GDPR

GDPR is obviously an important piece of legislation, not only for us, but for you, our customers.

As part of our GDPR preparations, we have created this FAQ to help you prepare for GDPR as well as reassure you about our own preparations.

What does GDPR stand for?

General Data Protection Regulation.

How did it come about?

In January 2012, the European Commission set out plans for data protection reform across the European Union in order to make Europe ‘fit for the digital age’. Almost four years later, agreement was reached on what that involved and how it will be enforced.

One of the key components of the reforms is the introduction of the General Data Protection Regulation (GDPR). This new EU framework applies to organisations in all member-states and has implications for businesses and individuals across Europe, and beyond.

“The digital future of Europe can only be built on trust. With solid common standards for data protection, people can be sure they are in control of their personal information,” said Andrus Ansip, vice-president for the Digital Single Market, speaking when the reforms were agreed in December 2015.

What is GDPR?

At its core, GDPR is a new set of rules designed to give EU citizens more control over their personal data. It aims to simplify the regulatory environment for business so both citizens and businesses in the European Union can fully benefit from the digital economy.
 
The reforms are designed to reflect the world we’re living in now, and brings laws and obligations – including those around around personal data, privacy and consent – across Europe up to speed for the internet-connected age.
 
Fundamentally, almost every aspect of our lives revolves around data. From social media companies, to banks, retailers, and governments — almost every service we use involves the collection and analysis of our personal data. Your name, address, credit card number and more all collected, analysed and, perhaps most importantly, stored by organisations.

What is GDPR compliance?

Data breaches inevitably happen. Information gets lost, stolen or otherwise released into the hands of people who were never intended to see it — and those people often have malicious intent.

Under the terms of GDPR, not only will organisations have to ensure that personal data is gathered legally and under strict conditions, but those who collect and manage it will be obliged to protect it from misuse and exploitation, as well as to respect the rights of data owners – or face penalties for not doing so.

Who does GDPR apply to?

GDPR applies to any organisation operating within the EU, as well as any organisations outside of the EU which offer goods or services to customers or businesses in the EU. That ultimately means that almost every major corporation in the world will need to be ready when GDPR comes into effect, and must start working on their GDPR compliance strategy.

There are two different types of data-handlers the legislation applies to: ‘processors’ and ‘controllers’. The definitions of each are laid out in Article 4 of the General Data Protection Regulation.

A controller is “person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing of personal data”, while the processor is “person, public authority, agency or other body which processes personal data on behalf of the controller”. If you are currently subject to the UK’s Data Protection Act, for example, it’s likely you will have to look at GDPR compliance too.

“You will have significantly more legal liability if you are responsible for a breach. These obligations for processors are a new requirement under the GDPR,” says the UK’s Information Commissioners Office, the authority responsible for registering data controllers, taking action on data protection and handling concerns and mishandling data.

GDPR ultimately places legal obligations on a processor to maintain records of personal data and how it is processed, providing a much higher level of legal liability should the organisation be breached.

Controllers will also be forced to ensure that all contracts with processors are in compliance with GDPR.

What is personal data under the GDPR?

The types of data considered personal under the existing legislation include name, address, and photos. GDPR extends the definition of personal data so that something like an IP address can be personal data. It also includes sensitive personal data such as genetic data, and biometric data which could be processed to uniquely identify an individual.

When does GDPR come into force?

GDPR will apply across the European Union from 25 May 2018, and all member nations are expected to have transferred it into their own national law by 6 May 2018.

Following four years of preparation and debate, GDPR was approved by the European Parliament in April 2016 and the official texts and regulation of the directive were published in all of the official languages of the EU on May 2016.

What’s the GDPR compliance deadline?

As of 25 May 2018, all organisations are expected to be compliant with GDPR.

How does Brexit impact on GDPR?

The UK is set to leave the EU on 29 March 2019, a little over ten months after GDPR comes into force. The UK government has said this won’t impact on GDPR being enforced in the country, and that GDPR will work for the benefit of the UK despite the country ceasing to be an EU member. So Brexit is unlikely to have any impact on an organisation’s GDPR compliance requirements.

What does GDPR mean for businesses?

GDPR establishes one law across the continent and a single set of rules which apply to companies doing business within EU member states.. This means the reach of the legislation extends further than the borders of Europe itself, as international organisations based outside the region but with activity on ‘European soil’ will still need to comply.

It’s hoped that by slim-lining data legislation with GDPR, it can bring benefits to businesses. The European Commission claims that by having a single supervisor authority for the entire EU, it will make it simpler and cheaper for businesses to operate within the region. Indeed, the Commission claims GDPR will save €2.3 billion per year across Europe

“By unifying Europe’s rules on data protection, lawmakers are creating a business opportunity and encouraging innovation,” the Commission says.

What that means, they say, is regulation will guarantee data protection safeguards are built into products and services from the earliest stage of development, providing ‘data protection by design’ in new products and technologies.

