{"id":89,"date":"2018-02-22T07:58:47","date_gmt":"2018-02-22T07:58:47","guid":{"rendered":"https:\/\/website.prod.unilu.spikeseed.cloud\/fr\/news\/data-privacy-day-lessons-for-gdpr-compliance-and-information-security\/"},"modified":"2018-02-22T07:58:47","modified_gmt":"2018-02-22T07:58:47","slug":"data-privacy-day-lessons-for-gdpr-compliance-and-information-security","status":"publish","type":"news","link":"https:\/\/www.uni.lu\/fr\/news\/data-privacy-day-lessons-for-gdpr-compliance-and-information-security\/","title":{"rendered":"Data Privacy Day: Lessons for GDPR compliance and information security"},"content":{"rendered":"

On Monday 29 January 2018, a Data Privacy Day information session was held at the University of Luxembourg. It was attended by more than 100 visitors, who originated not only from the University and the Restena Foundation but also from other research institutions and other sectors.<\/p>\n

\nHow to become GDPR compliant for 25 May 2018<\/h2>\n

After a warm welcome by the president of the University of Luxembourg, Prof. St\u00e9phane Pallage, the Data Protection Officer of the University of Luxembourg, Dr Sandrine Munoz, gave a summary of the upcoming changes<\/strong> in the seven steps to be prepared<\/strong>. She focussed on the key factors to be prepared for GDPR compliancy in terms of processing of personal data identification, documentation, organisation of processes, accountability and risk management. As suggested by the General Data Protection Regulation (GDPR)<\/a> she presented Commission nationale pour la protection des donn\u00e9es (CNPD)<\/a>:<\/p>

  1. be informed about the upcoming changes;<\/li>
  2. identify your processing of personal data;<\/li>
  3. appoint a Data Protection Officer;<\/li>
  4. develop an action plan;<\/li>
  5. identify and manage risks;<\/li>
  6. organise internal processes;<\/li>
  7. document your compliancy.<\/li><\/ol><\/p>

    In the discussion after this presentation, members of the audience expressed their concern about the impact of the European Regulation on research projects and national laws in the pipeline<\/strong>. In response to that, experts underlined that GDPR foresees the possibility for derogations<\/strong> for data subject rights in national laws for scientific, historical or statistical research projects, if rights impair the research. These derogations are defined in the Luxembourg Project of Bill 7184<\/a> for research programmes, and it is required that researchers implement appropriate safeguards such as pseudonymisation, data management plan to safeguard data subjects\u2019 rights.<\/p>

    On the side of Information Security<\/strong>, the speakers Dr Cynthia Wagner from the Foundation Restena and Christian Hutter, Chief Information Security Officer from the University of Luxembourg, provided practical examples of privacy risks and information security threats.<\/p>\n

    \nCompliance monitoring by the CNPD<\/h2>\n

    The presentation by Michel Sinner, Head of controls at CNPD, was closely followed and the detailed practical steps to be prepared for a CNPD control of compliance<\/strong> were highly appreciated. In the questions and answers section, the audience was concerned by the approach of the Commission in relation with the sanctions in case of failure to comply with the GDPR.<\/p>

    The CNPD representative explained that, even though compliance to the GDPR will be mandatory by 25 May, the initial focus of the CNDP will be more on supporting the controllers to improve their compliancy and encourage them to fully collaborate and being transparent then hitting them with high sanctions.<\/p>\n

    \nImproving information security<\/h2>\n

    Moreover, speakers also introduced attendees to different aspects of and threads to information security:<\/p>