Legal aspects of cyber security and data breach management under GDPR

1. Cybersafety First:
Understanding potential (legal) cyber security risks and the ways
to mitigate them
26 May 2021

2. Privacy & data protection
Cyber security
Software development
Internet & e-commerce
IP, Media & advertising
Gambling
Travel & consumer protection
Commercial & contracts
Corporate - tax
roeland@siriuslegal.be
bart@siriuslegal.be
www.siriuslegal.be
Downloadlink with documents
★ 3 copies of the ICLG Cyber security guide
★ NIST Identifying and Estimating
Cybersecurity Risk for Enterprise Risk Management
★ ENISA Information security and privacy standards for
SMEs
★ ICO whitepaper “Responding to a cybersecurity incident”
★ EDPB Guidelines on data breaches
★ Checklist “sécurité des données” CNIL
★ DPIA webinar and Data export webinar Sirius Legal
★ DPIA template Sirius Legal

3. When
reality
catches up
with you...

4. That morning in the office

5. Cybercrime
is
everywhere

6. 42% (!) of Belgian
companies were hit
in 2020
1 in 5 attacks was
ransomware
69% of all
victims were
hit at least
twice (!)
Highest ransom
paid:
€ 500.000
Belgium leader in
ransomware attacks
Compared to 8
neighboring countries
Cybercrime
is
everywhere
Source: Hiscox (cyber security
insurance specialist), based on
survey with 6.000 Belgian
companies

7. Solarwinds
December
2020
Malicious code in
software update
for Orion

8. MS
Exchange
March 2021
“zero day exploit”
vulnerability in MS
exchange code
that allows access
to mail servers

9. Are you
sure it won’t
happen in
your office?
Source: FBI cybercrime report
2021
Ransomeware is the
nr 1 cyber threat in
2021
Average extortion
is 1.000 USD
Total
worldwide cost
by 2025 is
10.5 billion
USD
Over 70% of
companies is not
sufficiently
prepared
Human error is the
cause in 90% of
cases

10. So, let’s start building our defenses...

11. Today’s scope
Cyber threat landscape
Response & Evolutions
Measures

12. Cyber threat landscape

13. Cyber threat
landscape
Belgium - Police Crime Statistics 2000-2019
2019
2365
2009
51
2016
49
Phishing
Ransomware
2019
177

14. Cyber threat
landscape
International
Alarming rise in IOCTA 2020 ETL 2020
cyberattacks under
COVID-19

15. Cyber resilience:
response & evolutions

16. Cyber
resilience
16
Legislative initiatives
GDPR
NIS - NIS2 (proposal)
Cyber Security Act
Product safety & -
liability (update)
1
2
3
4

17. 17
NIS
GDPR
Uitvoeren smart contract
Requirements?
Security
Notification
Information
Sanctions (NIS)
SR: 8d-1j gs / 208 tot 240.000 euro gb
AR: 500 tot 100.000 gb
SR: 8d-1j gs / 208 tot 160.000 euro gb
AR: 500 tot 75.000 gb
SR: 8d-1j gs / 208 tot 400.000 euro gb
AR: 500 tot 75.000 gb
Cyber
resilience

18. Cyber
resilience
Legislative initiatives
GDPR
NIS - NIS2 (proposal)
Cyber Security Act
Product safety & -
liability (update)
1
2
3
4

19. 19
National strategy in Belgian law?
2
3
4
5 Depe on
enforcement
Dependence on
enforcement
Inadequate
Up to date?
Hodgepodge
1
Cyber
resilience

20. 20
National strategy?
2
4
5 Depe on
enforcement
Up to date?
Hodgepodge
1
ccb.belgium.be
cybersecuritycoalition.be
Cyber
resilience

21. Cyber
resilience
21
National strategy?
2
4
5 Depe on
enforcement
Up to date?
Hodgepodge
1
Cyber Security Improvement Process
● 45% support
● Technical & legal support
● Menu
● Plan-Do-Check-Act

22. 22
Measures?

