1 of 43

www.drupaleurope.org

2 of 43

GDPR and�Privacy Experience

Be good, and benefit from it.

3 of 43

TOC

Why privacy matters
Impact of GDPR
Global legal environment
Tools available
Organizational level solutions
Wrap-up: benefits of PX

4 of 43

Why privacy matters

Glenn Greenwald (2014)

5 of 43

SEND ME YOUR MAILBOX PASSWORD NOW!

I won’t steal your money :)

6 of 43

We are social creatures,

but we all need privacy.

7 of 43

“Mass surveillance creates �a prison in the mind.”�Glenn Greenwald, Why Privacy Matters (2014)

8 of 43

Mass surveillance

China is ranking their citizens in a social credit system

9 of 43

Facebook – Cambridge Analytica scandal

Facebook plummeted 24 percent,

$134b loss in market value

10 of 43

Yahoo

Fine: £250,000 in June, 2018 over 2014 data breach
Failed to take "appropriate technical and organizational measures"
"failed to take appropriate measures" in making sure that Yahoo Inc., the data processor, complied with data protection standards

11 of 43

Google/Mastercard Secret Data Deal to track in-store purchases

For the past year, selected Google advertisers have had access to a potent new tool to track whether the ads they ran online led to a sale at a physical store in the U.S.

12 of 43

British Airways customer data stolen from its website

380,000 payment cards affected

1ST EMAIL

Received less than 72 hours after end of breach and contained:

Duration of data breach
Types of info compromised
Apology and recommendations

2ND EMAIL

Follow up 18 hours afterwards

Contained

Duration of data breach
Reminder of data compromised
Additional apology
Reimbursement info
“Action you need to take”
Contact info for BA DataPO

13 of 43

Austrian banks ordered to provide historical account info for free

Right to access personal info collected

14 of 43

Privacy matters

Decide whether you want to be on the right side.

15 of 43

Impact of GDPR

16 of 43

GDPR was something new

Massive fines
You need to prove your compliance
Extends globally

17 of 43

First decisions and fines

GDPR related fines, decisions, and number of cases

18 of 43

GDPR�the first decisions and fines

European authorities issue their first GDPR based decisions:

in Germany against ICANN

Not only big companies are affected:

An administrator of a Facebook page shares responsibility with Facebook

19 of 43

Responses from the authorities �a 1-week response test

Estonia 129 cases, almost 30% up compared to last year
Sweden 77 cases since 25th of May
Romania 1424 complaints, 81 notices
Denmark: 4082 total cases: 1682 closed, 2400 open
U.K. initial response - detailed response by October 3rd.
Slovakia: 25 ongoing cases, zero closed

Updated 12.09.2018

20 of 43

Some statistics: Organizations React to GDPR

How Org Leaders have responded to GDPR

21 of 43

How Orgs have responded to GDPR (227 responses)

LEADERS	vs	LAGGARDS
A Change to Build Customer Trust and Loyalty		An EU Issue That Doesn’t Impact Our Business
A Call to Action to Overhaul Organizational Perspectives on Customer Data		An Overwhelming Burden That we Don’t Know How To Tackle

22 of 43

How Organizations have responded to GDPR

(227 responses)

23 of 43

Customer Experience Impact

24 of 43

Global legal environment

There is much more than GDPR

25 of 43

Privacy has become a global trend

https://www.brainsum.com/blog/ubiquitous-privacy-experience-data-protection-enforcement-global-level

26 of 43

The era of Privacy and Data Protection

Let’s benefit from it!

Accelerate digital transformation, improve processes
Develop a Single Customer View
Improve customer confidence and engagement
Reduce unnecessary risks

27 of 43

How can we get this �DP monkey off our backs?

28 of 43

Tools available

You don’t necessarily need tools or systems in place to become compliant.

You do need documented processes. �Why not to automate them?

29 of 43

Visible at first sight

Cookie consent
Consent checkboxes on forms

30 of 43

Visible but usually harder to find

CMPs
Privacy policy, cookie policy
User rights (export, delete etc.)
Data breach reporting

31 of 43

Totally hidden but fundamentally important

Security incl. anonymization and encryption
Systems for data retention
Systems ensuring compliance by logging and monitoring

Data breaches are increasing rapidly!

32 of 43

Cookie consent solutions

Free and / or Open Source

33 of 43

Cookie consent

solutions�ePR vs GPDR

Prior consent is required for every cookie which is not strictly necessary
Categorisation at least by purpose
What’s the status now? There is a study for that already!

(66)

Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities.

https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32009L0136

GDPR

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

34 of 43

Third-party cookies per page by country �(April-July change in parenthesis)

35 of 43

SaaS cookie consent services

https://www.onetrust.com

https://www.trustarc.com�http://cookiepro.com

https://www.cookiebot.com�...

https://reutersinstitute.politics.ox.ac.uk/sites/default/files/2018-08/Changes%20in%20Third-Party%20Content%20on%20European%20News%20Websites%20after%20GDPR_0.pdf

@Balazs grafikonok, domain-es.

https://www.onetrust.com/ On https://www.accenture.com/hu-en you can see it in action. Seems like to market leader, the most advanced solution.

https://www.trustarc.com/ It's used on https://www.petarmor.com

http://cookiepro.com but they are using onetrust for their own cookie settings

https://www.iubenda.com/en/help/3081-introduction-to-prior-blocking-of-scripts#module - they are using server side tools too, they have apache, IIS and ngins modules to block 3rd party sources.

https://www.cookiebot.com/

https://www.civicuk.com/cookie-control
https://clym.io/
https://www.consentassist.com/
https://www.evidon.com/ (Adobe, Nestle, Speedtest)
https://piwik.pro/gdpr-consent-manager/

36 of 43

A free and Open Source personalized �cookie consent solution

https://github.com/brainsum/cookieconsent

https://brainsum.github.io/cookieconsent /

Developed by BRAINSUM

37 of 43

Managing Complexity

Gdpr module set: anonymization via gdpr dump, consent tracking, user rights
Inactive user module https://github.com/brainsum/inactive_user
Encryption, Fields encryption + external service integration e.g. Lockr.io

Overview of GDPR Drupal contrib modules

38 of 43

Our challenges

and answers

39 of 43

How many of you feel comfortable when asked about the status of GDPR compliance?

40 of 43

PX HUB

Review and track your compliance to the regulation and more.

BRAINSUM’s internal tool is also

available for agencies or organizations with multiple systems.

41 of 43

Changing the mindset

Adhere privacy by design,

and use monitoring to stay on the right side!

42 of 43

Privacy Experience - how?

Instantly visible
Security related
Privacy branding

43 of 43

Key takeaways

Good PX is beneficial
Systems already exist, many tools are open source
Think on an organizational level

Thank you!

Questions?

Riley Cunningham

Digital Solutions Consultant

rcunningham@brainsum.com � @RileyCunningh12

Peter Pónya

Founder and CIO

pedro@brainsum.com � @pedroleoman