GDPR compliance audit

GDPR: First phase of integration

May 25th 2018 saw a real breakthrough in the French, European and even global digital landscape. We're talking specifically about the digital landscape because, let's face it, the GDPR didn't invent the concept of privacy, or even personal data protection. We have indeed had the French Data Protection Act since 1978 (the so-called "LIL" law), and have amended it several times so that it has relevant rules.

This is how an arsenal of moderation and sanctions existed and could be used in front of the traditional courts, as well as before the CNIL (French's National Commission on Liberties and Computer sciences). This body was created specifically for the LIL. Its mission is both to provide support to those who process personal data and to punish those who do not comply with the established rules.

The LIL has made France the first European state with legislation specifically protecting personal data. This law was adopted in a context where the processing of personal data was made increasingly easy by the computerized and automated means of the 1970s. Since then, the context has changed a lot and explains the choice of a legislative evolution through a European regulation.

We can cite a few developments to capture this changing environment.

• First of all, the exponential evolution of new technologies has facilitated the processing of personal data, very quickly and for a growing number of actors. Thus, what was the problem of some in 1978 is now the problem of most professional and institutional actors.
• Second, with the democratization of the use of internet came the digital giants, the famous GAFA and the like, and the increasingly intrusive uses of connected technologies. New practices should be taken into account in the moderation of data processing and in the sanctioning of abuses, which are becoming easier and easier to commit.
• Finally, although we are far from having listed all the factors involved, the dissolution of state borders by cyberspace commonly allows the capture of personal data of French residents by foreign entities, both European and extra-European.

The adoption of the GDPR has therefore made it possible to achieve the following twofold objective: protect personal data (PDs) against the new possibilities for achieving this objective developed in recent decades; and take into account the Europeanisation and internationalisation of exchanges, facilitated by their dematerialization. A widespread awareness has then taken hold of the different institutional and professional worlds, in BtoC as well as in BtoB, of the abuses, sometimes without malicious intent, that marred the collection and processing of personal data.

We then witnessed the appointment of many DPOs, including outsourced DPOs. Public and private organizations have complied with the formal exercises of mandatory disclosures, requests for explicit consent (the famous "opt-in", relegating the old "opt-out" to the back burner, because it does not allow valid consent to be collected) and RPA (Record of Processing Activities).

The importance of security for privacy

The years 2018 and 2019 have been marked by several phases of formal implementation of the GDPR. The previous system of prior authorisation had given way to a system of a posteriori control. Since then, it has been possible to collect and process (except in special cases) FADs without prior authorisation. But we must be prepared to undergo at any time a CNIL control of the processing of personal data. This is why this whole formal process of nominations, mentions, opt-in and documentation (the famous RPA, or DPIA - Data Protection Impact Assessment) is so important: you don't just have to do it right, you have to be able to prove it.

However, this may have been done, at least initially, at the expense of an extremely important part of the protection of personal data: their security. The formal aspect of GDPR compliance seemed so sprawling and far-fetched that we sometimes overlooked the importance of the actual safety of the PDs. And yet, it is very often on this criterion that the CNIL pronounces sanctions : the breaches sanctioned by the independent administrative authority are often constituted by a failure to sufficiently secure personal data processed by the person in charge in question, more than by a lack of documentation.

In early 2020, we have seen a collective awareness of the urgent need to secure processed PDs. Now we must get down to business... But where to start? Information systems were often not originally designed with the protection of personal data as a priority. Since security by design is the prerogative of new solutions or infrastructures, how do you untangle all the equipments, networks, and public websites?

Ensure compliance with the GDPR

The new order of privacy protection has gradually taken hold in our institutional and normative landscapes. First there was the adoption of the GDPR in 2016, then the famous date of its entry into force: May 25th, 2018. Then the various publications and deliberations of the CNIL, the new LIL... The first consequence of all this was a climate of certain disorganization, including for those who had implemented an action plan ahead of 2018. The compliance of our public and private bodies has been (and is still being) carried out in a piecemeal fashion as we have reforms and new information on their interpretation.

That's why today we often find ourselves with a state of compliance that is not mastered, or at least not as well controlled as we had expected or wished for. However, many scenarios require that we control this compliance in order to turn it in our favour: CNIL controls, technical incidents, malicious acts, requests to data access (employees, customers, suppliers)... Knowledge and mastery of the level of compliance with the GDPR is essential to a positive outcome to these events. In order to regain that level of information and control over one's own compliance, there is one step to (re)launch the machine: the GDPR audit.