GDPR
Conference 2018
WIFI: The Space Password: 5pac3002

Welcome
Chris Sargisson
Norfolk Chamber
@Chris_NorfolkCC

Agenda
09:30 Welcome
09:40 Alex Saunders, Leathes Prior
Tom Parsley, Selesti
John Gostling, Breakwater IT
10:30 Refreshment Break & Exhibition
Darren Chapman, CyberScale
Panel Q&A
11:45 Host close
12.00 Free networking, light refreshments & speaker drop-in
12.15 Optional workshops
13.00 Event close

No fire drills – Exits are marked
Toilets outside this room
Phones on silent
Feel free to tweet
House keeping
@norfolkchamber #NorfolkGDPR
WIFI: The Space Password: 5pac3002

www.slido.com
#GDPR

Alex Saunders
Leathes Prior
@leathesprior
@norfolkchamber #NorfolkGDPR
www.slido.com #GDPR

GDPR & THE “CONSENT” MYTH
WITH
ALEX SAUNDERS

GDPR Overview
 Replaces the existing Data Protection Act 1998
 Due to come into force on 25 May 2018
 Most fundamental change to data protection law in almost 20 years?
 Covers the use of “personal data” – any information that can identify a living individual
 Introduces various key new concepts and expands on existing concepts
 Applies to:
 Organisations operating within EU
 Non-EU organisations offering goods/services within the EU
 Enforced in UK by Information Commissioner’s Office (“ICO”)
 Impact of Brexit?

GDPR Why is it important?

Principles Continuity
DPA 1998
Fair and lawful processing
Specific purposes
Adequate, relevant and not excessive
Accuracy
Retain only as long as necessary
Respect data subjects’ rights
Security
Transfers outside EEA
GDPR
Lawfulness, fairness and transparency
Purpose limitation
Data minimisation
Accuracy
Storage limitation
Integrity and confidentiality
(See lawfulness above)

Lawful Processing Basis for processing
CONSENT: you can process personal data where the subject has
given consent to the processing for one or more specified purpose
CONTRACT WITH INDIVIDUAL: you can process personal data,
without consent, where required under a contract with the data
subject
 E.g. employment contract, contract for sale of goods or services
VITAL INTERESTS: you can process personal data, without consent,
if it’s necessary to protect someone’s life

Lawful Processing Basis for processing (cont…)
PUBLIC TASK: you can process personal data, without consent, to
carry out your official functions or a task in the public interest – and
where you have a legal basis for the processing under UK law
 If public authority, likely to apply to most of your processing activities
LEGITIMATE INTEREST: you can process personal data, without
consent, if you have a genuine and legitimate reason to do so
 Legitimate interest can be for commercial benefit
 GDPR recitals – direct marketing could be a legitimate interest
 BUT exception if your interests are outweighed by harm to the individual’s
rights and interests

Lawful Processing Is “consent” always necessary?
MYTH: Consent is always necessary to process personal data
FACT: Consent is one way to comply with the GDPR, not the only way
 “Consent” is only one of six lawful basis for processing personal data
 Organisations will need to identify on which ground they are processing personal data
Will only be appropriate to use consent where other grounds do not apply

Consent under GDPR When is consent appropriate?
Consent may be required if you are…
 Direct marketing
 Using or sharing personal data in a way that is
potentially intrusive or unusual – e.g. selling database
 Transferring personal data outside the EEA
Consent will not be appropriate if…
 You are in a position of power over the individual (employer)
 Consent is a pre-condition of using the service
 You would still process personal data using a different basis
even if consent was withdrawn

Consent under GDPR Key changes?
DPA 1998
“any freely given specific and informed
indication of his wishes by which the data
subject signifies his agreement to personal
data relating to him being processed”
GDPR
“any freely given, specific, informed and
unambiguous indication of the data subject's
wishes by which he or she, by a statement or
by a clear affirmative action, signifies
agreement to the processing of personal data
relating to him or her”
Guidance: “Silence, pre-ticked boxes or inactivity should therefore not constitute consent”
GDPR sets a higher standard for obtaining consent

Consent Practical Changes
DON’T
 Identify basis of processing
Ensure consent is the most appropriate basis for the processing. Any other grounds?
 Clear and plain language
Use language that is easy to understand when obtaining consent. Avoid legal jargon!
 Third parties
Give details of any third parties who will be relying on the consent.
 Keep records
Who gave consent? When and how was consent given? Review consents regularly.
 Withdrawal
Make withdrawal of consent straightforward and simple. Same method as given.
DO

