Sue Foster is a London-based partner at Mintz Levin. In the second part of the interview, she discusses the interesting loophole for ransomware breach reporting requirements that's currently in the GDPR However, there's another EU regulation going into effect in May of 2018, the NIS Directive, which would make ransomware reportable. And Foster talks about the interesting implications of IOT devices in terms of the GDPR. Is the data collected by your internet-connected refrigerator or coffee pot considered personal data under the GDPR? Foster says it is!

I'm very excited to be talking to an attorney with a CIPP, and with direct experience on a compliance topic we cover on our blog — the General Data Protection Regulation, or GDPR.

Welcome, Susan.

But they are offering goods or services to people in Europe. And for these companies, you know in the past they've had to go through quite a bit of analysis to understand the Data Protection Directive applies to them. Under the GDPR, it's a lot clearer and there are rules that are easier for people to understand and follow.

So now when I speak to my U.S. clients, if they're a non-resident company that promotes goods or services in the EU, including free services like a free app, for example, they'll be subject to the GDPR. That's very clear.

Also, if a non-resident company is monitoring the behavior of people who are located in the EU, including tracking and profiling people based on their internet or device usage, or making automated decisions about people based on their personal data, the company is subject to the GDPR.

It's also really important for U.S. companies to understand that there's a new ePrivacy Regulation in draft form that would cover any provider, regardless of location, of any form of publicly available electronic communication services to EU users.

Under this ePrivacy Regulation, the notion of what these communication services providers are is expanded from the current rules, and it includes things that are called over-the-top applications – so messaging apps and communications features, even when a communication feature is just something that is embedded in a website.

If it's available to the public and enables communication, even in a very limited sort of forum, it's going to be covered. That's another area where U.S. companies are getting to grips with the fact that European rules will apply to them.

So this new security regulation as well that may apply to companies located outside the EU. So all of these things are combining to suddenly force a lot of U.S. companies to get to grips with European law.

But if they're not doing that, if not engaging in any kind of tracking, profiling, or monitoring activities, and they're not affirmatively marketing into the EU, then they're outside of the scope. Unless of course, they're offering some kind of service that falls under one of these other regulations that we were talking about.

The requirement to report these incidents has a number of caveats. So you have to report the breach to the Data Protection Authority as soon as possible, and where feasible, no later than 72 hours after becoming aware of the breach.

Then there's a set of exceptions. And that is unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. So I can understand why U.S. companies would sort of look at this and say, ‘I don't really know what that means’. How do I know if a breach is likely to ‘result in a risk to the rights and freedoms of natural persons’?

Because that's not defined anywhere in this regulation!

It's important to understand that that little bit of text is EU-speak that really refers to the Charter of Fundamental Rights of the European Union, which is part of EU law.

There is actually a document you can look at to tell you what these rights and freedoms are. But you can think of it basically in common sense terms. Are the person's privacy rights affected, are their rights and the integrity of their communications affected, or is their property affected?

So you could, for example, say that there's a breach that isn't likely to reveal information that I would consider personally compromising in a privacy perspective, but it could lead to fraud, right? So that could affect my property rights. So that would be one of those issues. Basically, most of the time you're going to have to report the breach.

When you're going through the process of working out whether you need to report the breach to the DPA, and you're considering whether or not the breach is likely to result in a risk to the rights and freedoms of natural persons, one of the things that you can look at is whether people are practically protected.

Or whether there's a minimal risk because of steps you've already taken such as encrypting data or pseudonymizing data and you know that the key that would allow re-identification of the subjects hasn't been compromised.

So these are some of the things that you can think about when determining whether or not you need to report to the Data Protection Authority.

If you decide you have to report, you then need to think about ‘do you need to report the breach to the data subjects’, right?

And the standard there is that is has to be a “high risk to the rights and freedoms” of natural persons’. So a high risk to someone's privacy rights or rights on their property and things of that sort.

And again, you can look at the steps that you've taken to either prevent the data from — you know before it even was leaked — prevent it from being potentially vulnerable in a format where people could be damaged. Or you could think also whether you've taken steps after the breach that would prevent those kinds of risks from happening.

Now, of course, the problem is the risk of getting it wrong, right?

If you decide that you're not going to report after you go through this full analysis and the DPA disagrees with you, now you're running the risk of a fine to 2% of the group’s global turnover …or gross revenue around the world.

And that I think it’s going to lead to a lot of companies being cautious in reporting when even they might have been able to take advantage of some of these exceptions but they won't feel comfortable with that.

If they had not reported it, and waited until after the 72-hour rule, what would have happened to let's say a multinational like Yahoo?

It's hard to imagine they would be in a situation where they would be off the hook for reporting.

Now the 72-hour rule is not hard and fast.

But the idea is you report as soon as possible. So you can delay for a little while if it's necessary for say a law enforcement investigation, right? That's one possibility.

Or if you're doing your own internal investigation and somehow that would be compromised or taking security measures would be compromised in some way by reporting it to the DPA. But that'll be pretty rare.

Obviously going along for months and months with not reporting it would be beyond the pale. And I would say a company like Yahoo would potentially be facing a fine of 2% of its worldwide revenue!