Organisations will also be encouraged to adopt techniques like ‘pseudonymization’ in order to benefit from collecting and analysing personal data, while the privacy of their customers is protected at the same time. (Although some groups have argued that this already comes too late, given the number of connected devices in the world.)

What does GDPR mean for consumers/citizens?

Because of the sheer number of data breaches and hacks which have occurred over the years, the unfortunate reality for many is that some of their data — be it an email address, password, social security number, or confidential health records — has been exposed on the internet.

One of the major changes GDPR will bring is providing consumers with a right to know when their data has been hacked. Organisations will be required to notify the appropriate national bodies as soon as possible in order to ensure EU citizens can take appropriate measures to prevent their data from being abused.

Consumers are also promised easier access to their own personal data in terms of how it is processed, with organisations told that they need to detail how they use customer information in a clear and understandable way.

Some organisations have already moved to ensure this is the case, even if it is as basic as sending customers emails with information on how their data is used and providing them with an opt-out if they don’t issue their consent to be a part of it. Many organisations, such as those in the retail and marketing sectors, have contacted customers to ask if they want to be a part of their database.

In these circumstances, the customer should have an easy way of opting out of their details being on a mailing list. Meanwhile, some other sectors have been warned that they have a lot more to do in order to ensure GDPR compliance – especially when consent is involved.

GDPR is also set to bring a clarified ‘right to be forgotten’ process, which provides additional rights and freedoms to people who no longer want their personal data processed to have it deleted, providing there’s no grounds for retaining it.

Organisations will need to keep these consumer rights in mind once GDPR comes into force.

What is a GDPR breach notification?

Once GDPR comes into force, it’ll introduce a duty for all organisations to report certain types of data breaches which involve unauthorised access to or loss of personal data to the relevant supervisory authority. In some cases, organisations must also inform individuals affected by the breach.

Organisations will be obliged to report any breaches which are likely to result in a risk to the rights and freedoms of individuals and lead to discrimination, damage to reputation, financial loss, loss of confidentiality, or any other economic or social disadvantage.

In other words, if the name, address, data of birth, health records, bank details, or any private or personal data about customers is breached, the organisation is obliged to tell those affected as well as the relevant regulatory body so everything possible can be done to restrict the damage.

This will need to be done via a breach notification, which must be delivered directly to the victims. This information may not be communicated only in a press release, on social media, or on company website. It must be a one-to-one correspondence with those affected.

Under GDPR, when does an organisation need to make a notification about a breach?

The breach must be reported to the relevant supervisory body within 72 hours of the organisation first becoming aware of it. Meanwhile, if the breach is serious enough to mean customers or the public must be notified, GDPR legislation says customers must be made responsible without ‘undue delay.’

What are the GDPR fines and penalties for non-compliance?

Failure to comply with GDPR can result in a fine ranging from 10 million euros to four per cent of the company’s annual global turnover, a figure which for some could mean billions.

Fines will depend on the severity of the breach and on whether the company is deemed to have taken compliance and regulations around security in a serious enough manner.

The maximum fine of 20 million euros or four percent of worldwide turnover — whichever is greater — is for infringements of the rights of the data subjects, unauthorised international transfer of personal data, and failure to put procedures in place for or ignoring subject access requests for their data.

A lower fine of 10 million euros or two percent of worldwide turnover will be applied to companies which mishandle data in other ways. They include, but aren’t limited to, failure to report a data breach, failure to build in privacy by design and ensure data protection is applied in the first stage of a project and be compliant by appointing a data protection officer — should the organisation be one of those required to by GDPR.

What’s in a GDPR-compliant breach notification?

In the event of a company losing data, be it as a result of a cyberattack, human error or anything else, the company will be obliged to deliver a breach notification.

This must include approximate data about the breach, including the categories of information and number of individuals compromised as a result of the incident and the categories and approximate numbers of personal data records concerned. The latter takes into account how there can be multiple sets of data relating to just a single individual.

Organisations will also need to provide a description of the potential consequences of the data breach, such as theft of money, or identity fraud, and a description of the measures which are being taken to deal with the data breach and to counter any negative impacts which might be faced by individuals.

The contact details of the data protection officer, or main point of contact dealing with the breach, will also need to be provided.

When do we need to appoint a Data Protection Officer?

Under the terms of GDPR, an organisation must appoint a Data Protection Officer (DPO) if it carries out large-scale processing of special categories of data, carries out large scale monitoring of individuals such as behaviour tracking or is a public authority.

In the case of public authorities, a single DPO can be appointed across a group of organisations.While it isn’t mandatory for organisations outside of those above to appoint a DPO, all organisations will need to ensure they have the skills and staff necessary to be compliant with GDPR legislation.

There’s no set criteria on who should be a DPO or what qualifications they should have, but according to the Information Commissioner’s Office, they should have professional experience and data protection law proportionate to what the organisation carries out.

Failure to appoint a data protection officer, if required to so by GDPR, could count as non-compliance and result in a fine.

What does GDPR compliance look like?

