Data Champions can implement technology that can help DPOs manage data and protection simply and effectively
Mark Roebuck, DPO and Founder of ProvePrivacy
The very thought of keeping up-to-date with new regulations, cyber threats and improving data protection can send shivers down the spines of companies across all sectors. Such is the threat and the sheer number of ways that personal data can be compromised, that aligning data protection across an organisation is often no small task.
Of course, data protection is not just about the threat from cybercriminals but also compliance obligations, weak controls, internal mistakes and system errors. There is also the risk of implementing new practices where protecting personal data is not considered adequately. For those companies that hold particularly sensitive data, the task is all the more challenging as the risk to data subjects can be considered higher making the landscape in which they sit complex and ever-changing.
The role of the Data Protection Officer
All companies are now data-driven in some form or another with huge amounts of data residing in systems. Therefore, the role of the Data Protection Officer (DPO) within companies has grown in importance over the past decade. DPOs have significant responsibilities and a huge range of tasks in front of them, but the main one is to ensure that practices and policies that protect personal data are implemented across all departments and functions.
For many organisations the DPO position is mandated by articles 37, 38 and 39 of GDPR regulations. As well as being responsible for advising on how to protect privacy, DPOs must also ensure that organisations can evidence compliance with data protection regulation and that they don’t fall foul of other aspects of GDPR relating to transparency, accountability and accuracy.
In the event of a serious incident, data breach or complaint, DPOs will act for the data subject and as an intermediary between the organisation and the data protection regulator such as the Information Commissioner’s Office (ICO). They are also the go-to person when problems relating to data privacy occur within the organisation.
‘Data protection by design and default’
It is clear therefore, that DPOs have a wide range of tasks spanning the whole of the organisation. One of the main elements is to ensure that practices and policies that protect data are implemented in every department. One behaviour which can very much help the DPO in this regard is the implementation of ‘data protection by design and default’. This essentially ensures that any system, service, product and/or business practice is designed with the protection of personal data as a default consideration.
The DPO is consulted at all stages of the implementation of a process, which means that systems are developed where data remains protected without the individual having to change or do anything. It also means that data protection is weaved through everyday business processes. The ‘default’ nature of this means that once a procedure or system is implemented staff can rest assured that data is protected making their task somewhat easier.
It is no longer effective to have one individual sitting above multiple departments
‘Data protection by design and default’ is a fundamental project requirement within UK GDPR data protection legislation. It requires a risk assessment of all data protection and processing activities to be performed at the conception and design stage of a project and throughout the entire project lifecycle, as well as when procedures, data sources or contracts with data processors change.
However, for the DPO implementing this across multiple departments and untold numbers of systems is difficult. They may not have the right level of knowledge to effectively implement this in every specific system.
In too many organisations the DPO is considered by the rest of the company as the first line of defence concerning the protection of personal data and they are expected to act accordingly. The issue though is that the DPO does not own the data or the procedures.
The threat to personal data from cybercriminals as well as the individual complexities within particular departments means that it is not effective to have one individual sitting above multiple departments implementing a generalised approach.
Turning to Data Champions
Instead, companies should be devolving responsibility for data protection to ‘Data Champions’ within departments, ensuring that the data owners themselves are the first line of defence. This means that there is specific expertise and knowledge of the nuances of systems and approaches within departments. It also means that departments are equipped to build in data protection by design, when change is being affected and the DPO can remain in an advisory capacity.
The appointment of Data Champions means that there is a better chance of finding specific vulnerabilities that might be missed by a DPO sitting above. The DPOs role is still critical as they will be ultimately responsible for providing advice but the responsibility for personal data remains within specific touchpoints/individual departments of the business.
The Data Champion has a greater understanding of the department’s need for personal data, how it is used and how it can be protected by default. By putting Data Champions in place data protection by design and by default becomes easier to achieve.
Data Champions can help DPOs manage data and protection effectively
The introduction of Data Champions can be more effective with the implementation of supporting technology that can help DPOs build a Record of Processing Activities to gain a holistic view of data allowing them to more simply and effectively monitor and manage data protection. Identifying data protection risks, maintaining policies and procedures and providing colleagues, with training that allows them to better understand the threats and vulnerabilities can all be implemented with one, simple to use, platform.
