C&L_December 2017 (1)

Cover Story
“In India, however, 7 out 10 BFSI
organizations (handling EU customer
data/business) we reached out to did
not want to comment on their GDPR
preparedness”
The ABC of GDPR
The General Data Protection Regulation
(GDPR) is a law or a regulation, which
was adopted by the European Commission
on 27 April 2016. The GDPR
applies to any organization, regardless
of geographic location, which controls
or processes the data of an EU resident
in a proscribed way. It dictates to what
extent personal data may be collected,
the need for explicit consent to gather
such data, requirements to disclose
breaches of data and stronger powers
to substantially fine organizations that
fail to protect the data for which they are
responsible.
Applicability: Applies to entities —
including third parties that are (i) established
in the EU, (ii) providing goods
or services to EU residents or (iii) are
monitoring the behavior of individuals in
the EU
Building: Privacy-by-design principles
must be incorporated into the development
of new processes and technologies
Empowering Consumers: Organizations
Source: EY’s cyber and privacy insights document
will have to facilitate customers’ and
employees’ right to erasure (of data),
right to portability, and an increased right
of access.
Fines: Up to EUR20 million or 4% of
the organization’s total global revenue,
whichever is greater; also provides individuals
new rights to bring class actions
against data controllers or processors,
if represented by not-for profit organizations,
which heightens litigation risk
Reporting: Organizations will have only
72 hours to report data breaches
Employing People: Most organizations
will need to designate a Data Protection
Officer and a Data Controller
Storage: Organizations will have to
maintain records of processing activities
Security: Organizations will need to
scale security measures based on privacy
risks.
Permissions: Explicit and affirmative
consent will be required before processing
personal data.
For long, the fleeting mention of
GDPR in India came up only at the time
of reporting a security breach. Until in
2016, Indian regulators namely The
Reserve Bank of India and Securities
and Exchange Board of India (SEBI)
issued frameworks to strengthen cyber
security in the BFSI sector.
“Banks, as owners of such data,
should take appropriate steps in preserving
the Confidentiality, Integrity
and Availability of the same, irrespective
of whether the data is stored/in
transit within themselves or with customers
or with the third party vendors;
the confidentiality of such custodial
information should not be compromised
at any situation and to this end,
suitable systems and processes across
the data/information lifecycle need to
be put in place by banks,” RBI explicitly
highlighted in the framework under
section subtitled ‘Ensuring Protection
of customer information’.
In September 2016, SEBI also asked
commodity derivatives exchanges to
put in place a framework to safeguard
systems, networks and databases from
cyber attacks. It also announced the
appointment of a new Chief Security
Officer who will be responsible for
strengthening SEBI's regulatory policy
framework in the area of cyber security.
Going a step further in April 2017, the
Insurance Regulatory and Development
Authority of India (IRDAI) tightened
the noose on CEOs and CMDs
of all insurance firms, giving them a
period of about a year to ensure that
adequate mechanisms are put in place
to address the issues related to information
and cyber security.
The icing on the cake this year was
the Supreme Court's landmark verdict
on the right to privacy. Additionally,
India is now moving towards legislation
on data protection. The central
government had set up an expert committee
to study the different issues
relating to data protection in India and
make specific suggestions on principles
underlying a data protection bill.
10 CIO&LEADER | December 2017