GDPR – General Data Protection Regulation in 60 seconds

“Protecting the data of the people”

EU regulation comes into force on 25^th May 2018.  It aims to simplify the existing laws and is an evolution of the pre-existing Data Protection Directive laws.   DPD has been implemented into national laws, leading to some inconsistencies between member states.  GDPR provides a more consistent definition of personal data creating a more uniform law across member states.   It is designed to bring much harsher penalties for non compliance.

Five roles are defined

Data Subject: citizen or resident of an EU member state. The rightful data owner

Data Controller: organisation that collects the data.

Data Processor: organisation that process the data on behalf of the controller

Data Protection Officer: works independently to ensure that an entity is adhering to GDPR regulations

Data Protection Authority: each EU member state must have an enforcement power

Personal Data: any information relating to the data subject

Important Principles

Consent:

data must be freely given i.e. individual may refuse and must affirm its use.

controller must clearly explain how data will be used.

Right Of Access:

data subject may obtain access to the data

data subject has right to erasure

Retention:

Data should only be retained when there is a compelling and valid reason

Enforcement:

3 days to report a breach

Lawful basis to process
There are 6 lawful basis under GDPR in order to process personal data. You must determine and document your lawful basis before you begin processing.
Consent
Consent must be unambiguous and involve a clear affirmative action (an opt-in). You must keep clear records to demonstrate consent.
Contract
You can rely on this lawful basis if you need to process someone’s personal data to fulfil your contractual obligations to them
Legal Obligation
You can rely on Legal Obligation if you need to process the personal data to comply with a common law or statutory obligation.
Vital Interests
Where processing is necessary in order to protect the vital interests of the data subjec. vital interests are intended to cover only interests that are essential for someone’s life e.g. emergency medical care
Public Task
Your overall purpose must be to perform a public interest task or exercise official authority, and that the overall task or authority has a sufficiently clear basis in law e.g. justic admin. government functions.
Legitimate Interests
Legitimate interests are most likely to be an appropriate basis where you use data in ways that people would reasonably expect and that have a minimal privacy impact. requires a LIA legitimate Interest Assessment: purpose, necessity and balancing test

Payment Card Industry Data Security Standard - PCI DSS

PCI DSS fundamentals. 

PCI DSS requirements apply to any organisation that stores or transmits the following:

Primary Account Number

Cardholder Name

Expiration Date

Service Code

Full track data *

CAV2/CVC2/CVV2/CID *

PIN *

*these items are determined extremely sensitive and cannot be stored after authorisation even if encrypted

PCI-DSS applies to all system components in the CDE – Cardholder data environment.  The CDE is comprised people, processes and technologies that store, process or transmit cardholder data (as above)

Merchant Levels

There are different levels of merchants: Level 1 thru Level 4 with level 1 being the highest. In general merchant level is determined by transaction volume and classification varies between Service Provider (Amex, Visa and Mastercard).  

There is a misconception that the degree to which you must comply with PCI DSS varies among the different levels. In fact merchants must comply with the entire DSS regardless of their level. The only variant is the way and frequency that compliance is reported upstream.  The exact scope of compliance validation is determined by merchant level (transaction volume, card brand, and method of accepting cards). Also if a merchant has been subject to a hack that has left card data comprised this raises them to Level 1!

Level 1            ASV Scan, QSA on-site assessment

Level 2            ASV Scan, SAQ self-assessment

Level 3            ASV Scan, SAQ self-assement

Level 4            ASV Scan if requested by acquirier, SAQ self-assessment

Notes:

ASV = Approved Scanning  Vendor

SAQ = Self-Assessment Questionnaire

PCI DSS Scope

The first step in a PCI DSS Assessment is to determine the scope of the CDE.  Ongoing this must also be revisited at least annually.  As mentioned the CDE is comprised people, processes and technologies that store, process or transmit cardholder data.  Scoping needs to identify all locations and flows of cardholder data, and identify all systems that are connected or if compromised could impact the CDE.

To achieve this goal

i)              Document existence of all cardholder data in the environment

ii)             Any cardholder data found IS in scope of PCI-DSS

iii)            The only way to descope is to delete or migrate the data

One common strategy to limit PCI DSS scope is to ensure network segmentation is in place. Physically or logically separated networks

PCI Requirements

The PCI is comprised of 12 requirements that cover a wide array of business areas.