data in the forms needed to hold up in court by collecting metadata and using digital signatures and timestamps. As regular backups could miss a step or fail to prove data authenticity and integrity, proper archives are the way to go.

MiFID II ARTICLE 16 (7): “The records kept in accordance with this paragraph shall be provided to the client involved upon request and shall be kept for a period of five years and, where requested by the competent authority, for a period of up to seven years.”

Taking the next steps By now, all organisations to whom MiFID II applies should be in a position to archive, supervise, and disclose all of their electronic communications and be prepared for European Securities and Markets Authorities (ESMA) requests at any time. This requires a reflection of company recordkeeping and reporting processes to ensure complete compliance.

With ESMA’s ability to conduct an audit or make records requests, all recordkeeping aspects, from supervision and replaying, should be carefully considered when determining which systems to implement.

Preserving electronic communications with archiving software Given MiFID II’s extensive recordkeeping expectations for online communications, a comprehensive data collection and archiving

• Easy fulfilment of data requests Should ESMA request your electronic records in the future, how much time and scrambling would that require from your organisation?

An archiving solution makes the fulfilment of requests easy, by offering quick and easy exports of your collected content in a quick turnaround time.

• Set it and forget it solution Archiving software serves as a ‘set it and forget it’ solution. A small, one-time investment in the right software spares you the need for regular maintenance and check-ups on your backups.

Archiving software is built to run automatically, so you can rest assured the The Author work is done.

• Stored in the cloud Backups and technology are known to crash.

Archiving software built for the cloud ensures your data is backed up, stored, and protected in the cloud within EU borders.

PageFreezer is a leading provider of website and social media archiving solutions to a wide range of industries, including finance, legal, telecom, retail, utilities, government and postsecondary education. <info@pagefreezer.com> <www.pagefreezer.com>

INFORMATION AND RECORDS MANAGEMENT SOCIETY 45

A case study in activating improvement: a lean approach to file shares Alison Winning

T

Background and context he first new public records legislation in Scotland for over 70 years received Royal Assent in April 2011. The Public Records (Scotland) Act 2011 requires named public authorities such as local authorities, NHS, police, Scottish Government and Scottish Parliament to produce and submit a records management plan (RMP) setting out proper arrangements for the management of the organisations records to the Keeper of the Records of Scotland for his agreement under Section 1 of the Act. Where authorities fail to meet their obligations, the Keeper has powers to undertake records management reviews and issue action notices for improvement. Healthcare Improvement Scotland, a public body, submitted a records management plan in 2015 for agreement.

Healthcare Improvement Scotland (HIS) has a single purpose to drive improvements that support the highest possible quality of care for the people in Scotland. The organisation is comprised of many functions which source, analyse and interpret data and information to generate recommendations, advice and guidance for NHS Scotland. HIS owns a number of business brands with a national and international reach and reputation. The Public Services Reform (Scotland) Act 2010 created HIS and although a number of the business activities were inherited from predecessor bodies, dissolved or reconfigured under this legislation HIS also assumed a number of new obligations and statutory powers. The organisation has two central offices in Glasgow and Edinburgh fourteen offices across Scotland and around 500 staff. Staff work primarily from a file share with critical services

46 BULLETIN 202 · MARCH 2018

operating a document and record management system.

Records management plans must address the 14 elements below.

• Senior management responsibility • Records manager responsibility • Records management policy statement • Business classification • Retention schedules • Destruction arrangements • Archiving and transfer arrangements • Information security • Data protection • Business continuity and vital records • Audit trail • Competency framework for records management staff • Assessment and review • Shared information Agreement of the HIS records management plan was received with a small number of areas for improvement identified including; business classification, destruction of records and audit trail.

The identified areas for improvement were expected and welcomed with the organisation viewing the introduction of the legislation as a timely enabler driving the organisation to redefine the predecessor approaches to records management to create a single policy and practice approach.

This case study outlines an approach taken with one business function to address the creation of a business classification scheme and associated file share cleansing.

Aim The aim for the business classification scheme development was to map business activity and produce a visual representation of functions, activities and tasks physically represented by revised file structures and retention periods. Migration was to the revised file share structures housed in a single drive following data cleansing to reduce the overall number of drives in operation across the organisation.

Improvement approach Lean improvement methodologies, first developed

by Toyota in the 1950s, are concerned with adding value, from the customer perspective, to systems and processes, and

eliminating waste in procedures and processes, leading to a reduction in the resources required to get the job done.

The core idea in lean thinking is the need to provide what the customer wants, i.e. to provide ‘value’ to the customer, with minimal wasted time, effort and cost. It starts by defining the purpose of the process (value for the customer) and then redesigns the process to deliver that value with minimum wasted time, effort and cost. Through the efforts of a lean practitioner the people and organisation are then organised to manage the process. Within our case study the following lean tools were applied: 5S process mapping, 5 whys, Plan-Do-Study-Act (PDSA) (Figure 1).

5S 5S is a way of eliminating waste in your immediate environment by applying a process of sorting, setting in order, shining, standardising your environment and then making plans to sustain those changes. It is used to create a state of operational readiness and identify variations in standard processes.

Process mapping A map visually presenting a process from beginning to end answering questions such as: What is the waste in the process?

Where are any blockages to flow?

How long does each process step take?

How many handovers are there?

5 whys 5 whys is a questioning technique used to explore the cause-and-effect of particular problems with the aim of identifying the root cause of a problem or issue. The question “Why?” is simply repeated 5 times Plan-Do-Study-Act (PDSA) This approach is underpinned by three questions: What are we trying to accomplish?

