Share This Article
The French data protection authority (CNIL) issued a 6-step methodology for companies that want to prepare for the changes that will apply under the EU the General Data Protection Regulation (“GDPR”).
This is a very interesting contribution from my colleagues Carol A.F. Umhoefer and Caroline Chancé on the EU Privacy Regulation and how the French DPA requires companies to get compliant which was originally published on Privacy Matters blog.
* * *
The abolishment under GDPR of registrations and filings with data protection authorities will represent fundamental shift of the data protection compliance framework in France, which has been heavily reliant on declarations to the CNIL and authorizations from the CNIL for certain types of personal data processing. In place of declarations, the CNIL underscores the importance of “accountability” and “transparency”, core principles that underlie the GDPR requirements. These principles necessitate taking privacy risk into account throughout the process of designing a new product or service (privacy by design and by default), implementing proper information governance, as well as adopting internal measures and tools to ensure optimal protection of data subjects.
In order to help organizations get ready for the GDPR, the CNIL has published the following 6 step methodology:
Step 1: Appoint a data protection officer (“DPO”) to “pilot” the organization’s GDPR compliance program
Pursuant to Article 37 of the GDPR, appointing a DPO will be required if the organization is a public entity; or if the core activities of the organization require the regular and systematic monitoring of data subjects on a large scale, or if such activities consist of the processing of sensitive data on a large scale. The CNIL recommends appointing a DPO before GDPR applies in May 2018.
Even when a DPO is not required, the CNIL strongly recommends appointing a person responsible for managing GDPR compliance in order to facilitate comprehension and compliance in respect of GDRP, cooperation with authorities and mitigation of risks of litigation.
Step 1 will be considered completed once the organization has appointed a DPO and provided him/her with the human and financial resources needed to carry out his/her duties.
Step 2: Undertake data mapping to measure the impact of the GDPR on existing data processing
Pursuant to Article 30 of the GDPR, controllers and processors will be required to maintain a record of their processing activities. In order to measure the impact of the GDPR on existing data processing and maintain a record, the CNIL advises organizations to identify data processing, the categories of personal data processed, the purposes of each processing, the persons who process the data (including data processor), and data flows, in particular data transfers outside the EU.
To adequately map data, the CNIL recommends asking:
- Who? (identity of the data controller, the persons in charge of the processing operations and the data processors)
- What? (categories of data processed, sensitive data)
- Why? (purposes of the processing)
- Where? (storage location, data transfers)
- Until when? (data retention period)
- How? (security measures in place)
Step 2 will be considered completed once the organization has identified the stakeholders for processing, established a list of all processing by purposes and categories of data processed, and identified the data processors, to whom and where the data is transferred, where the data is stored and for how long it is retained.
Step 3: Based on the results of data mapping, identify key compliance actions and prioritize them depending on the risks to individuals
In order to prioritize the tasks to be performed, the CNIL recommends:
- Ensuring that only data strictly necessary for the purposes is collected and processed;
- Identifying the legal basis for the processing;
- Revising privacy notices to make them compliant with the GDPR;
- Ensuring that data processors know their new obligations and responsibilities and that data processing agreements contain the appropriate provisions in respect of security, confidentiality and protection of personal data;
- Deciding how data subjects will be able to exercise their rights;
- Verifying security measures in place.
In addition, the CNIL recommends particular caution when the organization processes data such as sensitive data, criminal records and data regarding minors, when the processing presents certain risks to data subjects (massive surveillance and profiling), or when data is transferred outside the EU.
Step 3 will be considered completed once the organization has implemented the first measures to protect data subjects and has identified high risk processing.
Step 4: Conduct a privacy impact assessment for any data processing that presents high privacy risks to data subjects due to the nature or scope of the processing operations
Conducting a privacy impact assessment (“PIA”) is essential to assess the impact of a processing on data subjects’ privacy and to demonstrate that the fundamental principles of the GDPR have been complied with.
The CNIL recommends to conduct a PIA before collecting data and starting processing, and any time processing is likely to present high privacy risks to data subjects. A PIA contains a description of the processing and its purposes, an assessment of the necessity and proportionality of the processing, an assessment of the risks to data subjects, and measures contemplated to mitigate the risks and comply with the GDPR.
The CNIL has published guidelines in 3 volumes to help organizations conduct PIAs (see here, here and here).
Step 4 will be considered completed once the organization has implemented measures to respond to the principal risks and threats to data subjects’ privacy.
Step 5: Implement internal procedures to ensure a high level of protection for personal data
According to the CNIL, implementing compliant internal procedures implies adopting a privacy by design approach, increasing awareness, facilitating information reporting within the organization, responding to data suject requests, and anticipating data breach incidents.
Step 5 will be considered completed once the organization has adopted good practices in respect of data protection and knows what to do and who to go to in case of incident.
Step 6: Document everything to be able to prove compliance to the GDPR
In order to be able to demonstate compliance, the CNIL recommands that organizations retain documents regarding the processing of personal data, such as: records of processing activities, PIAs and documents regarding data transfers outside the EU; transparency documents such as privacy notices, consent forms, procedures for exercising data subject rights; and agreements defining the roles and responsibilities of each stakeholder, including data processing agreements, internal procedures in case of data breach, and proof of consent when the processing is based on the data subject’s consent.
Step 6 will be considered completed once the organization’s documentation shows that it complies with all the GDPR requirements.
The CNIL’s methology includes several useful tools (template records, guidelines, template contract clauses, etc.) and will be completed over time to take into account the WP29’s guidelines and the CNIL’s responses to frequently asked questions.