GDPR might seem complex, but the truth of the matter is that for the most part, the legislation is consolidating principles which currently form part of the UK’s Data Protection Act.

However, there are elements of GDPR such as breach notification and ensuring that someone is responsible for data protection which organisations need to address, or run the risk of a fine.

There’s no ‘one size fits all’ approach to preparing for GDPR. Rather, each business will need to examine what exactly needs to be achieved to comply and who is the data controller who has taken responsibility for ensuring it happens.

“You are expected to put into place comprehensive but proportionate governance measures,” says the UK’s ICO. “Ultimately, these measures should minimise the risk of breaches and uphold the protection of personal data. Practically, this is likely to mean more policies and procedures for organisations, although many organisations will already have good governance measures in place.”

That could be the responsibility of an individual in a small business, or even a whole department in a multinational corporation. Either way, budget, systems and personnel will all need to be considered to make it work.

Under the GDPR provisions that promote accountability and governance, companies need to implement appropriate technical and organisational measures. These could include data protection provisions (staff training, internal audits of processing activities, and reviews of HR policies), as well as keeping documentation on processing activities. Other tactics that organisations can look at include data minimisation and pseudonymisation, or allowing individuals to monitor processing, the ICO said.

In preparing for GDPR, bodies such as the ICO offer general guidance on what should be considered. All organisations will need to ensure they’ve carried out all the necessary impact assessments and are GDPR compliant come 25 May 2018 or risk falling foul of the new directives.

Crystal Summit and GDPR

Crystal Summit Ltd (we/us/our) is both a Data Controller and a Data Processor. If you use any of our services to store data that is subject to the GDPR then you are also a Data Controller. If you use any of our services to process data that is subject to the GDPR on behalf of another Data Controller then you are also a Data Processor.

We have recently updated our Terms and Conditions, Privacy Policy, Data Protection Policy and Data Retention Policy and can confirm that we are fully compliant with the GDPR.

In the course of providing our services to our customers, Crystal Summit may process personal data on our customer’s behalf where such personal data is subject to EU data protection laws like GDPR. To this end, we have created a Data Processing Agreement (DPA) which can be used to form a legally binding agreement between you (as Controller) and us (as Processor) whilst you are a Crystal Summit customer. Please note that we are not able to change this Data Processing Agreement for any particular customer. If you use our services to store/manage data that is subject to the GDPR, then it is your responsibility to ensure there is an agreement between us for us to process such data. Please contact us here if you need a DPA with us. 

All of our web hosting related services are supplied to us by Heart Internet Limited (a sub-processor under GDPR). 

Is my site compliant?

We are unable to confirm that your own site or business is compliant. We can give you as much information as we have about our systems and security, but you will need to make the decision for yourselves on your own compliance.

Where is our data located?

Our primary data centre, managed by Heart Internet Limited, is in Leeds (UK), and has in it:

  • All our Starter, Home, Business and Pro packages
  • Our Virtual Private Servers
  • Our legacy Dedicated Servers
  • Our stand-alone mailboxes
  • Our Hosted Exchange mailboxes
  • All our customer details

Our secondary data centre, managed by Heart Internet Limited, is in the EU, and has in it:

  • Most Dedicated Servers purchased after 2016

SiteDesigner is produced by BaseKit, and they have their own data policy available here.

Email Marketing is produced by Sign-up.to, and they are updating their own data policy.

Our SSL certificates are generated by Starfield Technologies, who have a Privacy Centre here.

StopTheHacker is produced by Cloudflare and does store a small amount of customer data.

Most of our third-party partners are considered Data Processors, and we, or our customers, are the Data Controller.

How secure is our data with you?

All personal data is supplied to us through controlled processes that are protected by appropriate measures, including encryption.

Access to your data is subject to audits and access logging, and is restricted based on the business need.

All staff that have access to your data, or will be collecting data, have been fully trained on respecting customers’ rights, collecting only the data that is needed, adhering to privacy by design, and following other privacy principles.

How physically secure are your data centres?

Heart Internet have built in a secure and resilient network infrastructure and do not rely on third-party solutions.

Our data centres, managed by Heart Internet Limited, are staffed 24 hours a day every day of the year, with extensive physical security measures, including strict access control and CCTV.

What is your own GDPR policy?

Crystal Summit complies with all data protection laws applicable to its operations. GDPR is an evolution of privacy law, and not a drastic departure from the laws and regulations that currently govern our day-to-day operations. We welcome the changes as another step towards maintaining the privacy of our customers, and we’re working towards compliance as appropriate and necessary.

We store data as needed to manage and run your account, including for accounting, product configuration, and other reasons. Please see our Terms and Conditions and Privacy Policy for further information.

Do you have a Data Processing Agreement (DPA)

We have a Data Processing Agreement (GDPR DPA) that meets the requirements of the GDPR. This GDPR DPA is available to all Crystal Summit customers to help them prepare for the GDPR. To obtain a copy, please contact us here.

Where can I find out more?

ICO’s Guide to the General Data Protection Regulation

ICO’s Data Protection Self Assessment