Michael Johnson

As of May 25^th, 2018, if local businesses aren’t ensuring the highest possible level of data privacy, they’re risking serious financial consequences. The General Data Protection Regulation (GDPR) is coming into effect. What does this mean? All local businesses MUST be ready to take security more seriously than ever before. The EU Parliament approved GDPR in April of 2016 with enforcement set to start in a couple of weeks on May 25^th, 2018.

Who Must Comply with GDPR?

All businesses storing or processing data of people living in the European Union must comply, regardless of where you’re located in the world. The EU is very consumer-focused and always has been. As data travels beyond the borders of the EU, GDPR is designed to help protect citizens as any company, anywhere in the world, is bound by its rules as long as they’re holding data on citizens.

Businesses of all types and sizes – from small one or two person shops to multi-national corporations – must comply. There are no exceptions. For those businesses already complying with the Data Protection Act (DPA), they’re one step closer to being in compliance with GDPR.

What’s the Risk of Non-Compliance?

Local companies who fail to comply with face fines – up to $24 million OR 4% of annual global turnover, depending on which number is higher. In addition to fines, local companies who fail to comply will also face the devastating impact of reputational damage as most consumers won’t feel comfortable working with a company that doesn’t prioritize data privacy.

What Do Local Companies Need to Know About GDPR?

First and foremost, local companies need to know that compliance is not optional. Every organization should become familiar with the provisions of GDPR so they’re aware of the requirements.

Here are a few key facts to know about GDPR:

• Strict parameters must be followed to receive consent for the use and/or storage of data. These parameters require an easily accessible form and withdrawing consent must be simple.
• The right to be forgotten enables consumers to request their personal data be deleted and/or erased immediately with all third-parties halting any processing of said data.
• In the event of a breach, notification must be done within 72 hours of becoming aware of the breach. This means all affected parties must be notified and offered information on the incident.
• Consumers may request to receive their personal data, in order to transmit said data to another data controller as needed. Companies must ensure data is easily accessible to provide upon request.
• Data protection must always be considered when designing any system or solution, which means it cannot be an afterthought or addition done after the system or solution is designed.
• Specific protection is in place for children as they are generally more vulnerable. When storing data relating to or involving children, parental consent must be received for children up to age 16.

Essentially, local businesses will have to review their marketing processes in terms of data mining and remarketing. However, those who have already prioritized data privacy will have less work to do to ensure compliance.

What Steps Must Be Taken to Ensure Compliance?

1. Assess what needs to be done: Review all requirements of GDPR to understand how the provisions impact your company and/or which departments will be affected.
2. Perform a complete audit: Audit what personal data is collected and stored, where the data came from, and who the data is shared with, then record your processing activities.
3. Update all privacy notices: Privacy notices must be updated to communicate how personal data will be used and collected, as well as explaining the lawful basis for processing personal data.
4. Verify data accessibility and portability: Verify that access requests can be accommodated in 30 days and data can be received in a commonly used, machine-readable format.
5. Review instructions for receiving consent: These instructions will help you properly seek, record, and manage consent for the use and/or storage of data.
6. Work with all third-party providers: You can be held responsible for breaches resulting from non-compliance on a third-party providers part, so work with email service providers, CRM providers, and more.
7. Educate every single staff member: ALL staff members must be educated in case they come into contact with information relating to customers.

Lastly, make sure you’re working with a trusted team of technology experts who can help you put all of the tips above into action. You almost certainly WILL require some changes to your information technology environment in terms of how data is stored and processed. A good Omaha IT support company will help with this.

You need a technology services company Omaha businesses trust to help them comply with GDPR. InfiNet Solutions is that technology services company. Call us now at (402) 895--5777 or email us at [email protected] to get started.

Where Did They Go?

In 2017, Microsoft planned to release a lightweight version of Windows 10. This was their effort to provide a Windows solution that delivered a predictable performance by using only Microsoft-verified applications via the Microsoft Store.

Microsoft also wanted to compete with the Google Chromebook and promote Windows 10 S for use in the K-12 education market. Windows 10 S was initially offered as part of the Surface Laptop which is a premium, and quite expensive product. So, this addition to the education market was quite a leap.

Windows 10 S was going to be offered at a reduced price with the option to pay more to “unlock” the full Windows 10 Operating System. But Microsoft changed their minds. They realized that we don’t want to pay extra for something that should have been included, to begin with.

On March 7, 2018, they said:

Based on customer feedback we are simplifying the experience for our customers. Starting with the next update to Windows 10, coming soon, customers can choose to buy a new Windows 10 Home or Windows 10 Pro PC with S mode enabled, and commercial customers will be able to deploy Windows 10 Enterprise with S mode enabled.

What this means is that the Windows 10 S computer has been retired. Instead, Microsoft has decided to incorporate Windows 10 S as a “mode” for all Windows 10 Operating Systems.

Microsoft hopes this new approach will make it possible for their customers to start using the S mode. They say that it provides a streamlined computing experience that enhances security and performance across all editions.