How will we know a change is an improvement?

What changes can we make that will result in an improvement?

The questions are put into action by devising a plan to test a change, the test is carried out and the results studied using a measure and then any modifications to the test are determined. This occurs on a small scale and is further rolled out if successful.

Figure 1

Small test of change A small test of change aiming to achieve development of file structures, data cleansing and migration with one business function was implemented.

Initially, to determine the issues for the team and identify the value for the customer process, mapping was undertaken to identify the current approaches to receiving, filing and handling records/documents within the business area. Through the process mapping, a number of wastes were identified: Inventory • Physical identification of where records/documents stored Motion • Staff using 7 mouse clicks to access records/documents • Multiple staff saving the same records/documents in more than one location • Staff searching for records/ documents in more than one location Overproduction • Records/documents being duplicated within the filing structure The team recognised the problems with current approaches to their records management namely that: • Project records and documents were saved in different locations. Data from the file management system evidenced that approximately 500 documents/records are stored. within two locations on the shared drive with the same or similar naming conventions >>>>>

INFORMATION AND RECORDS MANAGEMENT SOCIETY 47

>>>>> • Records/documents stored on personal drives, which has an impact on information governance and records management control arrangements.

• Records/documents not named as per agreed organisational policy. 100% of records/documents within a sample of 511 were name incorrectly - inconsistent naming of records/documents can also contribute to duplication, loss of records management control, inefficient use of time locating documents, and risks relating to access and retention/ destruction of records/ documents.

• The current filing structure had seven levels i.e. it took 7 clicks to access a record/document.

In order to identify the root cause of the duplication, lack of consistency and compliance with policy the 5 whys approach was applied in discussion with the team. This elicited that there was insufficient information on process, benefits and the importance of records management, there was a lack of understanding of ‘what’s in it for me or the organisation’.

A theory of change was developed identifying what the team or customer wanted to change linked to interventions which would underpin achieving this outcome. The Plan – Do – Study – Act (PDSA) framework was used to plan, implement and report on the success of the interventions (Figure 2) over a three month period.

48 BULLETIN 202 · MARCH 2018

Plan: The team planned to migrate records and documents to a single location within the business classification scheme and ensure all are named according to the corporate naming and version control policy.

Do: To achieve this they identified a need for training on policy and procedure and the 5S approach (Figure 3) to support development of an agreed file plan. Guidance on developing file structures was produced alongside decision aids to assist with identification of records as opposed to documents and suggested standard folder sets were recommended for global

activities. Training sessions on policy and procedure were also held.

Study: An important indicator to the team was compliance with document naming as the inconsistency in practice was a big time waster and challenge to them. Also the number of clicks necessary to reach a document was to be reduced.

Staff competency in records management was also to be assessed.

Act: The plan was then to review the results and create an improvement plan as needed based on the learning.

Single location Applying naming & version policy

Impovement plan

Act

Study

Plan

Do

Compliance

Training 5s File plan

Figure 2

5a

Application

Sort

Identify records and other documents where there is a business need to keep.

Consider what is no longer required

Set in order

Develop filing structure to hold records consistently and differentiate from other documents following the corporate rules Set permissions

Shine

Migrate to new filing structure and delete what is no longer required

Standardise

Document decisions made eg. exceptions to retention periods Add to existing SOPs, create new SOPs to support

Sustain

Develop ongoing improvement plan Set aside time to do regularly Undertake audits

Figure 3: Applying 5S: Developing file structures

Evaluation File locations on shared drive located from two locations to one location

The number of clicks to reach a document reduced from seven clicks to five clicks

% of documents named correctly A sample of documents (511) were analysed pre and post migration to consider whether they were named according to document naming and version control procedures. Following the migration, all new documents saved within the case files were checked to see whether they were compliant.

Percentage of documents compliant with document naming and version control policy

Team feedback Project team members were asked to consider their competence in managing records on a scale of one (not at all competent) to five (very competent) before and after participating in the project.

Project team members competence in undertaking records management

Follow-up A number of activities have been identified as next steps for the team to be captured as part of an ongoing improvement plan in order to sustain the changes: • Repeat audit of documents/ records to ensure ongoing compliance with naming conventions • A regular audit of document naming within project files • Monitoring growth of folders on the shared drive Learning points • Using an improvement approach rather than emphasising the ultimate compliance requirements of the legislation was a useful way of engaging staff to undertake necessary tasks.

• Seeking input from those with business improvement expertise was crucial. Connect with wider colleagues and work collaboratively to develop programmes of work which are implementing changes to standard ways of working.

• Working in this way particularly gathering data can be resource intensive, be clear that everyone can commit and sustain the actions required.

The Author

¾ staff members reported improvement in records management knowledge

Sources of Information • Applying lean six sigma to records management: <http://slideplayer.com/slide/5910265/> • The Lean Guide: <http://www.theleancoach.co.uk/images/downloads/lean_guide.pdf> • Quality Improvement Zone: <https://learn.nes.nhs.scot/Resource/View/741> • Public Records (Scotland) Act 2011: <http://www.legislation.gov.uk/asp/2011/12/contents> • Public Services Reform (Scotland) Act 2010: <https://www.legislation.gov.uk/asp/2010/8> • National Records of Scotland: Records Management <https://www.nrscotland.gov.uk/record-keeping/records-management>

Alison Winning, Knowledge Management Team Lead, Healthcare Improvement Scotland.

Alison can be contacted at <alison.winning@nhs.net>

INFORMATION AND RECORDS MANAGEMENT SOCIETY 49

Holmes Financial Solutions Ltd fined 300,000 after making 8.7 million nuisance calls A company that made 8.7 million nuisance calls has been fined £300,000 by the Information Commissioner’s Office (ICO).

distress as they were concerned that the call may have been about something happening to a friend or family member.

