Free checklist

Checklist Privacy

Scan "Status Privacy according the GDPR - Avg"

Participant details:

Part 1: Personal data processing

Explanation: Can the data be linked to a specific customer or employee? If so, then this is "personal data". Examples are someone's name, registration number, address, telephone number, account number, e-mail address, orders, payment details, photo, training, CV, assessments, business contact details, job title, medical data, personal preferences, misconduct, creditworthiness, etc. If you think this does not apply to you, you can now close the scan. Please note, if your assessment turns out to be incorrect, this can have unpleasant consequences.

Explanation: Do you want (or can you) qualify with the data your customer or employee in a certain way? In particular behavior, presence, performance or social status. For example, payment data can be used to estimate the risk of nonpayment. Productivity data measures an employee's performance. Camera images portray suspicious behavior. Black lists can be used to exclude certain customers or employees. And group characteristics such as salary level, marital status or postal code area can say something about a person's social status.

Explanation: For example, salary payment requires that you record details of the employee, including his or her bank account number, BSN and gross salary. Delivery of an order requires, among other things, the name, delivery address and order number of your customer. And for the security of your company, for example, you keep a visitor administration with the name of the visitor, his contact person and time of arrival.

Explanation: Do you use data to map undesirable behavior? Do you, for example, monitor the number of hours worked or the internet usage of your employees, check your customer's data to detect fraud or use a security camera?

Part 1: Personal data processing (continuation)

Explanation: This is usually the case when using certain technology such as cookies, location data, device fingerprinting, IP addresses, RFID or biometrics. Thus a website confirms through a cookie that he has placed on the user's computer, that he always communicates with the same user. But the website does not know who is the person behind the computer. The same applies to RFID technology: an entrance gate allows access to a person on the basis of an RFID chip in a pass, but does not know who the person holds the pass.

Explanation: Do you want (or can you) qualify with the data your customer or employee in a certain way? In particular behavior, presence, performance or social status. For example, payment data can be used to estimate the risk of nonpayment. Productivity data can say something about an employee's performance. Camera images portray suspicious behavior. Black lists can be used to exclude certain customers or employees. And group characteristics such as salary level, marital status or postal code area can say something about a person's social status.

Explanation: To what extent does your process influence the family life or lifestyle of your client or employee, his relationships with other people, his physical or mental integrity or autonomy in making decisions? For example, the purchase of a particular product or use of a service can say something about, for example, a person's health, sexual preferences or lifestyle. In an employer-employee relationship, becoming aware of a disorder or illness can have consequences for the functioning of the employee in the workplace or his or her career. The recording of secondary activities can also give the employer insight into the personal interests of the employee.

Explanation: There are various categories of confidentiality: public information requires little to no confidentiality, but for special data such as medical data or for data that can be used for identity theft, the interest of the employee or client in confidentiality is extra large

Part 1: Personal data processing (continuation)

Explanation: Think of number of persons, number of data per person, number of persons who have access to data, number of parties with whom data is shared, etc. The more extensive the data processing is, the greater the chance that an incident or error (hacking, incorrect data, poor administration, people who can not log in to your website, wrong deliveries, etc.) has annoying consequences for your employees or customers, and therefore for you.

Explanation: Do you cooperate with third parties or do you share the data with others (co-responsible parties)? Think of a joint industry warning system (= blacklist of customers or employees) or conducting a joint personnel registration by several subsidiaries in a concern. Do you enable a supplier (processor) for your company (process) or data processing? Think of outsourcing your IT system (cloud), outsourcing of payroll administration or switching on a call center

End Part 1: Go to the next page

Part 2: Measures taken in the organization

'Het Nieuws' is currently testing a major update for the 'Registration' application, which makes the application even more secure. Because this is a major system change that may have an impact on the privacy of those involved, the newspaper has a Privacy Impact Assessment (PIA) performed on this system by an external auditor. With the help of the results of the PIA, risks can be mitigated at an early stage.

In the past, an employee of 'Het Nieuws' lost a USB stick, in which the personal data on this USB were abused. This has led to individuals from the database of the newspaper being approached unsolicited by a marketing company for renting homes. In the past year, the newspaper has been busy drawing up a procedure for reporting data leaks, so that in the future it knows which steps to take in the event of such a data leak. The procedure includes the following: • The difference between a security incident and a data breach: a security incident is a data breach if the protection of personal data has been breached, the data being exposed to loss or unlawful processing of personal data; • Security incidents are always registered in a registration tool; • In the case of a data breach, this will be reported to the Dutch Data Protection Authority as soon as possible, but in any case within 72 hours; • In the case of a data leak, a risk assessment is made and the parties involved are informed if necessary; • Examples of incidents that can lead to a data breach, including the loss of a USB stick, a burglary by a hacker, a malware infection or a calamity such as fire in the data center.

The newspaper 'Het Nieuws' maintains an overview of the personal data that is being processed. For each processing a set of data is included in this overview so that it is clear that every processing has a purpose, the security is sufficiently guaranteed and the data is stored according to the legal storage period.

