Shredding Ireland & Data Sharing In The Public Sector

 

Secure Paper Shredding Hard Drive Shredding WEEE Destruction

At Security In Shredding our industrial paper shredding service deal with public and private sectors. When carrying out our confidential document destruction complies with data protection laws.

An individual may expect public sector bodies to share their personal data where it is essential and necessary to provide him/her with the services sought and the Office Data Protection Commissioner (ODPC) fully support the aim of developing more efficient and customer centric public services in this regard.

While also informing an individual weather his or her data is being shared, for what purpose and who can access this data.

As such the ODPC recommends that all data sharing arrangements in the public sector should:

  • Have a basis in primary legislation;
  • Be made clear to individuals that their data may be shared and for what purpose;
  • Be proportionate in terms of their application and the objective to be achieved;
  • Have a clear justification for individual data sharing arrangements;
  • Share the minimum amount of data to achieve the stated public service objective;
  • Have strict access and security controls; and
  • Ensure secure disposal of shared data.

Public sector bodies should ensure that the following best practice guidelines are considered and applied as appropriate:

1. Demonstrable Justification

  • Identify what the arrangement is meant to achieve. All data sharing arrangements should have a clearly understood set of objectives which are documented and recorded.
  • Identify whether the objective could be achieved without sharing the data or by anonymising it. The default position should be to analyse whether personal data needs to be shared in the first instance in order to achieve the goal(s).
  • Identify the minimum information required to achieve that purpose. All data sharing arrangements should share only the minimum required personal information to achieve the body’s objectives.
  • Identify any risks which the data sharing may pose. When considering whether to implement and place a data sharing agreement on a legislative footing consideration should be given of the fact that such sharing could increase the reluctance of individuals to provide accurate personal data to public sector bodies. It should also take account of any disproportionately negative impact on particular sections of society.
  • Identify when and how often the data should be shared. It is good practice to document this and set out whether the sharing arrangement will be ongoing or periodic or whether it will occur in response to a particular set of events.

2. Explicit Legal Basis

In general a legal basis for data sharing, including the conditions under which such sharing is permitted, should be set out in primary legislation as provided under Section 2(2A) of the DPA. The ODPC recommends (where appropriate) that the conditions of the data sharing arrangement are outlined clearly and in adequate detail either in primary legislation or alternatively.

In secondary legislation (provided a primary legislative basis exists) thereby leaving no room for confusion or doubt as to the nature of the arrangement and providing legal certainty[2]. The legislation should clearly identify the public sector bodies involved, the information that will be shared and the purpose(s) for sharing the information. Public sector bodies should also ensure that adequate, appropriate and relevant safeguards are put in place to protect the data rights of the individual.

3. Transparency

The Law

Personal data must be obtained and processed “fairly and lawfully”. Two situations arise that are specifically regarded in the DPA – firstly where a data controller obtains the personal data directly from an individual and, secondly, where a data controller obtains the personal data through some other means.

In the first case, as per Section 2(2D) of the DPA where personal data is gathered directly from the subject the data controller must provide (unless they already have the information) the following:
Identity of the controller and his representative (if applicable);

  • Purpose of processing;
  • Any other information which is necessary such as identifying recipients or categories of recipients of the data, whether data provision is voluntary or mandatory and details as to the right to information access and the right to data correction pertaining to the data subject.

In the second case, Section 2(2D) of the DPA also provides that where data has not been obtained from the data subject the controller/representative must in advance or at the time of the recording/disclosure provide in addition to the above information the following:

  • Categories of data concerned
  • Identity of the original controller.

The DPA highlights a clear obligation to inform data subjects how their data is or will be processed and processing will not be considered fair unless the data subject is given specific information about the identity of the controller, who the information will be disclosed to, and the purposes for which the data is to be processed. The rationale is that if the processing is to be fair the data subject must be placed in a position to learn of the existence of the processing operation, have access to that information and consequently be able to have that data rectified if required.

4. Authorisation

Any decision to share personal data between public bodies (and thereby to set aside a person’s right to privacy) must not be taken lightly. This is especially the case when bulk data is shared. Such decisions should only be taken following due consideration at senior management level.

5. Data minimisation

Only the minimum amount of personal data should be shared. In many cases all that may be required is a “yes” or “no” in regard to whether an individual is, for example, a holder of a permit or a license.

6. Data Access and Security:

Enhanced access controls and security requirements should apply to personal data shared and received as part of an approved data sharing arrangement. Access to such data should be limited to a very small number of officials and public sector bodies should employ a ‘need to know’ basis thereby ensuring that other organisations should only have access to the data if they need it, and that only relevant staff within those organisations should have access to the data. Arrangements in this respect should also address any necessary restrictions on onward sharing of data with third parties.

