Blue Paper on Data Protection - A Data Breach Accountability Framework
How to reduce the risk of GDPR sanctions (Professional Publication, 2nd edition)
Published on 1. June 2021
Book
Paperback/Softback
270 pages
978-1-908585-16-5 (ISBN)
Description
This second edition provides updated diagrams and information on the legal position of the General Data Protection Regulation (GDPR) on data security and data breaches. In particular, it presents a legally defensible compliance position for organisations in the form of a practical Accountability Framework for handling actual data breaches.
A new section provides a systematic approach to addressing technical and organisational control failures for which DPSAs have imposed heavy fines on organisations in the recent past. There is a simple checklist that can help guide organisations to minimise data breaches, while at the same time strengthening their defensible position by demonstrating to regulators that best practices have in fact been followed.
This revised Blue Paper is best guidance for professionals, politicians, scholars, and all who wish to glean more insight into how to develop a robust data protection framework. What readers will find in this Blue Paper will empower them to assess their real situation and will aid them in conceptualising practical solutions.
A new section provides a systematic approach to addressing technical and organisational control failures for which DPSAs have imposed heavy fines on organisations in the recent past. There is a simple checklist that can help guide organisations to minimise data breaches, while at the same time strengthening their defensible position by demonstrating to regulators that best practices have in fact been followed.
This revised Blue Paper is best guidance for professionals, politicians, scholars, and all who wish to glean more insight into how to develop a robust data protection framework. What readers will find in this Blue Paper will empower them to assess their real situation and will aid them in conceptualising practical solutions.
More details
Series
Language
English
Place of publication
London
United Kingdom
Target group
Professional and scholarly
Dimensions
Height: 1778 mm
Width: 254 mm
ISBN-13
978-1-908585-16-5 (9781908585165)
Copyright in bibliographic data and cover images is held by Nielsen Book Services Limited or by the publishers or by their respective licensors: all rights reserved.
Schweitzer Classification
Content
FOREWORD: Data Breaches and information security provisions provide ongoing challenges for organisations (Professor Ian Walden)
ACKNOWLEDGEMENTS
TABLE OF CONTENTS
LIST OF ACRONYMS
LIST OF FIGURES
EXECUTIVE SUMMARY
PART I: OVERVIEW OF THE BLUE PAPER; THE LEGAL POSITION ON DATA SECURITY AND BREACHES
1. INTRODUCTION
1.1 Key objectives, assumptions and value for data controllers
1.2 Scope of this Blue Paper
1.3 Structure of this Blue Paper
1.4 Methodology applied and resources used
2. THE LEGAL POSITION OF THE GDPR ON DATA SECURITY AND DATA BREACHES
2.1 Why data breaches occupy a unique position
2.2 The integrity and confidentiality principle (Article 5(1)(f))
2.3 The legal definition of security of processing (Article 32) and DPIAs
(Article 35)