The newspaper has a legal obligation to process personal data for the processing of wage data from employees. If, for example, the newspaper also wants to use the data of the employees for sending out newsletters, it must request explicit permission from the employees for this processing. A distinction is made in law between these situations: • You have a statutory obligation to process personal data. • You process personal data in the context of the execution of a contract. • There is a vital interest for those involved. • You have received explicit permission from the data subjects to process his / her personal data.

Part 2: Measures taken in the organization(continuation)

The newspaper's name, email address and home address of the employee needed to process payroll data. For this processing, for example, data about hierarchical chef is not necessary, while the newspaper does have this information. For each processing, the newspaper must check whether the goal can not be achieved with less personal data.

The newspaper has taken various measures to ensure that the data of its employees are correct and up-to-date. The data of a new employee checks the newspaper on the basis of an original identity document. A new employee receives an e-mail to confirm the account, a measure to ensure that the data is correct. With the citizen's service number (BSN) specified, a check is done, the so-called eleven test, to determine whether the specified BSN exists, which does not mean that it is the correct BSN.

Employees of the Personnel Department of the newspaper have access to the personal details of the employees. Employees of the 'Creditors' department of the newspaper are responsible for the monthly payment of 'Fix IT' for the services provided. They do not need to have access to the personal details of the employees to perform their duties. For this reason they have no access to the applications 'Human Resources'. Installation according to the 'need-to-know' principle?

To ensure that employees who do not need access do not actually have access, access to the applications is protected with a unique user name and password. The password must consist of at least 10 characters, must contain at least a letter, a number and a sign and must be changed every three months. The applications are only accessible from the internal network of the newspaper. If employees of the newspaper want to work at home, they can access the internal network with a VPN connection. This requires two-factor authentication, which means that the employee must log in with an additional authentication tool (eg soft-token) in addition to the user name and password. The newspaper also uses antivirus software to combat viruses. Measures have also been taken to ensure that outside access is protected (by unauthorized persons). The web servers of the applications are managed by 'Fix IT' and they have taken measures to ensure security, such as the use of firewalls, network segmentation (the web server is placed in a DMZ) and monitoring the physical access to the building. and the servers. Asset management = Keeping track of all business software and hardware in a list or system including cloud services, online service subscriptions, purchased security certificates and network components and mobile data carriers such as usb and external hard drives. Pentest = having a technical check carried out by the recognized company on the internet access and the internal network

Part 2: Measures taken in the organization (continuation)

Special data includes religion, race, sexual preference, health, membership of and trade union and criminal behavior, but also biometric data, such as fingerprints, voice, handwriting and scans of the retina. The newspaper has chosen to encrypt special data. The encrypted storage of data means that data based on an algorithm can not be read by unauthorized persons. For analysis and control purposes, data is anonymised and only presented in aggregated form. Anonymised data is not personal data and does not fall under the Avg(GDPR)

No personal digital identifiers are used for the processing of personal data internally. However, citizen service numbers (BSN) must be used for communication with the tax authorities with regard to wages. The BSN is an example of a personal digital identifier, because it is a unique number that can be traced back to the person. The newspaper stores the BSN in a pseudonymized manner, which means that the number is made unreadable with a cryptographic hash function.

The general terms and conditions of the newspaper state that the data subjects (subscribers) have the right to access, correct and delete their data. Since the newspaper has included in the register where personal data are included (in which systems) it can easily meet such requests. In doing so, it must take account of other (legal) obligations or interests of third parties, as a result of which the deletion of data or inspection is not permitted. For example, financial data must be kept for 7 years and may not be deleted.

The newspaper has concluded a processor agreement with service provider 'Fix-IT'. In this agreement they have included: • which activities are carried out under the responsibility of the newspaper by the service provider • how the service provider deals with the data • the measures taken by the service provider to ensure the security of the data • entitled 'The News' to audit 'Fix IT' 'Fix IT' has several clients and chooses to hire an external auditor every year to test its internal control measures. The assurance report issued by this auditor provides the newspaper with information about compliance with the measures.

Part 2: Measures taken in the organization (continuation)

The newspaper 'Het Nieuws' has drawn up a privacy policy / information security policy, which includes the following components: • Personal data of subscribers are marked as confidential; • Measures have been taken to protect confidential data, such as restricting access to these data; • Employees may not use data for purposes other than for the work they perform; • A member of the Executive Board is responsible for ensuring compliance with the measures and being compliant with the Avg. • The privacy officer of 'Het Nieuws' supervises the handling of personal data within the newspaper and checks whether the organization complies with the Avg and applicable regulations.

In addition to the Avg, other legislation applies to the newspaper. The privacy officer has drawn up an overview of all legislation that the newspaper must comply with. For example, they have to deal with the Civil Code and, like every entrepreneur, they must comply with the fiscal retention obligation, which requires that financial data be retained for 7 years.

End Part 2: Go to the next page

Closing Checklist Privacy

Free Quickscan of the status of the Privacy

No rights can be derived from this scan