Holmes Financial Solutions Ltd, based in Speke, Liverpool, made the automated marketing calls between 22 October 2015 and 27 July 2016.

The contravention could have been far higher since it is known that the company instigated over 26.6 million automated calls.

The 8,792,907 calls contained recorded messages, primarily promoting PPI compensation claims, but the company did not have the recipients’ consent for sending direct marketing, which is against the law.

It also broke the law by failing to identify the organisation making the calls, while it used so-called ‘added value’ numbers that generate revenue when an individual calls the number, which is then apportioned and passed to associated companies and the network carrier.

The ICO received 62 complaints from the public about Holmes Financial Solutions Ltd. Some people were called on multiple occasions.

Others said they were unable to opt out of receiving the calls. Some expressed further

ICO Head of Enforcement, Steve Eckersley, said: “The company paid no heed to laws on telephone marketing and showed no concern for the distress they were causing people, by making huge volumes of invasive calls.

“The ICO will not tolerate companies who blatantly disregard the law and Holmes Financial Solutions Ltd has paid the price for their negligence.

“I welcome the Government’s plans to introduce personal liability for directors who think they are above the law, and hope to see them introduced as soon as possible, to support our work to stop such rogue traders operating.”

Accident recovery firm employee who sold personal data to nuisance callers is fined A former worker at an accident repair firm who downloaded and sold the personal data of motorists to nuisance callers has been fined.

of Nationwide Accident Repair Services Limited (NARS) when he was found to be accessing suspicious volumes of customer data from a laptop at home outside of work hours.

Phillip Bagnall, 33, of Scotta Road, Eccles, Greater Manchester, was an employee

NARS called in cybersecurity consultants in November 2016 after large numbers of

50 BULLETIN 202 · MARCH 2018

customers began complaining that they were receiving nuisance calls shortly after engaging its services. Initial enquiries led to suspicions that Bagnall was involved and it was decided that his access to the company’s computer systems would be monitored.

During a week that Bagnall’s accesses were monitored, he accessed the data of 2,724 customers without

NHS General Data Protection Regulation (GDPR) guidance The national NHS GDPR working group and IGA have produced guidance to help the NHS, social care and partner organisations prepare for GDPR. The policy and guidance is being developed by the national GDPR working group, chaired

by NHS England, for publication by the Information Governance Alliance (IGA).

The IGA is the authoritative source of advice and guidance about the rules on using and sharing information in health and care. Those with senior responsibility for information governance can use the guidance to learn how to comply with the GDPR. This includes Caldicott Guardians, operational IG leads and managers, plus all employees.

While the IGA will cascade this information it is not able to answer specific enquiries relating to the regulations and points enquiries to the ICO’s office. The guidance is available here: <https://digital.nhs.uk/information-governancealliance/General-Data-Protection-Regulationguidance>.

his employer’s consent.

Customers whose data was accessed subsequently received unsolicited and at times aggressive marketing calls regarding their accidents and they were asked whether they wanted to pursue legal claims.

NARS reported Bagnall to the Information Commissioner’s Office (ICO). He made ‘no comment’ in a subsequent interview and declined to identify the person he sold the data to.

New report: Improving information sharing between Police and health services Information sharing between the Police and health services allows early intervention and preventative work to enable better care for patients, supports safeguarding and the promotion of welfare and improves public protection. It is important for the Police and the health services to find new ways to work together.

Effective information sharing improves services for members of the public, particularly in emergencies or when someone is near crisis.

Although individual examples of information sharing between the two organisation exist, there is still a need for this to happen on a much larger scale to enable the services they provide to be more joined up and ultimately improve the service for the public. The Centre of Excellence for Information Sharing’s website brings together a number of local examples of collaboration between the Police and the health services through improved information sharing to work together more effectively and deliver better services: <http://informationsharing.org.uk/ healthandpolice/>.

You can download a copy of the full report here: <http://informationsharing.org.uk/ download/2566/>.

The defendant pleaded guilty to unlawfully obtaining data in breach of s55 of the Data Protection Act 1998 when he appeared at Manchester and Salford Magistrates’ Court. A further charge of unlawfully disclosing data was also admitted and taken into consideration. Bagnall was fined £500 and was also ordered to pay £364 costs and a £50 victim surcharge

ICO Criminal Enforcement Manager Mike Shaw said: “This case serves as a warning to anyone who thinks they can make some quick and easy money selling people’s personal information. The consequences can be severe. Not only can it can lead to a day in court and the attendant media coverage, but it can cost a person their job and can damage their future career prospects.”

INFORMATION AND RECORDS MANAGEMENT SOCIETY 51

Man prosecuted and police force given undertaking after sensitive data leak on Twitter A Kent man, who posted sensitive police information on Twitter, has appeared in court after he admitted breaking the Data Protection Act. William Godfrey had previously been in a relationship with a probationary officer, and came into possession of a USB stick containing the data.

In July 2016, he tweeted the name and address of a vulnerable adult, along with details of their health and sexual life, to the accounts of the Information Commissioner’s Office (ICO), the Independent Police Complaints Commission and Surrey Police.

The ICO contacted him to ask him not to publish the material. Godfrey later failed to attend a meeting to hand over the USB stick and Surrey Police eventually had to take out an injunction to retrieve it.

Godfrey admitted two offences of unlawfully disclosing personal data in breach of s55 of the Data Protection Act when he appeared at Maidstone Crown Court, on Wednesday 17 January 2018.