2.4 Safeguarding the rights of data subjects through PbD&D (Article 25)
2.5 The relevance of data breach notifications (Articles 33 and 34)
2.6 Cooperation and prior consultation with the DPSA (Articles 31 and 36)
2.7 The concept of "demonstrating" compliance with the Regulation
2.8 Demonstrating risk prevention and damage mitigation
3.9 Conclusions of the legal review
PART II: INSIGHTS FROM REGULATORS AND DATA PROTECTION PRACTITIONERS
3. THE EMPIRICAL DATA: ANALYSIS OF DATA BREACHES
3.1 Sanctions by national DPSAs
3.2 Sanctions for data breaches vs. other GDPR provisions that carry liability
3.3 The consistency of enforcement across the EEA
3.4 GDPR sanctions by DPSAs (Sanctions Directory)
3.5 Case studies: Lessons to be learned for after the data breach
3.5.1 Case One: Doorstep Dispensaree Ltd.
3.5.2 Case Two: Cathay Pacific Airways Ltd.
3.5.3 Case Three: WM Morrison Supermarkets plc
3.5.4 Case Four: British Airways
3.5.5 Case Five: Marriott International
3.6 A systematic approach to address compliance failures for which DPSAs fined organisations
4. HOW CAN ORGANISATIONS PROTECT THEMSELVES FROM DATA BREACH SANCTIONS?
4.1 Insights obtained by survey respondents who are professionals in the data protection field
4.1.1 Governance and policy
4.1.2 Processes and procedures
4.1.3 Technology
4.1.4 DPSA response to data breaches
4.2 Insights obtained from author's participant observation of privacy events
4.2.1 Governance and policy
4.2.2 Processes and procedures
4.2.3 Technology
4.3 Implement appropriate technical and organisational security measures
4.4 Demonstrate compliance: Independent assurance and approved certifications
4.5 Synthesis for practitioners
PART III: A NEW COMPLIANCE MODEL: THE DATA BREACH ACCOUNTABILITY FRAMEWORK
5. CONCLUSIONS: HOW ORGANISATIONS CAN IMPROVE THEIR COMPLIANCE MATURITY
5.1 DPR enforcement by national DPSAs and oversight at European level
5.2 Building a legally defensible compliance position: The Data Breach Accountability
BIBLIOGRAPHY
TOOLKITS - Resources for Professionals
Toolkit 1: Tables analysing the results of the data breach survey
Toolkit 2: Survey questionnaire
Toolkit 3: Tables and diagrams analysing the results of the GDPR enforcement and sanctions review
Toolkit 4: GDPR Sanctions Directory
Toolkit 5: Inventory of European Data Protection bodies
Toolkit 6: Inventory of EEA national Data Protection Supervisory Authorities (DPSAs)
Index
ACKNOWLEDGEMENTS
TABLE OF CONTENTS
LIST OF ACRONYMS
LIST OF FIGURES
EXECUTIVE SUMMARY
PART I: OVERVIEW OF THE BLUE PAPER; THE LEGAL POSITION ON DATA SECURITY AND BREACHES
1. INTRODUCTION
1.1 Key objectives, assumptions and value for data controllers
1.2 Scope of this Blue Paper
1.3 Structure of this Blue Paper
1.4 Methodology applied and resources used
2. THE LEGAL POSITION OF THE GDPR ON DATA SECURITY AND DATA BREACHES
2.1 Why data breaches occupy a unique position
2.2 The integrity and confidentiality principle (Article 5(1)(f))
2.3 The legal definition of security of processing (Article 32) and DPIAs
(Article 35)
2.4 Safeguarding the rights of data subjects through PbD&D (Article 25)
2.5 The relevance of data breach notifications (Articles 33 and 34)
2.6 Cooperation and prior consultation with the DPSA (Articles 31 and 36)
2.7 The concept of "demonstrating" compliance with the Regulation
2.8 Demonstrating risk prevention and damage mitigation
3.9 Conclusions of the legal review
PART II: INSIGHTS FROM REGULATORS AND DATA PROTECTION PRACTITIONERS
3. THE EMPIRICAL DATA: ANALYSIS OF DATA BREACHES
3.1 Sanctions by national DPSAs
3.2 Sanctions for data breaches vs. other GDPR provisions that carry liability
3.3 The consistency of enforcement across the EEA
3.4 GDPR sanctions by DPSAs (Sanctions Directory)
3.5 Case studies: Lessons to be learned for after the data breach
3.5.1 Case One: Doorstep Dispensaree Ltd.
3.5.2 Case Two: Cathay Pacific Airways Ltd.
3.5.3 Case Three: WM Morrison Supermarkets plc
3.5.4 Case Four: British Airways
3.5.5 Case Five: Marriott International
3.6 A systematic approach to address compliance failures for which DPSAs fined organisations
4. HOW CAN ORGANISATIONS PROTECT THEMSELVES FROM DATA BREACH SANCTIONS?
4.1 Insights obtained by survey respondents who are professionals in the data protection field
4.1.1 Governance and policy
4.1.2 Processes and procedures
4.1.3 Technology
4.1.4 DPSA response to data breaches
4.2 Insights obtained from author's participant observation of privacy events
4.2.1 Governance and policy
4.2.2 Processes and procedures
4.2.3 Technology
4.3 Implement appropriate technical and organisational security measures
4.4 Demonstrate compliance: Independent assurance and approved certifications
4.5 Synthesis for practitioners
PART III: A NEW COMPLIANCE MODEL: THE DATA BREACH ACCOUNTABILITY FRAMEWORK
5. CONCLUSIONS: HOW ORGANISATIONS CAN IMPROVE THEIR COMPLIANCE MATURITY
5.1 DPR enforcement by national DPSAs and oversight at European level
5.2 Building a legally defensible compliance position: The Data Breach Accountability
BIBLIOGRAPHY
TOOLKITS - Resources for Professionals
Toolkit 1: Tables analysing the results of the data breach survey
Toolkit 2: Survey questionnaire
Toolkit 3: Tables and diagrams analysing the results of the GDPR enforcement and sanctions review
Toolkit 4: GDPR Sanctions Directory
Toolkit 5: Inventory of European Data Protection bodies
Toolkit 6: Inventory of EEA national Data Protection Supervisory Authorities (DPSAs)
Index