This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.
You can find the current article at its original source at http://www.theguardian.com/technology/askjack/2018/mar/29/gdpr-email-data-protection-regulations-secure
The article has changed 6 times. There is an RSS feed of changes available.
| Version 3 | Version 4 |
|---|---|
| GDPR: how can I email data securely to comply with the new regulations? | GDPR: how can I email data securely to comply with the new regulations? |
| (about 2 months later) | |
| As a freelance media professional, I am often asked by my various employers to send copies of my passport, completed visa forms and other sensitive data in the form of email attachments. I have recently questioned this and have not really got a satisfactory response. I have tried uploading these documents to my Google Drive account and giving them a link, though I don’t really know whether this method is any safer. However, I am at a loss to see how companies should acquire such sensitive data in light of the new GDPR rules coming into force in May. Robert | As a freelance media professional, I am often asked by my various employers to send copies of my passport, completed visa forms and other sensitive data in the form of email attachments. I have recently questioned this and have not really got a satisfactory response. I have tried uploading these documents to my Google Drive account and giving them a link, though I don’t really know whether this method is any safer. However, I am at a loss to see how companies should acquire such sensitive data in light of the new GDPR rules coming into force in May. Robert |
| The European Union’s General Data Protection Regulation (GDPR), which comes into force on May 25, will govern the storage and processing of data rather than its collection. It also includes some very important consumer rights. The most important are the right to be informed, the right of access, the right to correct errors, the right to erase data, the right to restrict processing, and the right take it elsewhere (data portability). How useful these will be in practice remains to be seen. | The European Union’s General Data Protection Regulation (GDPR), which comes into force on May 25, will govern the storage and processing of data rather than its collection. It also includes some very important consumer rights. The most important are the right to be informed, the right of access, the right to correct errors, the right to erase data, the right to restrict processing, and the right take it elsewhere (data portability). How useful these will be in practice remains to be seen. |
| The European Union's new stronger, unified data protection laws, the General Data Protection Regulation (GDPR), will come into force on 25 May 2018, after more than six years in the making. | The European Union's new stronger, unified data protection laws, the General Data Protection Regulation (GDPR), will come into force on 25 May 2018, after more than six years in the making. |
| GDPR will replace the current patchwork of national data protection laws, give data regulators greater powers to fine, make it easier for companies with a "one-stop-shop" for operating across the whole of the EU, and create a new pan-European data regulator called the European Data Protection Board. | GDPR will replace the current patchwork of national data protection laws, give data regulators greater powers to fine, make it easier for companies with a "one-stop-shop" for operating across the whole of the EU, and create a new pan-European data regulator called the European Data Protection Board. |
| The new laws govern the processing and storage of EU citizens' data, both that given to and observed by companies about people, whether or not the company has operations in the EU. They state that data protection should be both by design and default in any operation. | The new laws govern the processing and storage of EU citizens' data, both that given to and observed by companies about people, whether or not the company has operations in the EU. They state that data protection should be both by design and default in any operation. |
| GDPR will refine and enshrine the "right to be forgotten" laws as the "right to erasure", and give EU citizens the right to data portability, meaning they can take data from one organisation and give it to another. It will also bolster the requirement for explicit and informed consent before data is processed, and ensure that it can be withdrawn at any time. | GDPR will refine and enshrine the "right to be forgotten" laws as the "right to erasure", and give EU citizens the right to data portability, meaning they can take data from one organisation and give it to another. It will also bolster the requirement for explicit and informed consent before data is processed, and ensure that it can be withdrawn at any time. |
| To ensure companies comply, GDPR also gives data regulators the power to fine up to €20m or 4% of annual global turnover, which is several orders of magnitude larger than previous possible fines. Data breaches must be reported within 72 hours to a data regulator, and affected individuals must be notified unless the data stolen is unreadable, ie strongly encrypted. | To ensure companies comply, GDPR also gives data regulators the power to fine up to €20m or 4% of annual global turnover, which is several orders of magnitude larger than previous possible fines. Data breaches must be reported within 72 hours to a data regulator, and affected individuals must be notified unless the data stolen is unreadable, ie strongly encrypted. |
| “Personal data” includes names, addresses, phone numbers and IP addresses, as well as whatGDPR calls “factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”. That includes biometrics such as face, fingerprint and iris recognition, and genetic information. In other words, you may have personal data that identifies someone even if you don’t know their name. | “Personal data” includes names, addresses, phone numbers and IP addresses, as well as whatGDPR calls “factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”. That includes biometrics such as face, fingerprint and iris recognition, and genetic information. In other words, you may have personal data that identifies someone even if you don’t know their name. |