He was sentenced to a 12-month conditional discharge, in part, because he had been placed on stringent bail conditions, including an electronic tag, before the hearing. He was also ordered to pay £150 costs and a £15 victim surcharge.

ICO Head of Enforcement Steve Eckersley said:

That same day, he e-mailed the ICO threatening to publish a 40-page document containing personal data, which included the details of a victim of a sexual offence, and became involved in a Twitter exchange with an independent user, who saw his tweet and warned him that he was breaking the law.

“People should always be careful about what they share on social media, both about themselves and others. But when it’s sensitive and confidential personal information that they have no right to see or possess in the first place, then we will not hesitate to take action to protect people’s rights.

It later emerged that a separate account, operated

by Godfrey, had tweeted Surrey Police 2 days earlier, disclosing the details of one named individual and the fact that they had been searched by police in relation to an offence.

”Surrey Police has also signed an undertaking to improve its procedures as a result of this case, and we are satisfied that many of our recommendations have already been taken on board.”

Former civil servant suing government after sensitive information reportedly revealed in e-mail A former civil servant is suing the government department where he worked after ‘highly sensitive’ medical information about him was reportedly revealed to a dozen colleagues in an e-mail, reports the Manchester Evening News.

52 BULLETIN 202 · MARCH 2018

Lawyers for Aftab Marchant have issued High Court proceedings against the Department for Work and Pensions (DWP) and are seeking damages of up to £50,000.

Only 9 % of companies are prepared for GDPR, and half don’t know where to begin The study, Data Protection Risks & Regulations in the Global Economy, asked more than 550 IT security and compliance professionals, involved with their companies’ global privacy and data security regulations, to weigh in on the top global security risks, as well as how prepared they feel their companies are to respond to a global data breach. The study found that more than half (51 %) of companies surveyed had experienced a global data breach, with nearly 56 % experiencing more than one breach in the past 5 years. Yet, despite these major security intrusions, 32 % of respondents noted that their respective

companies still don’t have a response plan in place.

Additional key findings from the study: • The General Data Protection Regulation (GDPR) notification requirements will be difficult to implement • Companies aren’t adequately prepared to respond to a global data breach • Companies fail to prioritise global regulations and remain sceptical about benefits

They claim Mr Marchant, who was a telephone agent at a DWP contact centre, suffered serious upset and distress having reportedly discovering ‘highly private’ information had been disclosed to workmates.

“It caused him considerable upset, anxiety, embarrassment and distress. He feels a profound sense of betrayal. He holds the DWP liable for the conduct of the employee who leaked the information.”

Mr Marchant is claiming damages for distress and personal injury, alleging a breach of the Data Protection Act. The incident has also been reported to the Information Commissioner’s Office (ICO).

Nick McAleenan, a data privacy law specialist at JMW Solicitors, said: “This case concerns a serious breach of confidentiality and misuse of our client’s private and very personal information.

Our client was devastated that extremely private and confidential information, relating to him and his family, was disclosed without his consent.

“Despite increasing reports of the damage caused by global data breaches, the study emphasises that the increasing risk of, as well as the experience of going through, a global data breach isn’t enough to lead CIOs and CSOs to prioritise compliance measures, in line with what is expected in the GDPR,” said Michael Bruemmer, Vice President, Experian Data Breach Resolution. “More emphasis is required from companies, especially those with a multinational footprint, to get ahead of impending global regulations and risks. They can start by conducting risk assessments and investing in new technologies, such as encryption, as well as considering appointing a Data Protection Officer to oversee compliance.”

For the full story, visit <http://www. manchestereveningnews.co.uk/news>

INFORMATION AND RECORDS MANAGEMENT SOCIETY 53

EC publishes GDPR guidance The European Commission (EC) has published guidance to facilitate a direct and smooth application of the new data protection rules across the EU, as of 25 May. The EC also launches a new online tool dedicated to smalland medium-sized enterprises (SMEs).

The guidance outlines what the EC, national data protection authorities and national administrations should still do to bring the preparation to a successful completion.

While the new regulation provides for a single set of rules directly applicable in all member

states, it will still require significant adjustments in certain aspects, like amending existing laws by EU governments or setting up the European Data Protection Board by data protection authorities.

The guidance recalls the main innovations; opportunities opened up by the new rules; takes stock of the preparatory work already undertaken; and outlines the work still ahead of the EC, national data protection authorities and national administrations.

54 BULLETIN 202 · MARCH 2018

Andrus Ansip, EC Vice President for the Digital Single Market, said: “Our digital future can only be built on trust. Everyone’s privacy has to be protected. Strengthened EU data protection rules will become a reality on 25 May. It is a major step forward and we are committed to making it a success for everyone.”

Véra Jourová, Commissioner for Justice, Consumers and Gender Equality, added: “In today’s world, the way we handle data will determine, to a large extent, our economic future and personal safety. We need modern rules to respond to new risks, so we call on EU governments, authorities

and businesses to use the remaining time efficiently and fulfil their roles in the preparations for the big day.”

EC calls on EU governments and data protection authorities to be ready and provide support Since the adoption of the General Data Protection Regulation (GDPR) in May 2016, the

EC has actively engaged with all concerned — governments, national authorities, businesses, civil society — to prepare the application of the new rules.

Preparations are progressing at various speeds across member states. At this stage, only two of them have already adopted the relevant national legislation. Member states should speed up the adoption of national legislation and make sure these measures are in line with the GDPR. They should also ensure they equip their national authorities with the necessary financial and human resources to guarantee their independence and efficiency.