23. Avoid the
Dunning-
kruger effect

24. 24
Cyber security = not
a problem of the
IT-department

25. Principles:
CIA-triad
Confidentialiteit
Information
security
Availability
Integrity Confidentiality

26. Identify = Risk assessments & audits
Protect = Organisational & technical measures
Detect = Monitoring & logging
React = Incident Response Management
Recover = Claim handling, cost allocation

27. Measures
from a legal
perspective
27
2
1
Overall
definition:
risk based
adequate &
proportionate
technical &
organisational
measures
Cyber
Security
*
As
*
A
*
Routine
Prioritize
Security clauses
Policies
Roles &
responsibilities
SLA (security legal
information…)
Audits
Insurance

28. 28
How to tackle?
Let’s dive into...

29. External
measure:
Security
clauses
29
2
1
Uitvoeren smart contract
Volledig automatisch
En/of taak voor business
Compliance
Autorisation
& access
Procedure
security-
incident
Roles
& liability
Contractual
essence
Audit
control
migration
Study on the economic detriment to Small and Medium-sized
Enterprises Arising from Unfair and Unbalanced Cloud
Computing Contracts (European Commission)

30. Internal
measure:
Shadow-IT
30
2
1
EASE OF USE
LACK OF
SECURITY
DATA
BREACH

31. External
measure:
pentesting/C
VDP
1
31
Voluntary hacking?
Valuable addition to your
security policy
● legal framework
● patching
vulnerabilities
● building trust
● compliancy
● confidentiality and
knowledge sharing
Points of attention:
● scope and conditions
● interests of third
parties
● consequences and
damages
● Proportionality
● GDPR…

32. Cyber security and GDPR,
twins, but not identical

33. Basic principles
Secure organisation
& secure workplace
TOM’s
Transparency
Information
Data subject rights
Safe partners
Safe apps & tools
Network security & control
Accountability
& documentation
creating a safe
environment
GDPR and
cyber security
Risk
prevention

34. Safe partners
Safe apps & tools
Network security & control
Secure organisation
& secure workplace
TOM’s
Accountability
& documentation
GDPR and
cyber security
Risk
prevention
creating a safe
environment

35. DPA’s
Data Export
assessment
Data register
Privacy Impact Assessment
DPIA
How to...
GDPR and
cyber security
Risk
prevention

36. GDPR and
cyber security
Data breach
management
Damage control
crisis communication
Liability
Insurance
Technical 911
Obligation to
notify
GBA/APD
Data subjects
individually
72 hours
Be prepared
Knowledge and awareness
policies
training
processes
Be prepared 2
DPA’s
Insurance
Incident register
Avoid data
breaches

37. GDPR and
cyber security
Data breach
management
Full webinar
Politeia
24/09
More info soon
on our webinar
pages

38. Privacy & data protection
Cyber security
Software development
Internet & e-commerce
IP, Media & advertising
Gambling
Travel & consumer protection
Commercial & contracts
Corporate - tax
roeland@siriuslegal.be
bart@siriuslegal.be
www.siriuslegal.be
Downloadlink with documents
★ 3 copies of the ICLG Cyber security guide
★ NIST Identifying and Estimating
Cybersecurity Risk for Enterprise Risk Management
★ ENISA Information security and privacy standards for
SMEs
★ ICO whitepaper “Responding to a cybersecurity incident”
★ EDPB Guidelines on data breaches
★ Checklist “sécurité des données” CNIL
★ DPIA webinar and Data export webinar Sirius Legal
★ DPIA template Sirius Legal

39. Privacy & data protection
Cyber security
Software development
Internet & e-commerce
IP, Media & advertising
Gambling
Travel & consumer protection
Commercial & contracts
Corporate - tax
Proud Legal Partner
Recent clients
roeland@siriuslegal.be
bart@siriuslegal.be
www.siriuslegal.be