This May, the General Data Protection Regulation (AVG) will be introduced. From 25 May, the same privacy laws will apply across the EU. The AVG has major consequences for companies, including in the manufacturing industry.
Manufacturers that have not carried out a privacy impact assessment by now are out of step and in "big trouble", according to Guy Jeurissen of Belgium's Computable. In a recently published article, he sets out the challenges that the AVG legislation will bring to manufacturing companies. 'Only a global, risk-based approach that puts the lifecycle of data at the centre can still get these entrepreneurs out of trouble.'
All companies that collect and use personal data must comply with the AVG. The new European privacy legislation is much in the news at the moment, yet Jeurissen stresses that plant directors need to look beyond marketing into sales. These are traditionally departments where a lot is done with customer data, but the legislation also affects other disciplines of companies and stakeholders. 'For example, employees in the human resources department process personal data of employees and job applicants on a daily basis,' he says. 'Think phone numbers (private and business), e-mail addresses and secret codes, such as access codes of premises and passwords for computers. There are also salary details, passports, bank account numbers, national register numbers and so on. And within secure factory premises, biometric data (such as fingerprints) and camera images may be taken and stored.
The finance department in turn collects personal data from suppliers, (sub)contractors and lenders. Some factories start up their own retail operations, serving customers directly, business-to-consumer. The marketing department then has a CRM system or database of customer data. The Industrial Internet of Ttings (IIoT) also creates new challenges. Anything with a plug can be connected to the internet. So also factory machinery. Ensuring 100 per cent cybersecurity therefore becomes almost impossible. Manufacturers can, of course, ensure that the basics are in order.'
Principles
The AVG sets out some basic principles:
- 'Data subjects' must give consent for their personal data to be processed through a clear active act. For example, a written statement, including by electronic means, or an oral statement, showing that the data subject freely, specifically, informed and unambiguously consents to the processing of their personal data.
- In a nutshell, personal data must be processed in a way that is lawful, proper and transparent in relation to the data subject.
- Manufacturers may only collect personal data for specified, explicit and legitimate purposes. 'Minimal data processing' is the norm here.
- Personal data must be correct, manufacturers are obliged to update it if necessary. Companies are obliged to delete or rectify incorrect personal data if required.
- Manufacturers must keep personal data in a form that does not allow data subjects to be identified for longer than is necessary for the purposes for which the personal data is processed.
- Manufacturers must process personal data by taking appropriate technical or organisational measures in a way that ensures appropriate security.
The Personal Data Authority makes a separate mention of 'privacy by design' on its site. This means that already when designing products and services, the manufacturer must ensure that personal data is well protected. But it also means that he does not collect more data than necessary for the purpose of processing. And that he does not keep the data longer than necessary. Privacy by default' means that the manufacturer must take technical and organisational measures to ensure that, by default, it only processes personal data that are necessary for the specific purpose it wants to achieve. For example, by not allowing an app it offers to record users' location if it is not necessary. A trust relationship based on AVG principles can only benefit the company's reputation.
Data breaches
In the article, Jeurissen also cites some examples of data breaches in both the Netherlands and Belgium. In our country, for example, data of two thousand employees of medical technology specialist Philips ended up on a public website (Pastebin.com). This involved salary data, annual statements, names, addresses and citizen service numbers.
Belgium experienced a major data leak at NMBS, the Belgian NS. Due to a human error, personal data of hundreds of thousands of railway customers appeared on the internet. It has since become one of the largest data leaks ever worldwide. In part, according to Jeurissen, it shows that there will be plenty of learning moments to come.
Incremental investment
The AVG replaces the Dutch Personal Data Protection Act and the Belgian Privacy Act. This also means that companies that already comply with current legislation today can take this approach as a valid starting point for implementing the AVG.
'Indian stories that the AVG will saddle manufacturers with a cost of tens of thousands of euros can be relegated to the realm of fantasy. Manufacturers that have taken the privacy of their employees, suppliers and other business partners seriously from the outset have probably already invested in information security every year. Companies that have failed to do so do have a problem. Companies that are bona fide especially struggle with setting the right priorities - the AVG is an incremental investment after all, and the overall budget for information security is rarely sufficient. Moreover, some of the novelties in the AVG require attention and budget.'
Novelties
For example, some companies will be obliged to appoint a data protection officer (dpo) to oversee data processing within the company. Even for companies not covered by this obligation, it may be wise to appoint a defined officer. This person can play an important role in the organisation's data protection policy.
Also new is the extraterritorial effect of the AVG. Thus, the regulation also applies to international suppliers that offer goods or services to EU citizens as 'processors' or 'processors' and process personal data in the process. This applies even to free products or services. International suppliers that monitor the behaviour of EU citizens are also covered by the regulation, to the extent that this behaviour takes place in the European Union. Meanwhile, the 'countdown timer' on the Privacy Commission's website is mercilessly counting down to the second to 25 May 2018.
Roadmap
Various bodies are currently trying to alert companies to the need to take precautions to avoid getting into trouble soon. They are doing this, for example, by publishing online tools and roadmaps. For instance, the Personal Data Authority put together a 10-step plan. It involves the following steps:
- Awareness
- Rights of data subjects
- Processing overview
- Data protection impact assessment (DPIA)
- Privacy by design & privacy by default
- Data protection officer
- Duty to report data breaches
- Processor agreements
- Leading regulator
- Consent
A detailed roadmap can be found on the AP website, as well as a handy infographic.
Balance
Finding the right balance between the use of personal data and the protection of privacy within our digital society is one of the biggest struggles today. A roadmap can serve a useful purpose here, but manufacturers who see the AVG merely as a checklist ('checkbox approach') are missing the point. By carefully aligning governance, risk management and compliance with relevant technology, AVG targets are more likely to be met. AVG compliance is not a capstone. Protecting personal data and preventing data breaches is an 'ongoing process', focused on high data quality and an enduring relationship of trust with all stakeholders.
Metal companies well prepared
The Koninklijke Metaalunie previously revealed that many SME metal companies are well on their way to complying with the privacy rules from the AVG. This is evident from the huge interest in the tools that Koninklijke Metaalunie offers its members to become 'AVG-proof'. To help companies do this, Koninklijke Metaalunie has developed a number of tools, including checklists. The second checklist was published yesterday.
'At the end of last year, the first checklist was published, which focused mainly on customer and supplier administration.... The second checklist published today deals with personnel and payroll administration. "It describes in concrete terms what members should do when it comes to collecting and using personal data that are part of these administrations," says Yasmin Baake, Metaalunie socio-legal adviser. 'By taking an average SME as a starting point, it is possible to give quite concrete advice. That is the big advantage of Metaalunie's checklists compared to other tools on the market.'
The next and final checklist will be published in March 2018 and will cover other processing operations.
By: Kelly Bakker
Source: Computable.be/MT/Koninklijke Metaalunie
