C&L October 2017_LR (5)

More documents

Recommendations

Info

Feature Right to be forgotten/Data erasure: Another important requirements that the EU GDPR has mandated—and which has become somewhat controversial—is the right of the individual to be forgotten or to request erasure of his/her data without ‘undue delay’. This is going to be especially challenging as there would most likely be a stipulated time period and failure to do that in that period may attract stringent penalties/punishment. The front end and back end system should be such that it should not only make it easy for the data subject to give or withdraw consent but also easily request for erasure which then have to be honored within a given time period. Data portability: Another possible requirement—taking a cue from EU GDPR—could be data portability. This means the data controllers or processors are under obligation to provide a data subject’s data to him/her on demand in a structured, commonly used and machine readable format for the latter to transport that data to another data controller. Practically, the challenge for the businesses is not just to make it possible but find an efficient cost-effective manner in which to make it possible. Storage and transfer of personal data: There are a number of requirements from the data controllers or businesses about how they should keep the data subjects in loop where they store the data and if they transfer data to a third party. With evolving technology, there would be a number of clarifications needed to enforce this regulation. For example, for this purpose, if a public cloud will be considered a third party is open for debate. Data protection mechanisms: The EU GDPR explicitly mentions pseudonymization as a data protection mechanism. A robust data protection mechanism may involve advanced techniques of data encryption and/or anonymization. Breach notification to the data subjects: This one is a no-brainer. Any data protection legislation would make it mandatory to for the data controllers to inform the individuals about any breach that happens. While many countries already have laws to address this, in India, it is still not a requirement; nor has been a voluntary practice. So, a new data protection regime will be challenging. Appointment of Data Protection Officers: The EU GDPR asks for a designated Data Protection Officer. This is primarily for accountability purpose as far as regulators are concerned but a dedicated executive also brings in focus. It remains to be seen if some information security professionals would look at a new career path through this responsibility. The companies will have to clear on what would be the role, seniority As a CIO or CISO, it is time for you to examine what the compliance requirements could mean for your organization and your KRAs. While the legislation and enforcement may still be at least a year away level, reporting structure of such an executive and what will be his/her relationship with the CIO and the CISO. Taking a cue from EU GDPR, the private member bill introduced by MP Baijayanta Panda too mentions the need to appoint a Data Protection Officer.“Every data controller or processor or third party, as the case may be, shall appoint a Data Protection Officer having adequate technical expertise in the field of data collection or processing and the ability to address any requests, clarifications or complaints made with regard to the provisions of this Act,” it notes. The draft bill also tries to list the role of Data Protection Officers. It says the role of DPO would be to act as an independent person, address requests, clarifications or complaints by any aggrieved person in stipulated time and recommend actions to be initiated. The Indian bill is yet to be drafted. It may add some other requirements and/or ignore some of the EU GDPR requirements. One of the tricky challenges for Indian banks, telcos and other such companies dealing with individual data will be how to meet the compliance requirements even in the wake of mandate to link with Aadhaar. As a CIO or CISO, it is time for you to examine what the most likely new compliance requirements could mean for your organization and for your KRAs. While the legislation and enforcement may still be at least a year away, it is only now that you can provide input to making of the legislation. Since a regulator like a Data Protection Authority will only be formed later, the committee may not be proactively be able to approach businesses. It is not a bad idea to get your voice heard now. This will ensure that the draft bill does not throw some nasty surprises. The private member bill introduced by Panda is a fairly comprehensive work and may serve as a good starting point in case you want to deliberate and reach out to the authorities with your considered opinion. 8 CIO&LEADER | October 2017
100 IT Decision makers with 10,000+Cr of IT Budget are getting together at 1st-2nd December, 2017 | Amritsar Are you there? For engagement opportunities, please contact AshishKumar ashish.kumar@9dot9.in, 9740761921 DeepakSharmadeepak.sharma@9dot9.in, 9811791110 PrashantAmin prashant.amin@9dot9.in, 9820575282 Gold Partners Technology Partner Associate Partners Organised by A Brand of
Page 1: INSIGHT Meet the global desi IT lea
Page 5 and 6: EDITORIAL Shyamanuja Das shyamanuja
Page 7 and 8: FEATURE 04-08 Are You Ready For A D
Page 9 and 10: Feature stringent regulations for t
Page 11: Feature ...Continued from Page 5 an
Page 15 and 16: Cover Story TAKING STOCK Organized
Page 17 and 18: Cover Story from every Indian state
Page 19 and 20: Cover Story by the K Raheja Corp Gr
Page 21 and 22: Cover Story 2,0 00 1,80 0 1,60 0 TO
Page 23 and 24: Vishal Salvi, Infosys Interview thi
Page 25 and 26: Event Report Sunil Manglore, Managi
Page 27 and 28: Event Report Experience Analytics a
Page 29 and 30: Book Review I t is ironic that in a
Page 31 and 32: Insight Mamatha Chamarthi Chief Dig
Page 33 and 34: Insight Rahul Samant SVP & CIO, Del
Page 35 and 36: Insight O Putting cloud first, lite
Page 37 and 38: Insight The initial driver for the
Page 39 and 40: Insight G Companies are struggling
Page 41 and 42: Insight Another important driver fo
Page 43 and 44: Insight I out of 144 countries 108
Page 45 and 46: #TheBigPicture 52% of winners from

C&amp;L October 2017_LR (5)

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?

C&L October 2017_LR (5)