GENERAL DATA PROTECTION REGULATION
(GDPR)
A guide to security and data protection in life sciences
Preparing for 2018

 To create a UNIFIED DATA PROTECTION LAW for all 28 European Countries.
 To ENHANCE THE LEVEL OF DATA PROTECTION for EU data subjects
 To MODERNIZE THE LAW in line with existing and emerging technologies
GDPR will fundamentally change the way
companies must manage their data
PRIMARY OBJECTIVES OF THE GDPR

GDPR came into force in May 2016 and will be applicable as of
25 May 2018
• It also has international reach – applying to any organization
that processes data of EU data subjects.
• Fines for non-compliance will increase substantially up to a
maximum fine of € 20 million or 4% of global annual turnover
per incident, whichever is higher
KEY ASPECTS OF THE REGULATION

MEDICAL DEPARTMENT
 Nursing department
 Medical laboratories
 Biomedical technology
 Pharmacy
ADMINISTRATIVE SERVICES
 The board
 Human Recourses,
 Legal , Compliance
 Procurement
 Medical record maintenance department
 IT, marketing and planning ,
 education and Training ,
 Billing and Collection ,
 material management,
 Hospital security
HEALTH CARE PROVIDER’ S ORGANIZATIONAL STRUCTURE

Lawfulness, fairness and transparency
 Personal data must be processed lawfully, fairly, and in a transparent manner
 Personal data must be collected for specified, explicit and legitimate purposes
and not further processed in a way incompatible with those purposes.
 Data minimization Personal data must be adequate, relevant and limited to
those which are necessary
 Accuracy Personal data must be accurate and, where necessary, kept up to
date;
 Storage limitation they should be kept for no longer than is necessary
 Integrity and confidentiality appropriate security of the personal data,
including protection against unauthorised or unlawful processing and against
accidental loss, destruction or damage.
KEY PRINCIPLES

•Erasure
•Rectification
•Data Portability and data sharing
stating that the data subject has the right to receive their data in an appropriate
format without hindrance and for data to be transferred between data controllers
where technically feasible
•Restricted Automated decisions and profiling
• Objection to direct marketing
• Claim of compensation from the data controller or processor for damage suffered
■ member states should enact local laws providing criminal sanctions for a
breach of the GDPR.
■ Claims or complaints may be made by not-for-profit bodies, organisations or
associations.
■ on behalf of a group of data subjects.
NEW RIGHTS FOR THE INDIVIDUAL

The appointment of a data protection officer (DPO)
The obligation to carry out privacy risk impact assessments (DPIA)
New data breach notification requirements
Requirement to apply Privacy by design and by Default,
Appropriate Documentation
Monitoring and verifying compliance regular audit
Consent necessary to process children’s data
Changes to the rules for obtaining valid consent
Heavy Fines for controller and PROCESSOR
ENHANCED OBLIGATIONS

Data protection: hidden risks, clear opportunities
Or the opposite :
Data protection: clear risks, hidden opportunities
INVOLVE THE BOARD

hBOARD
REGY 05
.
COMPLIANCE
BOARD
HRDPO
SUBJECTS
LEGAL FINANCE
PROCUREMEN
T
SUPPORT TEAM- THE GATE
KEEPERS
IT/CIO CRO
DIRECT LINES
OF
COMMUNICATION
AUTHORITIES

4
create DATA FLOW MAPPING
conduct RISK ANALYSIS and DPIA
Run a GDPR compliance GAP ANALYSIS
Implement SECURITY MEASURES
PROJECT GDPR COMPLIANCE 1/4

 DISASTER RECOVERY PLAN
 PRIVACY AND DATA PROTECTION POLICIES
 DATA SUBJECT ACCESS REQUEST (DSAR) PROTOCOLS
 DATA BREACH PROTOCOLS
 SECURITY POLICIES
 DATA RETENTION POLICIES
 DATA SUBJECT NOTIFICATIONS
 INCIDENT RESPONSE PLANS
 DATA TRANSFER AND DATA SHARING AGREEMENTS
 DATA PROCESSING AGREEMENTS
DRAFT POLICIES, PLANS AND PROCEDURES
PROJECT GDPR COMPLIANCE 2/4

TRAINING PROCESS AND AWARENESS PROGRAMS
KEY VENDOR CONTRACTS / THIRD-PARTY RISK
CONSENT OF DATA SUBJECTS
NOTIFICATIONS TO DATA SUBJECTS &
DATA SUBJECT’S RIGHT TO ACCESS, MODIFY, TRANSFER
DATA
PROJECT GDPR COMPLIANCE 3/4

10
DATA BREACH NOTIFICATION
■ describe the nature of the breach;
■ state the number of the data subjects affected by the breach;
■ describe the likely consequences of the breach;
■ describe the measures taken or proposed to be taken by the controller to remedy
the breach.
■ There is a tight deadline of 72 hours
INTERNAL BREACH NOTIFICATION PROCEDURES
 identification systems and incident response plans
 Internal breach register:
 Insurance policies
PROJECT GDPR COMPLIANCE 4/4
MONITORING & AUDITING- IMPROVEMENTS

GDPR IS NOT A DEADLINE OR A
DESTINATION,
IT IS A JOURNEY

Anthe Papageorgiou
Compliance Officer , Data Protection Officer (DPO)
Ε : anthipapage@yahoo.gr
LinkedIN : Anthe Papageorgiou
Tweeter : @AnthePapageorg1