X Don’t bundle consent
Keep separate from other terms. Don’t make it a pre-condition of signing up to a service.
X Blanket consent
Get separate consent for separate things where possible. Do not rely on a blanket consent
X Don’t use pre-ticked boxes
It should be an active opt-in. Don’t rely on implied consent.
X Penalising withdrawal
Do not penalise individuals who withdraw their consent.
X Public authorities
Take extra care to show consent has been freely given. Avoid over-reliance on consent.
Consent Practical Changes
DON’T

Action Points What now?
Undertake a review of the personal data held by your organisation
If not, consider whether consent meets the GDPR standard. Do you need to obtain
fresh GDPR-compliant consent?
Identify what data is being processed on the basis of consent. Are there any other
lawful basis for processing?
Ensure that there are proper procedures in place for recording consent and giving
customers the right to withdraw

THANK YOU
Please feel free to get in touch with any questions:
E: asaunders@leathesprior.co.uk
T: 01603 281141

Tom Parsley
Selesti
@Selesti
@norfolkchamber #NorfolkGDPR
www.slido.com #GDPR

GDPR & Marketing: opportunity or threat?
Tom Parsley

With change comes new
opportunities

STAND
OUT

More personalised,
human engagement

Improved focus

Through consent, you can
gain insight into each
individual’s interests to provide
them with information that they
want to receive.

FLYBE
FINED

Personalised email
GDPR and PECR apply
Generic marketing
email
Only general marketing consent needed
Dear Amber
Your recommendations

Increased trust

93% of online shoppers cite the security of their
personal data as a concern

If we can’t easily explain
what we’re doing with
personal data then
we shouldn’t be doing it

COPYWRITING
Avoid personal pronouns
Active voice
Write in plain English
Highlight the benefits
Make future opt-outs clear

Encourages creativity

THANK
YOU
for brands with ambition.
Strategies, Technologies & Campaigns
tom@selesti.com

John Gostling
Breakwater IT
@BreakwaterIT
@norfolkchamber #NorfolkGDPR
www.slido.com #GDPR

Personal Data
Breaches
WELCOME
John Gostling
Breakwater IT
13 March 2018

INTRODUCTION
About me;
• Worked in IT since 1998
• Nearly 20 years!
• Worked at Breakwater since 2012
• Regularly see different hacks, breaches and attempts at fraud

PERSONAL DATA BREACH
• What is a breach?
“A personal data breach means a breach of security leading to the accidental or
unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal
data. This includes breaches that are the result of both accidental and deliberate causes. It
also means that a breach is more than just about losing personal data.”

PERSONAL DATA BREACH
• What is a breach?
“A personal data breach means a breach of security leading to the accidental or
unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal
data. This includes breaches that are the result of both accidental and deliberate causes. It
also means that a breach is more than just about losing personal data.”

PERSONAL DATA BREACH
• What is a breach?
“A personal data breach means a breach of security leading to the accidental or
unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal
data. This includes breaches that are the result of both accidental and deliberate causes. It
also means that a breach is more than just about losing personal data.”

BREACH EXAMPLES
• Carphone Warehouse
• Fined £400,000 in January
• Records for approximately 3,348,869 customers of a number of mobile phone providers
• Records for 389 customers across two other companies
• Historic transaction details for the period March 2010 – April 2010
• Records of approx. 100 employees

BREACH EXAMPLES
• What is a vulnerability?
A vulnerability is a weakness which allows an attacker to reduce a system's information
assurance. Vulnerabilities are the intersection of three elements: a system susceptibility or
flaw, attacker access to the flaw, and attacker capability to exploit the flaw. To exploit a
vulnerability, an attacker must have at least one applicable tool or technique that can
connect to a system weakness. In this frame, vulnerability is also known as the attack
surface.

BREACH EXAMPLES
• Carphone Warehouse – How did they get in?
• Vulnerability?
• Password

BREACH EXAMPLES
• Carphone Warehouse – How did they get in?
• Vulnerability?
• Password

BREACH EXAMPLES
• Uber
• Details of 2.7 million UK drivers and riders
• Details of 57 million people worldwide
• Email addresses and phone numbers
• US Driver license numbers

BREACH EXAMPLES
• Uber - How did they get in?
• Password stored on Github
• What is Github?
• Cover up!
• ICO Response

BREACH EXAMPLES
• Uber – ICO Response
“Uber has confirmed its data breach in October 2016 affected approximately 2.7million user accounts in the UK. Uber
has said the breach involved names, mobile phone numbers and email addresses.
On its own this information is unlikely to pose a direct threat to citizens. However, its use may make other scams, such
as bogus emails or calls appear more credible. People should continue to be vigilant and follow the advice from the
NCSC.”