| GDPR applies to companies and organisations, particularly those with more than 250 employees. Home and household users are exempt. However, as a freelancer, you store and process data, even if the “processing” just means entering a name in an address book and looking it up. You should therefore do an audit of the devices and software you use to make sure that other people’s personal data is protected. This may require the use of data backups, passwords, encryption, malware protection, and a VPN when using public hotspots. The GDPR also obliges you to tell people if there are any security breaches. | GDPR applies to companies and organisations, particularly those with more than 250 employees. Home and household users are exempt. However, as a freelancer, you store and process data, even if the “processing” just means entering a name in an address book and looking it up. You should therefore do an audit of the devices and software you use to make sure that other people’s personal data is protected. This may require the use of data backups, passwords, encryption, malware protection, and a VPN when using public hotspots. The GDPR also obliges you to tell people if there are any security breaches. |
| You should also audit your data to make sure that you are only holding data that is necessary for your jobs, or that you are legally required to hold, eg for tax purposes. | You should also audit your data to make sure that you are only holding data that is necessary for your jobs, or that you are legally required to hold, eg for tax purposes. |
| The UK’s Information Commissioner’s Office (ICO) has a useful 12-step plan (PDF), though like most things GDPR-related, it’s aimed at companies. IBM’s Liz Henderson provides a good summary in two posts on LinkedIn, GDPR Plan – Do you have yours? and GDPR Initial Steps, What’s Next...? | The UK’s Information Commissioner’s Office (ICO) has a useful 12-step plan (PDF), though like most things GDPR-related, it’s aimed at companies. IBM’s Liz Henderson provides a good summary in two posts on LinkedIn, GDPR Plan – Do you have yours? and GDPR Initial Steps, What’s Next...? |
| Note: the GDPR is being modified and implemented in the UK by the data protection bill, which is still going through parliament. It should include some exceptions for journalism similar to the ones in the previous DPA, so check whether these apply to you. | Note: the GDPR is being modified and implemented in the UK by the data protection bill, which is still going through parliament. It should include some exceptions for journalism similar to the ones in the previous DPA, so check whether these apply to you. |
| Email problems | Email problems |
| You are right to be concerned about sending things by email. Emails are more like plain text postcards because they can, in theory, be read at any of the many servers through which they pass, or by someone tapping a line. Of course, “read by” is unlikely to mean “read by a human being.” However, software can look for things like passwords and credit card numbers. | You are right to be concerned about sending things by email. Emails are more like plain text postcards because they can, in theory, be read at any of the many servers through which they pass, or by someone tapping a line. Of course, “read by” is unlikely to mean “read by a human being.” However, software can look for things like passwords and credit card numbers. |
| A more likely problem is sending emails to the wrong address, either because users have got their own email addresses wrong (this happens surprisingly often), or through human error. Pick the wrong address from a list of auto-complete suggestions and you could send personal data to the wrong recipient. This would be a data breach that might have to be reported. | A more likely problem is sending emails to the wrong address, either because users have got their own email addresses wrong (this happens surprisingly often), or through human error. Pick the wrong address from a list of auto-complete suggestions and you could send personal data to the wrong recipient. This would be a data breach that might have to be reported. |
| It would obviously be good thing if all emails were encrypted by default so that only the intended recipient could read them. Three decades of history says this isn’t going to happen soon, if at all. Public key encryption is too hard for people who just want to send normal emails. | It would obviously be good thing if all emails were encrypted by default so that only the intended recipient could read them. Three decades of history says this isn’t going to happen soon, if at all. Public key encryption is too hard for people who just want to send normal emails. |
| Some large organisations do have encrypted email services, such as the NHS, but that doesn’t help the rest of us. | Some large organisations do have encrypted email services, such as the NHS, but that doesn’t help the rest of us. |
| Some people do choose secure email services, such as ProtonMail in Switzerland and Tutanota in Germany. However, you also have to send external recipients a password – for example, in an SMS text message – to decrypt the email. | Some people do choose secure email services, such as ProtonMail in Switzerland and Tutanota in Germany. However, you also have to send external recipients a password – for example, in an SMS text message – to decrypt the email. |
| Tutanota users get an email that says “you have an encrypted email” and you click a link to read it, and reply to it, in a browser. You have to export the email if you want to keep a copy. | Tutanota users get an email that says “you have an encrypted email” and you click a link to read it, and reply to it, in a browser. You have to export the email if you want to keep a copy. |
| There are also plug-ins for Gmail and the Microsoft Outlook email program that provide secure email services. If one of your employers is using a secure system, they might let you join in. | There are also plug-ins for Gmail and the Microsoft Outlook email program that provide secure email services. If one of your employers is using a secure system, they might let you join in. |
| If there’s no other alternative, you should encrypt and password-protect your images and documents before sending them as email attachments. Again, you must send the password separately, either via a different messaging service or in the post. | If there’s no other alternative, you should encrypt and password-protect your images and documents before sending them as email attachments. Again, you must send the password separately, either via a different messaging service or in the post. |