This is also a breach reporting related question, and it has to do with ransomware. We're seeing a lot of ransomware attacks these days. In fact, when we visit customer sites and analyze their systems, we sometimes see these attacks happening in real time. Since a ransomware attack encrypts the file data but most of the time doesn't actually take the data or the personal data, would that breach have to be reported or not?

So, if a company is subject to an attack that prevents it from accessing its data, but the intruder can not itself access, change or destroy the data, you could argue it's not a personal data breach, therefore not reportable.

But it sure feels like one, doesn't it?

Now, there are two important caveats.

Even though, technically, a ransomware attack may not be reportable, companies should remember that a ransomware attack could cause them to be in breach of other requirements of the GDPR, like the obligation to ensure data integrity and accessibility of the data.

Because by definition, you know, the ransomware attack has made the data non-assessable and has totally corrupted its integrity. So, there could be a liability there under the GDPR.

And also, the company that's suffering the ransomware attack should consider whether they're subject to the new Network and Information Security Directive, which is going to be implemented in national laws by May 9th of 2018. So again, May 2018 being a real critical time period. That directive requires service providers to notify the relevant authority when there's been a breach that has a substantial impact on the services, even if there was no GDPR personal data breach.

And the Network and Information Security Directive applies to a wide range of companies, including those that provide "essential services”. Sort of the fundamentals that drive the modern economy: energy, transportation, financial services.

But also, it applies to digital service providers, and that would include cloud computing service providers.

You know, there could be quite a few companies that are being held up by ransomware attacks who are in the cloud space, and they'll need to think about their obligations to report even if there's maybe not a GDPR reporting requirement.

The GDPR is not very specific about what has to be done to meet these Privacy by Design ideas, so do you have an idea what the regulators might say about PbD as they issue more detailed guidelines?

You might remember back on old,old math tests, right? When you were told, ‘Look, you might not get the right answer, but show all of your work in that calculus problem and you might get some partial credit.’

And it's a little bit like that. The GDPR is a lot about process!

So, the push for Privacy by Design is not to say that there are specific requirements other than paying attention to whatever the state of the art is at the time. So, really looking at the available privacy solutions at the time and thinking about what you can do. But a lot of it is about just making sure you've got internal processes for analyzing privacy risks and thinking about privacy solutions.

And for that reason, I think we're just going to get guidance that stresses that, develops that idea.

But any guidance that told people specifically what security technologies they needed to apply would probably be good for, you know, 12 or 18 months, and then something new would come along.

Where we might see some help is, eventually, in terms of ISO standards. Maybe there'll be an opportunity in the future for something that comes along that's an international standard, that talks about the process that companies go through to design privacy into services and devices, etc. Maybe then we'll have a little more certainty about it.

But for now, and I think for the foreseeable future, it's going to be about showing your work, making sure you've engaged, and that you've documented your engagement, so that if something does go wrong, at least you can show what you did.

We've learned from talking to testing experts that vendors are not really interested in PBD. It's ship first, maybe fix security bugs later. Any thoughts on how the GDPR will effect IOT vendors?

So, if you think about a device that knows my shopping habits that I can speak to and I can order things, everything that the device hears is effectively my personal data under the European rules.

And Internet of Things vendors do seem to be lagging behind in Privacy by Design. I suspect we're going to see investigations and fines in this area early on, when the GDPR starts being enforced on May, 2018.

Because the stories about the security risks of, say, children's toys have really caught the attention of the media and the public, and the regulators won't be far behind.

And now, we have fines for breaches that range from 2% to 4% of a group's global turnover. It's an area that is ripe for enforcement activity, and I think it may be a surprise to quite a few companies in this space.

It's also really important to go back to this important theme that there are other regulations, besides the GDPR itself, to keep track of in Europe. The new ePrivacy Regulation contains some provisions targeted at the internet of things, such as the requirement to get consent from consumers from machine-to-machine transfers of communications data, which is going to be very cumbersome.

The [ePrivacy] Regulation says you have to do it, it doesn't really say how you're going to get consent, meaningful consent, that’s a very high standard in Europe, to these transfers when there's no real intelligent interface between the device and the person, the consumer who's using it. Because there are some things that have, maybe kind of a web dashboard. There's some kind of app that you use and you communicate with your device, you could have privacy settings.

There's other stuff that's much more behind the scenes with Internet of Things, where the user is not having a high level of engagement. So, maybe a smart refrigerator that's reeling information about energy consumption to, you know, the grid. Even there, you know, there's potentially information where the user is going to have to give consent to the transfer.

And it's hard to kind of imagine exactly what that interface is going to look like!

I'll mention one thing about the ePrivacy Regulation. It's in draft form. It could change, and that's important to know. It's not likely to change all that much, and it's on a fast-track timeline because the commission would like to have it in place and ready to go May, 2018, the same time as the GDPR.

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️ 

Visit our website: https://www.varonis.com

LinkedIn: https://www.linkedin.com/company/varonis

X/Twitter: https://twitter.com/varonis

Instagram: https://www.instagram.com/varonislife/