The EC is dedicating 1.7 million to fund data protection authorities, but also to train data protection professionals.

A further 2 million is available to support national authorities in reaching out to businesses, in particular, SMEs. New online tool supporting practical application Knowledge of the benefits and opportunities brought by the new rules is not evenly spread.

There is, in particular, a need to step up awareness and accompany compliance efforts for SMEs. Today, the EC launches a new practical online tool to help citizens; businesses, in particular, SMEs; and other organisations to comply and benefit from the new data protection rules.

The EC will also engage in events organised across the member states to help the stakeholders in their preparation efforts and inform the citizens about the impact of the GDPR. Recalling the main innovations and new opportunities The GDPR enables the free flow of data across the Digital Single Market. It will better protect the privacy of Europeans and reinforce trust and security for consumers, while, at the same time, opening up new opportunities for businesses, especially smaller ones.

The guidance recalls the main elements of the new data protection rules: • One set of rules across the continent, guaranteeing legal certainty for businesses and the same data protection level across the EU for citizens.

• Same rules apply to all companies offering services in the EU, even if these companies are based outside the EU. • Stronger and new rights for citizens: the right to information, access and the right to be forgotten are strengthened. A new right to data portability allows citizens to move their data from one company to another. This will give companies new business opportunities.

• Stronger protection against data breaches: a company experiencing a data breach, which put individuals at risk, has to notify the data protection authority within 72 hours.

• Rules with teeth and deterrent fines: all data protection authorities will have the power to impose fines for up to €20 million or, in the case of a company, 4% of the worldwide annual turnover.

NEXT STEPS In the run up to 25 May, the EC will continue to actively support member states, data protection authorities and businesses to ensure the reform is ready to enter into effect. From May 2018 onward, it will monitor how member states apply the new rules and take appropriate action as necessary. One year after the GDPR enters into application (2019), the EC will organise an event to take stock of different stakeholders’ experiences of implementing the GDPR. This will also feed into the report the EC is required to produce by May 2020 on the evaluation and review of the GDPR.

INFORMATION AND RECORDS MANAGEMENT SOCIETY 55

Top accolade for nuclear recordkeeping The meticulous approach to managing historical records at the Nucleus archive has secured the highest accolade from the government’s records regulator.

‘Place of Deposit’ (PoD) status was granted

by The National Archives at Kew (TNA) and National Records of Scotland in December 2017, on schedule, after a comprehensive assessment of all operational aspects at the £20 million facility near Wick. It is one of the largest repositories outside London to be accredited by the TNA. This means Nucleus (The Nuclear and Caithness Archives) has met all of the UK’s stringent criteria for the safeguarding, preserving and cataloguing of important public information on behalf of the government.

Martin Robb, Programme Manager for the Nuclear Decommissioning Authority’s (NDA) Information Governance Programme, which is responsible for records management, said: “Our specialist contractor, Restore Ltd, has worked incredibly hard to secure PoD status and we’re extremely proud of their achievement.”

The news comes just weeks after the facility’s sleek, angular lines impressed judges in the annual Architects’ Journal awards, collecting two of the top trophies: Editor’s Choice and Public Building of the Year. Edinburghbased Reiach and Hall Architects feature the stunning design on the home page of their website.

Nucleus, located next to Wick airport in Caithness, Scotland, opened its doors for business early in 2017 and a programme is currently underway to transfer records from all of the NDA’s sites across the UK, which is 56 BULLETIN 202 · MARCH 2018

Photography © Tricia Malley Ross Gillespie www.broaddaylightltd.co.uk

estimated to take 4 years. This painstaking ‘sift and lift’ process requires millions of documents to be examined before being either destroyed or carefully indexed and packaged for the move north.

Eventually, decades-worth of NDA records, both digital and hard copy, will be housed at Nucleus, where they will be available for ongoing research. Importantly, Nucleus is also the central repository for the vital waste records associated with delivering a geological disposal facility and deferred decommissioning.

Dounreay’s photographic collection was the set of first nuclear records transferred to Nucleus, followed by the industry-wide epidemiological records.

Martin added: “With PoD status now secured, we can really begin the full-scale transfer of records.

The collection from Harwell is next in line, followed closely by Dounreay records and then the stored material from Hinton House and other stores in Warrington.”

‘Archives in Liquid Times’: A new publication about philosophy and theory on archives ‘Archives in Liquid Times’ aims to broaden and deepen thinking about archives in today’s digital environment. It is a book that tries to fuel the debate about archives in different fields of research. It shows that, in these liquid times, archives need and deserve to be considered from different angles. ‘Archives in Liquid Times’ is a publication in which archival science is linked to philosophy (of information) and data science. Not only do the contributors try to open windows to new concepts and perspectives, but also to new uses of existing concepts concerning archives.

“Each collection of records requires a full programme of careful examination, destruction, where appropriate – duplicates, for example – and then indexing, packaging, transfer, preservation if required and cataloguing at Nucleus.”

Sellafield alone has more than 130,000 boxes of archived records in off-site storage, plus material on site and in various offices.

Magnox Ltd, with 12 sites, has a similar-sized collection in storage – estimated to stretch, if laid out, to more than 120km worth of paperwork. The number of electronic records held across the estate, meanwhile, is believed to number hundreds of millions.

The articles in this book contain philosophical reflections, speculative essays and presentations of new models and concepts alongside well-known topics in archival theory. Among the contributors are scholars from different fields of research, like Wolfgang Ernst, Geoffrey Yeo, Martijn van Otterlo, Charles Jeurgens, Anne Gilliland and Geert-Jan van Bussel.