Security measures should rule out any possibility of data leakage (bearing in mind the increased emphasis on the State’s responsibility to prevent data breaches and the reputational damage that would result from failure to protect shared personal data). It is important that public sector bodies ensure that the personal data will be protected at all stages of the arrangement i.e. during the transmission, receipt of the data, and while the data remains with either party. Furthermore, it is important that the recipient organisation understands the nature and sensitivity of the data being shared and that common rules for its security are established.

7. Data Retention:

Personal data provided as part of an approved data sharing arrangement should be securely destroyed when no longer required. The ODPC recommends that public bodies should specify the conditions and the period for which the data may be retained and that such conditions are necessary and proportionate in relation to the purpose to be achieved.

8. Governance:

Public sector bodies involved in a data sharing arrangement will have their own responsibilities and liabilities in respect of the data they process. As alluded to, it is important that those entities involved in a data sharing initiative set out a common set of operational rules to be adopted in a data sharing agreement.

It is then reviewed on a regular basis to ensure that the data sharing initiative is meeting its objectives, that safeguards continue to match any risks posed, that records are accurate and up to date, that adherence to a consistent retention policy for all records is kept, and that the appropriate security measures remain in place. A clear description of the roles and responsibilities of public sector bodies in any data sharing arrangement should be made available to the data subject with regard to exercising their data rights.

9. And finally:

If a public sector body informs people about their data sharing arrangement and consequently receives a significant number of negative comments or concerns it should review the arrangement and data sharing in question. In particular, the body should carry out an analysis of the issues raised and decide whether the sharing can go ahead or continue.

Alternatively, it may need to reduce the amount of data it shares or share it with fewer organisations. In large scale data sharing operations, it is good practice to set up focus groups to explore individuals’ concerns and to develop more publicly acceptable ways of dealing with the issues that the data sharing was intended to address.

Read the full ODPC article here: https://dataprotection.ie/viewdoc.asp?m=m&fn=/documents/guidance/Data_Sharing_in_the_Public_Sector.htm

For more information or any queries regarding data sharing and data security. Please feel free to contact our confidential document shredding service team,

Email us at: info@securityinshredding.com

Data Protection Laws Set For An Update (2018)

Security in Shredding Data Protection Law

The General Data Protection Regulation has now being published in the official journal:  EU Official Journal. The journal was released on the 4th of May 2016.

This will result in the GDPR entering into force on the 24th of May 2016. Provisions will be directly applicable form the 25th May 2018. Organisations will have two years to prepare to the changes. Training courses on how to prepare for the changes are available in various cites throughout 2016 and 2017.

Data Protection Ireland Journal will keep you up to date with articles and journal entries regarding the new changes.

This change will effect Irish people and a course will take place in Dublin.

  1.  Friday, 16 September 2016

  2. Wednesday, 05 April 2017

The course will start at 10:00 to 16:00 (including lunch).

The course will cost €545 plus VAT

This course provides delegates with a detailed insight in to the main provisions of the Regulation, as well as practical guidance on what organisations should start doing to ensure that they are prepared for the new changes. The content includes:

  • The scope of the Regulation, including extra-territorial applicability
  • Key definitions
  • The role of the lead authority
  • The principles relating to personal data processing, including a detailed analysis of ‘consent’ and ‘legitimate business interests’
  • New obligations on data processors
  • Data breach notification
  • New obligations for Data Protection Officers
  • Data subjects’ rights
  • Data protection by design and default
  • Codes of Conduct and Certification
  • International data transfers
  • Consequences of non-compliance

Anyone attending the event should have a basic knowledge current data protection legal requirement. For anyone who does not have any knowledge of data protection laws can get up to date with data protection essential knowledge level 1 and then data protection essential knowledge level 2.

The course is recommended to be taken by compliance officers, HR managers, Office managers, Company secretaries, IT managers, Business analysts, Records Managers, legal advisers, Database managers and others.

Compliance & Your Data Processor

At Security In Shredding confidential document shredding and all other services provided are done in compliance with the law. Data Security and Data protection are paramount objectives for us to achieve. We keep up to date with these laws to ensure that we are operating correctly when processing Secure Documents.

If your business or organisation requires a Secure Document Shredding specialist please contact one of our team members for more information.

This change not only effects us but everyone within the EU, please like and share this article or join in on the conversation on our twitter feed

Adopting A Secure Document Shredding Strategy For Business

 confidential shredding, clean desk policy

A secure document shredding policy is integral to any business and protecting customer data is legislative. The Data Protection Commissioner implements the provisions of EU Directive 95/46. Not only are these regulations that require businesses to shred documents securely, but it is also part of running a business and maintaining a positive business reputation.

Why Businesses Need To Securely Destroy Documents?