| Online storage locations | Online storage locations |
| It’s a good idea to upload attachments and then send people a link. However, bear in mind that you are uploading documents to the company that probably runs the biggest surveillance operation on the planet. Encrypt your documents before you upload them. | It’s a good idea to upload attachments and then send people a link. However, bear in mind that you are uploading documents to the company that probably runs the biggest surveillance operation on the planet. Encrypt your documents before you upload them. |
| Encryption protects data if an online storage service is compromised – it has happened – or if your email is hacked. | Encryption protects data if an online storage service is compromised – it has happened – or if your email is hacked. |
| Unfortunately, using Google Drive brings up an extra complication. If you are using Gmail, then you can assume that your data is being held in, or passing through, or accessible from the USA. | Unfortunately, using Google Drive brings up an extra complication. If you are using Gmail, then you can assume that your data is being held in, or passing through, or accessible from the USA. |
| GDPR does not oblige users to store data on servers inside the EU. However, there are extra requirements if servers are outside the EU. First, you need to have a legitimate reason for transferring personal data outside the EU. Second, you must have the consent of the person whose data is being exported. Third, you must give that person the option to opt out. | GDPR does not oblige users to store data on servers inside the EU. However, there are extra requirements if servers are outside the EU. First, you need to have a legitimate reason for transferring personal data outside the EU. Second, you must have the consent of the person whose data is being exported. Third, you must give that person the option to opt out. |
| In another post, the aforementioned Liz Henderson explains how to create a GDPR Privacy Notice, and you could adapt her sample to cover Gmail storage outside the EU. | In another post, the aforementioned Liz Henderson explains how to create a GDPR Privacy Notice, and you could adapt her sample to cover Gmail storage outside the EU. |
| You could switch to using an email service that operates wholly within the EU (see above), if only for any people who opt out, or you could upgrade to Google’s paid-for service. | You could switch to using an email service that operates wholly within the EU (see above), if only for any people who opt out, or you could upgrade to Google’s paid-for service. |
| Google claims that its G Suite and Google Cloud Platform (GCP) services are fully compliant with GDPR, because it offers to sign EU Model Contract Clauses and a Data Processing Amendment. The fine print notes that “the parties acknowledge and agree that Non-European Data Protection Legislation may also apply to the processing of Customer Personal Data” and that “Google will not process Customer Personal Data for Advertising purposes or serve Advertising in the Services”. | Google claims that its G Suite and Google Cloud Platform (GCP) services are fully compliant with GDPR, because it offers to sign EU Model Contract Clauses and a Data Processing Amendment. The fine print notes that “the parties acknowledge and agree that Non-European Data Protection Legislation may also apply to the processing of Customer Personal Data” and that “Google will not process Customer Personal Data for Advertising purposes or serve Advertising in the Services”. |
| I don’t think GDPR will actually stop advertising-driven personal data processing. Just look forward to clicking “I agree” to lots of terms and conditions you won’t even bother to read. | I don’t think GDPR will actually stop advertising-driven personal data processing. Just look forward to clicking “I agree” to lots of terms and conditions you won’t even bother to read. |
| IANAL! | IANAL! |
| Bear in mind that GDPR is a legal matter and I am not a lawyer. I am also not an expert on GDPR. Companies who can be fined up to €20 million or 4% of their annual turnover should take this stuff seriously and follow the ICO’s advice. Lots of consultancies are offering guides, training, software toolkits and other services, too. | Bear in mind that GDPR is a legal matter and I am not a lawyer. I am also not an expert on GDPR. Companies who can be fined up to €20 million or 4% of their annual turnover should take this stuff seriously and follow the ICO’s advice. Lots of consultancies are offering guides, training, software toolkits and other services, too. |
| Freelancers like us are not the target, but we should work to comply as best we can. In particular, don’t keep any personal data you don’t need, and store and use it securely. Indeed, you should do those things even if the GDPR didn’t exist. | Freelancers like us are not the target, but we should work to comply as best we can. In particular, don’t keep any personal data you don’t need, and store and use it securely. Indeed, you should do those things even if the GDPR didn’t exist. |
| Have you got a question? Email it to Ask.Jack@theguardian.com | Have you got a question? Email it to Ask.Jack@theguardian.com |
| This article contains affiliate links, which means we may earn a small commission if a reader clicks through and makes a purchase. All our journalism is independent and is in no way influenced by any advertiser or commercial initiative. By clicking on an affiliate link, you accept that third-party cookies will be set. More information. | |
| Technology | Technology |
| Ask Jack | Ask Jack |
| Data protection | Data protection |
| Data and computer security | Data and computer security |
| European Union | European Union |
| Europe | Europe |
| Alphabet | Alphabet |
| features | features |
| Share on Facebook | Share on Facebook |
| Share on Twitter | Share on Twitter |
| Share via Email | Share via Email |
| Share on LinkedIn | Share on LinkedIn |
| Share on Pinterest | Share on Pinterest |
| Share on WhatsApp | Share on WhatsApp |
| Share on Messenger | Share on Messenger |
| Reuse this content | Reuse this content |