This book includes interviews with Luciano Floridi and Eric Ketelaar, in which they reflect on key issues arising from the contributions. The editors are Frans Smit, Arnoud Glaudemans and Rienk Jonker.

The book is published by the Dutch Society for Archival Publications (S@P). It is available as a free digital download in PDF and EPUB formats.

‘Archives in Liquid Times’ is available from: • Royal Dutch Association of Archivists: <http://kvan.nl/ publicaties/s-p> (PDF and EPUB) • The website of co-editor Rienk Jonker: <https://lnkd.in/ gnDwbjp> (PDF and EPUB) • Open Access Library: <http://www.oapen.org/search?identifier =641001;keyword=Archives> (PDF) • academia.edu: <https://www.academia.edu/35423093/ Archives_in_Liquid_Times> (PDF) For any questions regarding the publication, please contact co-editor Frans Smit on <info@fpsmit.nl>.

INFORMATION AND RECORDS MANAGEMENT SOCIETY 57

IRMS Public Sector Group GDPR event at Westminster Archives – 29 September 2017 (sponsored by AI) Sarah Graham

9.30am Elizabeth Barber, our esteemed Chair, opened proceedings by thanking everyone for attending and thanking Automated Intelligence (AI) for sponsoring and running the meeting today.

In a nutshell, organisations need to do the right thing… and be able to demonstrate that they are doing the right thing.

9.40am Ian Carter (AI) Introduction to AI and the challenges facing organisations, in terms of costs and productivity.

Ian took the group through the background to AI and the way that their systems and products can help with compliance with General Data Protection Regulation (GDPR).

9.50am – 10.35am Melody Allsebrook (AI & IRMS SPOG Chair & Groups Officer) 1.15pm – 2pm Melody Allsebrook (AI & IRMS SPOG Chair & Groups Officer)

Organisations need to look at their procedures and ensure that they are GDPR compliant… or will ensure compliance after May 2018. right to

The time is change the law, as there have been an enormous amount of changes in technology and information usage since the original Data Protection Act in 1998.

Melody started her presentation by noting that GDPR was the biggest change in Data Protection law for 20 years… so this is quite a challenge for everyone in the UK. The time is right to change the law, as there have been an enormous amount of changes in technology and information usage since the original Data Protection Act in 1998.

Melody moved on to discuss the new principles for GDPR: • Lawfulness, fairness and transparency • Purpose limitation • Data minimisation 58 BULLETIN 202 · MARCH 2018

• Accuracy • Storage limitation • Integrity and confidentiality

NB: If you are a member of the Public Sector Group, you can access Melody’s presentation on the website. It is a recommended read for anyone out there working to comply with GDPR.

Achieving SharePoint governance 10.35am – 11.20am Eamon O’Connor/Paul Hudson (AI) Enhanced governance, productivity and end-user adoption of O365 Eamon and Paul noted that the presentation was going to consider the following key areas in terms of implementing SharePoint governance.

• Governance plan • Planning and strategy • Architecture • Roles and responsibilities • Rules, procedures, processes • Content management

Key elements of the governance plan and planning/strategy sections should be an information audit and clear communications to staff throughout the organisation.

Eamon and Paul then moved on to discuss the architecture section of the implementation – the architecture should consider: • site structure • navigation • searching • classification With regards to content management, it was noted that as much automation as possible is the key. Then it’s key to have user training for all staff, so they understand how the new system works.

11.35am – 12.20pm Steve Sharpe (Lan2Lan) Digital transformation – behavioural and cultural changes Steve noted that cultural and behavioural change is the key to successful implementation of a new

20% DISCOUNT for IRMS Members Healthcare Conferences UK organises and produces high quality CPD approved conferences and exhibitions including events focusing on the appropriate and effective management and handling of patient information, data and records.

system. The technology could be the best in the world, but, if the users are not bought in to using it, the project will fail.

1pm – 1.15pm Ian Carter (AI) AI positioning on GDPR Ian took the group through the various solutions that AI have developed in order to address the GDPR challenge.

2pm – 2.30pm Eamon O’Connor (AI) Your data: Discover it, protect it, manage it Eamon provided a demonstration of how to navigate through a SharePoint site and find relevant information.

He demonstrated search functions and discovery within SharePoint.

The Author Sarah Graham, Secretary, IRMS Public Sector Group.

Sarah can be contacted at <sarah.graham7@nhs.net>

20% course fee discount for all IRMS members IRMS wishes to thank Tribal’s Information Matters Team for their kind offer of a 20% course fee discount available to all IRMS members on the standard course list price for all Information and Records Management Public access courses.

Please contact info@irms.org.uk for details

We are pleased to offer IRMS members a 20% discount which can be claimed by quoting ref: hcuks20irms when booking. visit www.healthcareconferencesuk.co.uk or please contact hanisha@hc-uk.org.uk or call 01932 429933 INFORMATION AND RECORDS MANAGEMENT SOCIETY 59

IRMS Public Sector Group GDPR event at Westminster Archives – 1 December 2017 (sponsored by AI) 10am Elizabeth Barber, our esteemed Chair, opened proceedings by thanking everyone for attending 10.15am Keynote Speaker: Helen Trudgeon, Head of Marketing (Sue Hill Recruitment) Social media and records management Helen presented a lively, interactive session which discussed ‘the good, the bad and the ugly’ about social media. There were lots of examples of the use of Facebook and Twitter, which fell into all three categories. After a presentation session, the room was split into four groups, where discussion took place as to the management of social media

in terms of records management requirements.