Every day, companies create paper documents and these documents require shredding. Practically any document that contains data and especially sensitive data needs to be shredded. In particular data containing the following would be regarded as sensitive data:

  • Person’s Name
  • Address
  • contact information
  • Account Details
  • Credit Card Details
  • Budget Reports
  • Medical Reports
  • Payroll information
  • Legal contracts
  • Receipt Information

This is a snippet of what data to shred any and all documents should be securely destroyed by a secure document shredding service.

How This Data Can Be Used Against You?

Not only is forgery and fraud a major issue but also there is of course the potential for bad publicity, loss of customers and lawsuits to name but a few of the dangers. Identity theft is a common issue with data breaches. Criminals will use this data to either make purchases or obtain more data under the pretence of your name.
It is important that all businesses shred or destroy certain sensitive documents. Law enforcement, legal industries, government agencies, banks, health care providers, insurance providers, financial brokers, and real estate are just a few industries where managing paperwork is crucial.

How To Manage Business Documents Safely & Effectively?

A detailed security policy for every type of document your business handles is essential and employees need to know these policies before starting work.

For example:

What are the shredding requirements for the various document types that your company frequently uses? What are employees allowed to photocopy? Incorporating a reputable Confidential Shredding Company that has a good track record. While also training employees about the correct method of destroying sensitive documents and ensuring correct secure policies about how long to hold and when to destroy documents.  Access to company records should be controlled and restricted to a small number of trusted individuals and there should be rules relating to access of these records. A notification or logging system can also be in place to account for what and where data is being used.

At Security In Shredding we operate throughout Ireland and frequently do business in areas of Dublin, Galway, Limerick, Cork and Waterford areas.

For a more information on Shredding confidential paper Services & data destruction service, please visit: www.securityinshredding.com

Like, Subscribe to our Twitter: @Securityinshred

Common Mistakes Businesses Do When Maintaining Security Of Sensitive Data

Answer;              

Not properly classifying the sensitive information, managing it accordingly and in turn protecting it against current threats.

 

Secure Paper Shredding Hard Drive Shredding WEEE Destruction

 

As you read this from your mobile, tablet and or computer you are viewing data digitally. Paper shredding in Ireland and industrial paper shredding services offer data protection services for said devices. Knowing technology pitfalls is a massive part to data protection while also knowing how and when to share your digital information must also be considered.

There are three critical points to the proper protection of sensitive data.

  1. Data Classification

In line with European Standards; Companies must understand what data needs to be protected and create a Data Classification Policy. This policy in turn will classify data based on sensitivity. At a minimum three levels of data classification are needed.

    • Restricted: This information requires very high protection, Unauthorised dissemination would have serious terminal consequences for the company and infringe trade confidentiality obligations, contracts or laws. It is essential that the confidentiality of personal data is maintained. Otherwise there is a risk to the health and safety or personal freedom of the affected persons.

All data that reaches its end of life should be destroyed to a minimum of Shred No.6 of EN 15713 to ensure destruction beyond reconstruction.

    • Confidential or Private: This is moderately sensitive data that would cause a moderate risk to the company and could infringe legal obligations or laws if compromised. Access is internal to the company or department that owns the data. There would otherwise be a considerable risk to the social standing and financial situation of the affected persons.

All data that reaches its end of life should be destroyed to a minimum of Shred No.4 of EN 15713.

    • Public: This is non-sensitive data that would cause little or no risk to the company if accessed. Access is loosely, or not, controlled.

All data that reaches its end of life should be destroyed to a minimum of Shred No.3 of EN 15713.

 

  1. Encryption – All Organisations should have an encryption strategy in place to ensure all staff are aware and capable of utilising it correctly. The essential element to a good encryption strategy is to use strong encryption and detailed key management.

 

  1. Cloud Misuse – Essentially cloud storage translates to storing your data on someone else’s computer. When it is uploaded, the control over it is no longer only yours. Encryption should always be implemented prior to uploading to the Cloud. It is always advisable to read through the cloud providers policies with regard to handling data.

 

The most important thing for business is to be aware of the technology pitfalls. Secure document destruction in Ireland and its data protection laws are different to other countries. While the laws may be different country to country, the method of data breaches are usually the same. The more you know the better you can protect yourself and business from data breaches.

For more information on a secure document shredding service in the Dublin, Cork, Limerick or Galway area please visit: www.securityinshredding.com

Feel free to join in on the conversation @securityinshred

No. of Data Leaks and Data Breaches Increasing

irish data breaches, Data Protection, Paper Shredding, Data Destruction

Industrial paper shredding can be implemented using an off site shredding service throughout Ireland. Onsite shredding services are also available in the Dublin, Cork, Limerick, Galway and Waterford areas. These services should be common practice for businesses to comply with Data Protection laws.