So, for the foreseeable future, Windows 10 S is now a configuration in the Windows 10 Pro and Windows Home computers. The S Mode will lock down Windows 10, so it can only run applications from the Microsoft Store–essentially, exactly what the dedicated Windows 10 S operating system was intended to do.

Microsoft is letting Windows 10 Home users disable the S Mode free of charge. However, Windows 10 Pro customers with S Mode enabled on their device will have to pay $49 to get access to the full version of Windows 10 Pro.

Should You Consider Using the S Mode? The “S” in Windows 10 S was supposed to stand for “simplicity.” Its intent was to provide a productive and secure Windows experience. Microsoft says that it’s designed for superior performance. Starting up, streaming HD video and switching across applications is much faster than with Windows 10.

Windows 10 S only uses apps from the Microsoft Store and provides a safer browsing capability via Microsoft Edge. Because the applications for Windows 10 S only come from the Microsoft Store, the folks at Microsoft say that it ensures security and integrity. And they say that Microsoft Edge is more secure than using Chrome or Firefox browsers. The Windows Defender Antivirus and other security features in Windows are also included in Windows 10 S.

Windows 10 S comes with built-in apps and new features like Cortana, Windows Ink and Windows Hello so you can sign on without a password. It integrates with OneDrive, so you can easily save your files to the cloud and sync them across your other devices. If you decide you want to run applications that aren’t in the Microsoft Store, you can easily switch to Windows 10 Pro (except you’ll have to pay $49 to do so).

What Do Others Think About Windows 10 S?

Microsoft says that 60% of their users stay with Windows 10 S when using third-party devices. And those who do switch, do so within 24 hours of setting up their device. Those who keep using Windows 10 S for a week or so, end up keeping their device in S mode (83 %). These statistics are for low-end PCs as the only high-end computer running Windows 10 S is the Surface Laptop. These users weren’t included in their survey.

It looks like the Windows S Mode is here to stay. But some experts predict that it poses problems for Microsoft down the line. They believe that it’s going to confuse people. While the Home versions offer a free switch path, the charge for the Pro versions could bother users who want more premium devices.

Here is another issue with this change— Microsoft says that AV/Security apps will come in the Windows 10 S mode. But what about the AV software from third-party providers? Will these applications run in the S mode? If so, this defeats the purpose of what the S mode is supposed to do. Does this mean that using these apps will hamper the promised performance in Windows 10 S? We’ll have to wait to see how Microsoft deals with this. But for now, it seems like a contradiction.

Windows 10 S devices span a price range from $189 to $2,199 (for the top Surface Laptop). It’s not impossible to provide solutions for both low-end and high-end device users, but some feel this will be difficult for people to get their minds around.

Windows 10 Spring Creators Update will probably be released with a different name: Windows 10 April Update. However, it’s been delayed while Microsoft rushes to fix a newly-discovered bug. Between the changes with Windows 10 S and now the next Windows 10 update, it seems there’s a lot of “plate-spinning” going on at Microsoft right now.

What Is It?  What Do We Need To Know?  What Should We Do?

If you don’t know what the GDPR is, and if you’re not ready for it, you’re going to get caught short because this is a legal deadline and it’s coming up fast. The General Data Protection Regulation goes into effect May 25, 2018.  It’s a privacy law that the European Union is enforcing to protect the personal data businesses collect. Even if your business is outside of the EU, you must comply.

What is the GDPR?

The GDPR affects all internet business worldwide. It’s a very complex law, so we can’t explain everything here. We’ve provided some resources below that you should check out.  Keep in mind that there are many gray areas where this law is concerned. So, you should do some research to determine how the law affects your organization’s unique situation.

The GDPR is an internet privacy law. All businesses, small or large, and even entrepreneurs who do business on the Internet with consumers located in the European Union need to be aware of how the law affects them.

It doesn’t matter if your company is inside the EU, or anywhere else in the world– If you do business with anyone in the following countries, you must comply with this new law by May 25th:

1. Austria
2. Belgium
3. Bulgaria
4. Croatia
5. Cyprus
6. Czech Republic
7. Denmark
8. Estonia
9. Finland
10. France
11. Germany
12. Greece
13. Hungary
14. Ireland
15. Italy
16. Latvia
17. Lithuania
18. Luxembourg
19. Malta
20. Netherlands
21. Poland
22. Portugal
23. Romania
24. Slovakia
25. Slovenia
26. Spain
27. Sweden
28. United Kingdom

The GDPR is a consumer data protection law. It ensures that individuals can:

• Access their personal data.
• Export their personal data.
• Correct errors to their personal data.
• Object to the processing of their personal data.
• Erase their personal data.

The GDPR applies to the acquisition, processing, and storage of personal data – from initial gathering to final deletion of this data and every point in between. It applies specifically to personal data and anything that pertains to identifiable data such as:

• Names
• Email Addresses
• Physical Addresses
• Phone Numbers
• Birthdate
• Age
• Sex
• Race
• ID Numbers
• Nationality
• Citizenship
• Marital Status
• Family Data
• Health Data
• Physical Characteristics
• Profile Pictures
• Occupation
• Employment History
• Income
• IP Addresses
• Cookies
• (and more)

This could be information you collect automatically from Google, an opt-in, or other collection method online – anything that would identify an individual.

