Data privacy concerns throughout the data journey

The data journey is a framework that touches on all aspects of company data, from the collection of data to how it’s used. “That’s a first issue right there,” says Jan Leonard, Data Protection Officer at Orange Belgium. “Is the collected data personal data that is protected by GDPR, for instance? Or is it company data? The latter is still confidential and should be treated in the same way, but from a legal standpoint there is a difference.” What’s important here are the sanctions that can be imposed on organisations in the event of non-compliance with GDPR legislation. They range from warnings to fines that can run into the millions.

The first stage of the data journey is collect: the collection of data. “The biggest challenge in this stage is how well devices are protected. Think of devices such as a thermostat or a camera. The need to better protect that IoT data has only recently come to the fore, even within the EU.” That’s why the European Commission is working on a legislative framework to prohibit the sale of inadequately protected IoT devices.

In our overview, Leonard focuses on data acquired within the context of the Internet of Things – via machines – which qualifies as personal data and, as such, is subject to GDPR. He continues: “Take the example of smart metering: that data appears to be anonymous but the fact that it can be location-based makes it personal in nature.”

The second stage is transport or how data is transported. “This is intrinsically the task of the telecom operator, and confidentiality is part of their core activity.”

This is in line with the task in the third leg of the data journey: store or the storage of data. “Here it depends on whether the data is stored in the customer’s own data centre or in the supplier’s.” Leonard emphasises that “in addition to protecting the data, they must ensure it is accessible at all times upon request”. It’s important to note that, in line with GDPR, any interested party can request access to the personal data you hold about them, and can request a copy to check whether the information is accurate.

The next stage of the data journey – data analysis – also raises points of concern. “Transparency is crucial in this stage. An end user must be perfectly aware of the purposes their data is being used for. That transparency is often lacking for the customer, who owns the data. This is absolutely an issue that companies must address.”

In addition to the legal and transparent processing of personal details, this data must also be processed for a specific purpose. An organisation cannot collect personal details for unspecified purposes, and it can only collect and process the details that are necessary to fulfil that purpose. Within this context, they are not allowed to store the data any longer than strictly necessary.

The next stage consists of sharing and using data. Leonard: “If possible, transparency is even more important in this stage. A customer can give permission to a specific supplier to store their data, but that doesn’t necessarily extend to any supplier or all data. Businesses must take the wishes of the end customer into account.”

The final stage – the protection of the data – is a point that crops up in every stage of the data journey. “Proper protection of the data is crucial at all times, regardless of whether it is company data or personal details. Security always comes first, just like privacy.” This is a point of concern for the entire organisation, from business to IT, and for the data privacy officer who is part of it.