Electric Magazine May/June 2018

ELECTRIC.IE • The Magazine & Website for the Irish Electrical Industry • 15 Industry News GDPR – The Elephant in the Board Room - GDPR is fast approaching, and it is a heavy topic. A recent study in the UK has shown that 35% of leaders in the construction industry do not know what GDPR is, while at the same time cyber crime in this sector is increasing •›•–‡• ƒ† ƒ—ƒŽ ƤŽ‡• ‘ ƒ need to know basis. Šƒ– ƒ”‡ –Š‡ ’‡ƒŽ–‹‡• ˆ‘” ‘– …‘’Ž›‹‰ ™‹–Š –Š‡ ǫ The most prominent information regarding GDPR so far is in relation –‘ –Š‡ ˜ƒ•–Ž› •‹‰‹Ƥ…ƒ– ‹…”‡ƒ•‡ ‹ Ƥ‡• ˆ‘” ‘Ǧ…‘’Ž‹ƒ…‡ Ǧ —’ –‘ ͆͜͞ ‹ŽŽ‹‘ ‘” ͠τ ‘ˆ ƒ—ƒŽ ‰Ž‘„ƒŽ turnover, whichever is higher. The ‡‰—Žƒ–‘”ǡ Š‡ ƥ…‡ ‘ˆ –Š‡ ƒ–ƒ Protection Commissioner, will have a degree of discretion as to ™Š‡–Š‡” –‘ ‹’‘•‡ ƒ Ƥ‡ ƒ† –Š‡ Ž‡˜‡Ž ‘ˆ –Šƒ– Ƥ‡Ǥ Šƒ– †‹•…”‡–‹‘ will ultimately come down to how complaint your organisation is. …‡ –Š‡ Ǧ‡ơ‡…–‹˜‡ †ƒ–‡ ‘ˆ ͞͡–Š ƒ› ƒ””‹˜‡•ǡ ‹– ‹• †‡Ƥ‹–‡Ž› not “tools down”, so to speak. Your organisation's preparation for this deadline should be seen as a once- ‘ơ ’”‘Œ‡…– ™‹–Š –Š‡ ”‡ƒŽ ‰‘ƒŽ –‘ attain ongoing compliance. Build data protection into your systems and processes from the outset, so that the security of personal data can no longer be an afterthought. If you are ahead of the game, you ƒ› Ƥ† ›‘—”•‡Žˆ ƒ– ƒ…‘’‡–‹–‹˜‡ advantage over your peers when it comes to tendering for business. There is still time to get your house in order so don’t panic and remember “When eating an elephant take one bite at a time”. Lorraine Valentine ‡‰—Žƒ–‘”› ‘’Ž‹ƒ…‡ Ƭ ˆ‘”ƒ–‹‘ ‡…—”‹–› ’‡…‹ƒŽ‹•–ǡ ‡•‹‘ †‹‹•–”ƒ–‹‘ ‡”˜‹…‡• Šƒ–ƒ”‡–Š‡•–‡’•›‘—”‘”‰ƒ‹•ƒ–‹‘ …ƒ –ƒ‡ –‘ ’”‡’ƒ”‡ ˆ‘” ǫ 1. Š‡ ˆ—†ƒ‡–ƒŽ Ƥ”•– •–‡’ is to carry out a data audit to understand the types of data that you hold, where it is stored, and who has access to it. Your organisation should also prepare ƒ ˜‹•—ƒŽ ƒ’ ‘ˆ –Š‡ ƪ‘™ ‘ˆ †ƒ–ƒ into, within and out of your organisation to fully understand your data processes. 2. –ƒơ –”ƒ‹‹‰ ‹• ‘‡ ‘ˆ –Š‡ ‘•– crucial parts of GDPR . Training needs will vary depending on roles. However, as most data breaches happen as a result of Š—ƒ ‡””‘”ǡ ‡•—”‹‰ •–ƒơ Šƒ˜‡ an understanding of the law, as ™‡ŽŽ ƒ• –Š‡ Ƥ‡• ƒ† ”‡’—–ƒ–‹‘ƒŽ damage their company could be subject to, is key. 3.Update your data protection policies and procedures to ensure these are GDPR compliant. 4.There are mandatory provisions under GDPR that must be in place with vendors that process data on your behalf; your organisation will therefore need to review these contracts with third party suppliers. 5.Some basic measures that you could start right now to keep data secure are to ensure laptops are encrypted, ensure your organisation operates a clean desk and clear screen policy, and that employees are only allowed to access information on your O ‡…ƒ ‘Ž› ƒ••—‡ –Šƒ– –Š‡ ƒ™ƒ”‡‡•• ‘ˆ ƒ† ‹–• ‹’Ž‹…ƒ–‹‘• ˆ‘” –Š‡ •‡…–‘” ‹• –Š‡ •ƒ‡ Š‡”‡Ǥ  –Š‹• ƒ”–‹…Ž‡ ™‡ ƒ‹ –‘ •Š‡† •‘‡ Ž‹‰Š– ‘ ™Šƒ– ‹• ƒ† Š‘™ ‘”‰ƒ‹•ƒ–‹‘•…ƒ ’”‡’ƒ”‡ ˆ‘” –Š‹• ‡™ Ž‡‰‹•Žƒ–‹‘Ǥ ‘ ™Šƒ– ‹• ǫ The General Data Protection Regulation (GDPR) is designed to help safeguard data protection rights for individuals. It also introduces a single set of rules across the EU when it comes to how organisations handle data relating to individuals. GDPR is the most •‹‰‹Ƥ…ƒ–…Šƒ‰‡ –‘ –Š‡ —”‘’‡ƒ data protection regime in over 20 years. Š‡ ™‹ŽŽ ‹–…‘‡ ‹–‘ ‡ơ‡…–ǫ The General Data Protection Regulation (GDPR) will come into force on the 25th May 2018. Š‘ ™‹ŽŽ „‡ ƒơ‡…–‡† „› –Š‡ ǫ All organisations that process the data of EU citizens, irrespective of size and location, will need to be compliant with GDPR. There appears to be a common misconception that small companies fall outside the scope of GDPR, but this is not the case. There are some exemptions under GDPR for small and medium-sized enterprises, but these need to be carefully examined. Šƒ– –›’‡• ‘ˆ †ƒ–ƒ ˆƒŽŽ —†‡” –Š‡ ǫ ‡”•‘ƒŽ †ƒ–ƒ ‹• †‡Ƥ‡† ˜‡”› broadly and essentially means any information that can lead to the ‹†‡–‹Ƥ…ƒ–‹‘ ‘ˆ ƒ ‹†‹˜‹†—ƒŽǤ Vast amounts of personal data is processed in the construction industry; examples include contact details, employee data, client data, CCTV imagery, health and safety data and data collated from site access cards and wearable technology.