How Will The GDPR Affect My Business?

If your business has a website or an email list, you may be affected.

The GDPR affects any business relationship or transaction whether commercial or free where one or more of the entities are in the European Union. It’s not based on citizenship, rather location.  Any business within the EU must comply with the GDPR across its entire audience. If your business is in any of the 28 European Union Member States, you must comply with the law if you conduct a transaction with anyone located anywhere. If your business is located in the U.S. and you collect data about any business or person in the EU, you must comply with the GDPR.

How Should We Prepare For The GDPR?

There are three requirements you must meet before May 25th.

Controls and Notifications

• Protect personal data using appropriate security.
• Notify authorities of personal data breaches.
• Obtain appropriate consents for processing data.
• Keep records detailing data processing.

Transparent Policies

• Provide clear notice of data collection.
• Outline processing purposes and use cases.
• Define data retention and deletion policies.

IT and Training

• Train privacy personnel and employees.
• Audit and update data policies.
• Employ a Data Protection Officer (if required).
• Create and manage compliant vendor contracts.

Some Examples

Before the GDPR:

Let’s say you offer a whitepaper or free video to people online. Before the GDPR, your prospect provided their information, you gave them the freebie, and the consent was assumed because they accepted your gift.  Pretty easy, right?

After the GDPR:

You can no longer assume that their consent is given if they accept your gift. Now you must specifically obtain their consent. It must be given freely, specifically, and be unambiguous. Nor can you require them to give their consent to receive the gift.

Note: This new standard applies to all of your existing lists. Beginning May 25th, you can no longer send marketing emails to anyone who hasn’t given their precise consent for you to keep their personal information.  Plus, you cannot go back and ask them for their consent. You’ll need a stand-alone system to do this.

What Can We Do To Comply With These Strict Rules?

This is important. You must do this BEFORE May 25, 2018.

Compliance/Preservation

Step 1. Segment your email mailing lists into two parts.

• Non-EU subscribers
• EU-based subscribers and any unknowns

You want to continue to build goodwill with your Non-EU contacts so reach out to them as you would have before.  The EU-based and unknowns you’ll need to re-engage with. Here’s what we mean:

Step 2. Reengage EU-based and Unknowns.

• Before emailing them, add additional value and content to your website.
• Then send them a link to your website and request their specific consent to keep their personal information.
• Set up a system to migrate those who give consent over to it.
• On May 24, 2018, you must delete anyone in this group who hasn’t consented.

Remember, storing and deleting their information is considered processing. That’s why you must do this BEFORE May 25th.

Breach Notification Requirements

The 2018 GDPR replaces the old Data Protection Directive of 1995. The most recent GDPR breach notification requirement was enacted in April 2016.  It set a higher compliance standard for data inventory, and a defined risk management process and mandatory notification to data protection authorities.

Breach notification is a huge endeavor and requires involvement from everyone inside an organization. In-house tech support and outsourced Technology Service Providers should have acquired a good understanding of the consequences a data breach causes and the data breach notification requirements for their organization.  They must be prepared in advance to respond to security incidents.

The Following Are Additional Steps You Should Take To Prepare Your Technology Before May 25th  

Your Technology Solutions Provider Can Help

• Perform a through inventory of your personally identifiable information, where it’s stored–in onsite storage or in the Cloud. And determine in what geographical locations it’s housed. Don’t forget about your databases. PII is often stored in databases.
• Perform a Gap Analysis. This is a process where you compare your organization’s IT performance to the expected requirements. It helps you understand if your technology and other resources are operating effectively. By doing this, your Technology Solution Provider (TSP) can then create an action plan to fill in the gaps. The right TSP will understand the GDPR regulations and how your IT must support your compliance efforts.
• Develop an Action Plan. Your TSP should document a detailed action plan for how to use technology to meet the GDPR if you experience a data breach. This should include individuals’ roles and responsibilities. Conduct tabletop exercises to practice how the plan will work with specific timelines and milestones.
• Ensure data privacy. If you don’t have a Technology Solution Provider, then you need one for this. Data protection is key for any-sized organization. Consumers have the right to have their data erased if they want. This is called “the right to be forgotten.”  This is a concept that was put into practice in the European Union in 2006, and it’s a part of the GDPR. You won’t be able to do this if their data is stolen.
• Be sure to document and monitor everything that you do that’s related to GDPR Compliance. This includes any changes or upgrades that your TSP makes to your IT environment. You may need to demonstrate that you’ve done your due diligence when it comes to protecting citizens’ private information and that you practice “defense-in-depth” strategies where you use multiple layers of security controls when it comes to your technology.

Resources To Check Out For More Information

The European Commission’s website regarding the GDPR:

https://ec.europa.eu/info/law/law-topic/data-protection

Wikipedia

General Data Protection Regulation

https://en.wikipedia.org/wiki/General_Data_Protection_Regulation

Information from the service vendors you use:

• Mail Chimp
• Salesforce
• Google
• Microsoft

These and other services have GDPR-centric webpages with helpful information that impacts your relationship with them, how they handle processing, and how they can help you comply with the new regulations