It has become an increasingly talked about topic both globally and in Ireland of user’s details being leaked accidentally or retrieved through malicious means. The most recent story on a global scale is the “Panama Papers” involving political figures and leaders having offshore accounts and profiting from them. How the leak happened is still unclear but can happen.

Closer to home the Irish Aviation Authority (IAA) was the case of a data leak. The leak revealed the details of listed drone users in the country. No credit card details were released but names, addresses and emails were revealed. The leak was an internal issues and was dealt with accordingly. The Data Protection Commissioner was informed with the leak and appropriate actions were taken.

If A Breach Occurs

Your own business like any other business can be subject to a Data Breach or Leak. To think it wont happen to you is naive and bad business practice. If you feel a breach has occurred there are a number of steps you should follow if the breach occurs.

  • Take your site offline so the leak/breach is no longer available
  • Find out where the breach occurred. Contact IT or site developer for help
  • If public details are released then inform the Data Protection Commissioner
  • Issue a warning to the effected users that the breach occurred
  • Passwords for accounts need to be updated to prevent unwanted access to user accounts.

The quicker you deal with the issue the less damaging it is for business in the long run. Contacting the Data Protection Commissioner (DPC) is important as they are a governing body for issues like these. Failure to contact the DPC can result in a hefty fine and be damaging for business if the issue goes public.

Data Protection is vital for businesses to succeed and now more than ever it is important to have proper Data Security setup to prevent these kind of attacks. A confidential shredding service will provide your business with its Data Protection. Consulting with them about your Data Security would also be recommended.

Data Protection Commissioner Data Security Guidelines:

https://www.dataprotection.ie/viewdoc.asp?DocID=1091

Data Security From Top To Bottom

Security in Shredding Logo. 2014.

Data Security is a vital for businesses to run. Weather it is paper shredding and or media destruction a confidential shredding service is needed.

Security is a strategic part of company policy. While physical security has being around for a long time. Security cameras, security personal, alarm systems etc are common terms to hear when referring to security. When it comes to cyber security the terms used become less frequent and can appear more intimidating to the untrained ear. You will hear terms like encryption, end to end encryption, firewalls and 2 step verification are terms involving cyber security.

Digital Data has grown over the past 20 years and this has lead to the increase of Data Breaches in industries and organisations. Often the case for these breaches were due to certain aspects not having protections in place. With the increase in electronic devices it should no longer be just a matter for the IT department but a company wide matter.

In The Boardroom

Data Security and Digital Data must be a part of the boardroom’s security strategy and treated equal to the overall security of the company. Awareness to cyber issues should be known be all board members and not just the CIO.

This should include the company policies in place. What are the major threats to Digital Data. Regular update of this information from IT department to the board to increase awareness.

Human Error

All the security measures in place cannot protect against human error. People will forget items, it happens. A stray document left on a table or seat when travelling. Not just paper documents but mobile devices also need to be looked after again of the potential of sensitive data being accessed.

Less technical minded people who use these devices may also use social media and other sites while not being aware of potential breaches or what data they might expose.

Setting up security features before the device is used will help improve security. Password setup and enabling encryption on messaging systems will greatly improve the device security.

Company Policies and Terms Of Use

Is a term widely used throughout Technology sector. A person must agree to these terms before they can use a product. This should also be adopted by your own company if issuing devices for board members and staff. It does not have to be a technical document but a set of guidelines and processes to do when dealing with sensitive data.

Technology is constantly improving and changing are for some people it can be hard to learn these new technologies and this is where the potential breaches can occur. With a regularly updated information to the board members will ensure your data is secure.

For more information on the Data Protection please visit: https://www.securityinshredding.com/legislation.php

What is the European Commission’s New Data Protection Framework proposal?

The European Commission announced a proposed reform to The European Union’s Data Protection Framework On the 25th of January 2012. You can read the full press release here. 

EU Data Protection, Secure Paper Shredding, Data Processor Firm

EU Data Protection

Within the announcement The Commission stated that the current framework – known as the 19995 EU Data Protection Directive is outdated. The main reasons for the framework to be outdated are due to rapid technology change and globalisation. These points are important to consider when deciding upon the best option to securely destroy your sensitive paper data through a confidential paper shredding service. Whether the service will be an onsite paper shredding service or an on-demand offsite paper shredding service it is important to ensure that your paper shredding company is a Data processor. You can see the list of registered Irish data processing firms here.

The new Data Protection framework will be a regulation which means all member states will have to abide by the rules. The rules will go into effect two years after they have been adopted by the member countries which is expected to be in 2018-2019.

Security in Shredding Team.

Free Shred and Information Event in aid of Data Protection Day a true success.

shreddayimage

It is advantageous for the General Public and Organisations within Ireland and across the Globe to be aware that January 28th is European Data Protection Day, and it is known as “Privacy Day” outside of the EU. Continue reading