One group raised the issue of WhatsApp – some authorities/public sector bodies use it and others do not. There was also some interesting discussion with regards to public and private profiles and the need to keep a distinguishing line between them.

11.45am Alison North (Alison North Associates Limited) The future of records management Alison presented a unique session with regards to records management and the future of the 60 BULLETIN 202 · MARCH 2018

profession. She noted the difficulty of the definition of ‘records management’ and the need for records professionals to have a clarity of purpose.

Records management needs to be closely linked to ethics and integrity. There was much discussion in the room about the need to bring records management into the 2020s as a much-needed skill set.

Much, much food for thought here!

2pm Paul Gibbons (FOI Man UK) GDPR and public engagement We welcomed our esteemed colleague Paul Gibbons to the group. Paul came to the group to discuss public engagement and the Freedom of Information Act. We kicked off with discussions around principle 1 of the new GDPR, which is around processing being ‘fair and lawful’. When the GDPR first arrived, there was concern around Article 6, which states that public authorities cannot rely on legitimate interests as a lawful basis for processing… this was a concern in terms of responding to Freedom of Information requests.

Paul pointed out that Schedule 18 of the Data Protection Bill amends the Freedom of Information Act Section 40 to note that public bodies CAN use legitimate interests for requests. Many in the room breathed a sigh of relief!

There was then some discussion around the need for privacy notices to be robust and visible to the public in order to fulfil GDPR requirements.

The presentations from this session will be available for members of the IRMS Public Sector Group on the website in due course.

The Author Sarah Graham, Secretary, IRMS Public Sector Group.

Sarah can be contacted at <sarah.graham7@nhs.net>

diary 2018

March–May

06 March · Preston · IRMS North Spring 2018 Event The agenda includes GDPR readiness, SharePoint and MS 365 implementation and legal recordkeeping. With opportunities to network and discuss issues of importance to your organisation with colleagues from across the region. Those interested can register for the event from the North Group pages of the IRMS Website and IRMS members will be able to access a PDF copy of the agenda. <http://irms.org.uk/events/EventDetails. aspx?id=1054223&group=> 07 March · Glasgow · Records Management 1 - PDP Training Organisations face increasing pressure to manage their records according to statutory and business requirements. As the use of electronic records and the deployment of electronic document and records management systems continue to increase, the core skills of the person responsible for records management become ever more important to the organisation. In many cases, appropriate data protection and Freedom of Information (FOI) compliance will depend upon a good records management system.

This invaluable training session, led by John Wilson, examines core concepts of good records management practice. Records Management 1 is an introductory level session that provides delegates with a thorough grounding in the fundamentals of records management, including: • introduction – basic concepts • records management tools • records life cycle approach • designing a file plan • records destruction • legal framework/compliance • management of electronic records and e-mail Delegates are encouraged to share their own experiences at the session. The day will be a

mixture of presentation and practical exercises.

There will be plenty of opportunity for questions.

A discount is available for delegates booking both Records Management 1 and Records Management 2.

For further information and booking details, see: <http://www.pdptraining.com/find-a-trainingcourse/56-records-management-1>.

08 March · Glasgow · Records Management 2 – PDP Training This course examines how to implement good records management practice. Led by John Wilson, Records Management 2 is an intermediatelevel session that provides a grounding in the fundamentals of records management, including: • introduction – initiating a records management project • records audit • process mapping • building a business classification scheme • measuring performance • EDRMS • sustaining a records management programme Delegates are encouraged to share their own experiences at the session. The day will be a mixture of presentation and practical exercises.

There will be plenty of opportunity for questions.

Delegates electing to attend only the Records Management 2 course should have a knowledge of basic records management principles, including classification, metadata and retention, which are covered in the Records Management 1 training course.

A discount is available for delegates booking both Records Management 1 and Records Management 2.

For further information and booking details, see: <http://www.pdptraining.com/find-a-trainingcourse/123-records-management-2> >>>>> INFORMATION AND RECORDS MANAGEMENT SOCIETY 61

>>>>> diary 2018 continued 13 March · Birmingham · The SharePoint and Office 365 Feast An opportunity for networking and seeing some practical demonstrations and case studies of SharePoint use and management, as well as showcasing some Office 365 features. Also includes a large side helping of GDPR compliance. <http://irms.org.uk/events/EventDetails. aspx?id=1055087&group=> 16 March · Caldicott Guardian Training Course Facilitated by Christopher Fincken, Independent Member UK Caldicott Guardian Council (Chairman 2012–2017), this 1-day training course about Caldicott Guardian Principles has been developed to provide both practical and appropriate training for experienced Caldicott Guardians, their deputies and others involved in delivering the Caldicott Guardian Function in a wide range of organisations.

The day will provide sound foundations for those seeking to understand the Caldicott Guardian Role, and inspiration as to how it can be developed in their own organisations based on the latest National Guidance. The course is fully interactive, and participants in small groups will face a number of case-study challenges throughout the day, building personal knowledge, understanding and confidence. For further information and to book your place visit: <http://www.healthcareconferencesuk.co.uk/ courses/caldicott-guardian-training.html> Our 10% discount is available by quoting ref: HCUK10IRMS when booking. (Cannot be used in conjunction with any other offer. Full T&Cs available upon request.)

16 March · London · IRMS Public Sector Event: GDPR This session will on focus on GDPR – more information coming soon... we are in the process of contacting speakers... <http://irms.org.uk/ events/EventDetails.aspx?id=1058595&group=> 16 March · London · Digital Imaging 2018: Radiology Information Systems and PACS This 1-day conference will examine how to work with digital imaging, radiology information systems and PACS to deliver the national ambition of a 62 BULLETIN 202 · MARCH 2018

paperless and filmless NHS, improving imaging services and timeliness.