BREACH EXAMPLES
• Leicester County Council
• Email sent to 27 different taxi firms
• Accidentally included a large spreadsheet
• The spreadsheet contained personal data of thousands of children

PREVENT A BREACH
• Vulnerability testing & Penetration testing
• Password Management
• Risk assess
• Two Factor Authentication
• Utilise DLP features on key documents
• Data Protection training

USEFUL LINKS
• Elizabeth Denham Blog - http://bit.ly/2tcP5uA
• Carphone Warehouse Monetary Penalty Notice -
http://bit.ly/2oR86xs
• ICO Statement on Uber Breach - http://bit.ly/2juR7y4
• BBC Article on Leicester City Council - http://bbc.in/2D3V8C9

Refreshment
Break
See you back in the
Auditorium at 11.00
@norfolkchamber #NorfolkGDPR
www.slido.com #GDPR

Darren Chapman
CyberScale
@cyberscaleuk
@norfolkchamber #NorfolkGDPR
www.slido.com #GDPR

GDPR & Cyber Security
GDPR Conference 13th March, 2018
Darren Chapman
Director & Principal Security Consultant
Pragmatic IT Security

(Why) Does Cyber Security Matter?
“Cyber security and data protection are inextricably linked“
CBI Cyber Security Conference, 13 September, 2017

“Processing” Personal Data
“Processing” means any operation or set of operations which is performed on
personal data or on sets of personal data, whether or not by automated means,
such as collection, recording, organisation, structuring, storage, adaptation or
alteration, retrieval, consultation, use, disclosure by transmission, dissemination
or otherwise making available, alignment or combination, restriction, erasure or
destruction;

Cyber Security – GDPR Regulations
“the controller and the processor shall
implement appropriate technical and
organisational measures to ensure a level of
security appropriate to the risk”
…Article 32, GDPR

Cyber Security – GDPR in practice
“A personal data breach can be broadly
defined as a security incident that has
affected the confidentiality, integrity or
availability of personal data”
ICO Website – Personal Data Breaches

Cyber Security Fundamentals
• For DATA, we use C.I.A.
▫ Confidentiality
▫ Integrity
▫ Availability
• Risk based approach
▫ Understand what is critical to your business
▫ Understand the vulnerabilities and threats
▫ Assess the risks and impacts
▫ Apply controls to reduce or mitigate
• For reducing risks, we consider
▫ People, Process & Technology

Data - Where is it?

Data – What are the threats?
Malware Ransomware Viruses Worms Trojans Phishing Smishing
Fire Theft Flood
Hardware
failure
Human error DOS Attack RAT’s
Backdoors Corruption Insider threats
Zero day
attacks
Fileless
Malware
Man in the
middle attacks
Credential
stealing
Keyloggers SQL Injection XSS Bluejacking
Spear
Phishing
Whaling
“.. accidental or unlawful destruction, loss, alteration, unauthorised disclosure of,
or access to personal data transmitted, stored or otherwise processed”
..Article 32, GDPR

Cyber Security Frameworks

Cyber Security Personal Data Security
“.. the ability to ensure the ongoing
confidentiality, integrity, availability and
resilience of processing systems and services”
…Article 32, GDPR
Cyber Security Personal Data Security (GDPR)
CIA CIA
Risk Based Approach - DATA Risk based Approach – PERSONAL DATA
No formal requirement Demonstrable
Incident Response Plan Breach Response Plan

Cyber Security – Where are you at?

Cyber Security is a journey…

Common Gaps
Checking backups AV coverage Copies of data Cloud Security Policies
Contracts & SLA’s Staff training
Password
Management
Multi Factor
Authentication
Encryption (All
Devices)
BYOD Management
Individual User
Accounts
Monitoring &
Auditing
Updating
Applications
Least Privilege
DOCUMENTATION!
Incident Response
Plan

If things do go wrong….
Under the GDPR there is a
requirement for organisations to
report a personal data breach that
affects people’s rights and freedoms,
without undue delay and, where
feasible, not later than 72 hours after
having become aware of it

Key Actions & Take-aways

GDPR & Cyber Security
GDPR Conference 13th March, 2018
Darren Chapman
Director & Principal Security Consultant
Pragmatic IT Security
Thank You

Speaker Q+A
@norfolkchamber #NorfolkGDPR
www.slido.com #GDPR

Workshops
Workshop A -
A Practical Marketing Approach
to GDPR
Workshop B – Appointing a
Data Protection
@norfolkchamber #NorfolkGDPR
www.slido.com #GDPR

@norfolkchamber #NorfolkGDPR
www.slido.com #GDPR
Please feel free to complete these cards which
can be found in your Delegate folders, and hand
them in at Reception.

Thank you #GDPRConf18