Compliance with GDPR

April 13, 2018 Sue Diltz

Woman hand holding mobile phone and laptop data synchronization

 

The European Union’s (EU) General Data Protection Regulation (GDPR), effective May 25, 2018, enhances the security of personal information of citizens and residents of the EU countries as well as Norway, Iceland and Lichtenstein. The unified standard also will cover UK citizens and residents post-Brexit. It’s hard to imagine a company or industry offering goods or services in Europe that won’t be affected by these detailed personal data protection requirements.

Speaking for Graebel, I welcome the new regulations. They’re rigorous but reasonable and consistent with the spirit of security and transparency in which we’ve handled personal information in the past, not only in Europe but around the globe.

The Requirements

In general, the GDPR builds on the EU’s previous privacy standards – the 1995 Data Protection Directive. It expands and clarifies those requirements in areas including:

  • Territorial Scope – It will apply to all organizations with access to the personal information of residents of these countries regardless of where the company is based
  • Penalties – The new structure of fines is graduated and capped. Maximum fines are larger than in the past.
  • Consent – Consent forms must be clear and succinct with minimal “legalese”
  • Rights of Individuals:
    • Breach notification – They must be notified within 72 hours of the discovery of a breach of their information
    • Right to Access – They may request information about their personal data maintained by the organization
    • “Right to be Forgotten” – They can request the organization erase their personal information
    • Data Portability – They can retrieve their information and share it with another entity
  • Privacy by Design – Personal information security must be a component of the initial design of any systems that use or hold such data.
  • Data Protection Officers – Organizations must appoint a Data Protection Officer if their personal information processing activities exceed a certain threshold.

For more on these issues, you can go right to the source and review the EU’s material, including a useful summary of the requirements.

GDPR and Mobility

As a Relocation Management Company (RMC), we’re entrusted every day with basic personal identifier information for transferees and assignees. And in cases of immigration and other functions, we may require and store personal information that’s even more sensitive – related for example to citizenship, gender, marital status and even place of birth. Protecting this information is critical.

And our GDPR obligations extend to each of the partner companies and service providers with whom we share this information as they work on behalf of our customers. That’s one of the reasons we carefully screen our global service partners – the companies that handle specific relocation services from household goods management to immigration and tax support. We not only must ensure they’re taking excellent care of our customers, we must verify they have proper systems in place to protect confidential personal information.

The European Relocation Association (EuRA) has released an extensive review of the key provisions of the GDPR from the perspective of the Mobility industry.

Graebel is Ready

Following the adoption of the GDPR in April 2016, Graebel created a cross-functional Assessment team and began the process of updating our policies and procedures to integrate the new requirements. Since that time, we’ve taken the following steps, which will be completed by May 25:

  • Retained a third party (TrustArc) to perform a prioritized Gap assessment to identify steps we needed to take
  • Conducted a data inventory and business process maps to address GDPR Article 30
  • Identified all external-facing applications that collect data and then created related privacy notices
  • Documented our processes as a Data Controller and a Data Processor to address GDPR Article 30.1
  • Developed custom code for our cookie notices/consent process
  • Validated our records retention policy to align with GDPR Articles 5/25
  • Updated our Incident Response Plan to ensure notification processes are in place for individuals and authorities in accordance with GDPR Articles 32/33
  • Developed a process and plan for the Data Privacy Impact Assessments to address GDPR Article 6.4
  • Updated our client and supplier contracts to address GDPR Article 30
  • Developed employee training to prepare teams for their specific responsibilities related to the GDPR requirements
  • Created internal processes to support the individual rights elements of GDPR related to Articles 15/17/20
  • Developed an annual testing plan of our GDPR Compliance Program, including Breach Notification

Again, we congratulate the EU countries on the thoughtful way they’ve drafted these new regulations. Yes, preparing for this has been a lot of work for us and other RMCs. But our processes are the better for it since the requirements are based on a very defensible approach to protecting individual privacy.

Here’s to the World Ahead!

 

About the Author

Sue Diltz

Sue Diltz leads Graebel’s technology team and is responsible for maintaining strict IT security throughout all of Graebel’s operations as well as developing strategic technology solutions that drive efficiencies and productivity. Prior to joining Graebel in 2012, Ms. Diltz served as Director of Infrastructure & Technology Services at Children’s Hospital Colorado and before that was the Senior Director of Technology Services at Time Warner Telecom. She holds a Bachelor of Science in Management from Regis University and a Masters of Organizational Leadership from Colorado State University. Additionally, Ms. Diltz is a Certified Information Systems Security Professional (CISSP) and holds a GIAC Law of Data Security & Investigations (GLEG) certification.

Follow on Linkedin More Content by Sue Diltz
Previous Article
What’s the State of Mobility?
What’s the State of Mobility?

2018 will be remembered as a year when Mobility programs grew in influence and scope. Our research from 242...

Next Article
Data integration and other tech tools to support mobility programs
Data integration and other tech tools to support mobility programs

Integrating mobility programs with human resources, payroll and other corporate data systems is critical. C...