Our 10% discount is available by quoting ref: HCUK10IRMS when booking. (Cannot be used in conjunction with any other offer. Full T&Cs available upon request.) <http://www.healthcareconferencesuk.co.uk/ radiology-information-systems-and-pacs> 23 March · London · The Caldicott Guardian in General Practice Summit HCUK are pleased to announce the National Caldicott Guardian in General Practice Summit. The conference will be chaired and has been produced in association with Christopher Fincken, past Chair and member of, The UK Caldicott Guardian Council, and will include national developments and local case studies on how the role is developing in primary care.

The conference aims to bring current and aspiring Caldicott Guardians together to understand current issues and the national context, and to debate and discuss key issues and areas they are facing in practice. The conference will also discuss the implications of the GDPR for General Practice.

Our 10% discount is available by quoting ref: HCUK10IRMS when booking. (Cannot be used in conjunction with any other offer. Full T&Cs available upon request.) <http://www.healthcareconferencesuk.co.uk/ caldicott-guardian-general-practice> 09 April · London · Records Management 1 – PDP Training See 7 March for full details.

10 April · London · Records Management 2 – PDP Training See 8 March for full details.

16 April · London · Advanced Records Management – PDP Training This training course, led by John Wilson, provides an in-depth analysis of the key issues and challenges facing those responsible for the management of records and information in the current business environment. This training session is designed to meet the needs of senior and more experienced practitioners and builds on the basic and intermediate skills and techniques covered in the Records Management 1 and Records Management 2 training courses.

Topics covered include: • Information governance • Dealing with risk • Records management policy development • Embedding good records management practice • Records migration and dealing with legacy records • Digital continuity – managing electronic records over time Delegates are encouraged to share their own experiences at the session. The day will be a mixture of presentation and practical exercises.

There will be plenty of opportunity for questions.

For further information and booking details, see: <http://www.pdptraining.com/find-a-trainingcourse/240-advanced-records-management>

27 April · Manchester · Advanced Records Management – PDP Training See 16 April for full details.

27 April · Caldicott Guardian Training Course See 16 March for full details.

17 May · Dublin · Records Management 1 – PDP Training See 7 March for full details.

18 May · Dublin · Records Management 2 – PDP Training See 8 March for full details.

25 May · Caldicott Guardian Training Course See 16 March for full details.

Go to <http://www.irms.org.uk/events> for an up-to-date list of all forthcoming events, and join the IRMS groups on our website to be notified when

new events are added. If you’d like to get involved – including by hosting, sponsoring or speaking at one of our events – please e-mail <groups@irms.org.uk>. To advertise an event in the Bulletin, e-mail <communications@irms.org.uk>; please note the copy deadline on page 2, and that due to space restrictions we cannot guarantee that all events are included.

Newly updated

Records Management for Schools The IRMS Records Management Toolkit for Schools is essential reading for anyone working in records and information management within schools.

It covers all aspects of records management, and includes useful templates, standards, advice and guidance.

It is available to download now from <www.irms.org.uk/resources>

INFORMATION AND RECORDS MANAGEMENT SOCIETY 63

new members march 2018 Since the beginning of 2018, 41 new members have joined IRMS. Amongst those recently joining are:

individual members

Lauren McEwan Stephen Outhwaite

corporate members

Philippa Bell

Laura Smales

IMMJ Systems

Alison Cable

Gareth Symons

Millnet Document

Matt Charge

Caroline Todd

Services

Joseph Dixon

Des Ward

Nursing and Midwifery

Cillian Fearon

David Willcox

Council

Richard Franklin

David Wise

Oâ&#x20AC;&#x2122;Neil Software Ltd

Lucy Greaney

Richard Young

Rotherham Council

affiliate members

student members

Mollie Kerry

Benidra Beauty

Romhel Delos Santos

Helen Lawrenson

Peter Coghlan

Kirsty McKie

Donald MacKinnon

Pearl Daley

Kicki Olsson

Helen Manners-Vaughan

Christopher Willson

Sam Thomas

Antony Haworth Nicola Hubberstey Patrick Hughes Konrad Kawalec

Amanda Marshall

dilbert

64 BULLETIN 202 ¡ MARCH 2018

Lucy Nutbeem

IRMS CONFERENCE

20-22 05 2018

BACK TO THE FUTURE FROM BEST PRACTICE TO INNOVATION

KEYNOTE SPEAKERS INCLUDE:

David Bowen

Audata Ltd

Louise Byers

Head of Risk and Governance, ICO

Morag Fyfe

Archivist, United Nations Mechanism for International Criminal Tribunals

Elizabeth Lomas

Senior Lecturer - Information Governance, University College London

Tim Pitt Payne

Senior Barrister - Information Law, 11KBW

John Sheridan

Digital Director, The National Archives

Atle Rod Skjekkeland Stone Senior Vice President, AIIM

Policy Manager, Royal Bank of Scotland (RBS)

IRMS CONFERENCE 2018 · 20 – 22 MAY · HILTON BRIGHTON BOOK YOUR PLACE AT EUROPE’S PREMIER INFORMATION AND RECORDS MANAGEMENT EVENT NOW AT WWW.IRMSCONFERENCE.ORG.UK

G D P R ARE YOU READY ?

General Data Protection Regulation comes into force on May 25, 2018

It applies to us all Make sure your business isnâ&#x20AC;&#x2122;t at risk by talking to our team today.

Scan it...

Host it...

Shred it...

Visit ascentas.co.uk or call 0800 075 2625