How CSA is Working to Address Privacy

By John DiMaria, Assurance Investigatory Fellow, CSA

The European Data Protection Board (EDPB) published an infographic on compliance and enforcement of the GDPR from May 2018 to January 2019. It shows that 95,180 complaints have been made to EU national data protection authorities by individuals who believe their rights under the GDPR have been violated. Two-thirds of the most common of these complaints had to do with telemarketing and promotional emails, which practically every organization uses as the primary tool of communication.

Anyone can file a complaint about anyone else. The question is — how poised is your organization to prove you have a "Standard of Care" in place to protect your organization and have a documented defense in place? As the cloud is a shared high-risk sector, CSA developed a simple yet high-quality way for Cloud Service Providers to evaluate where they are in the compliance process and get detailed feedback from 3rd party legal experts using the CSA GDPR Code of Conduct (COC). CSA established the CSA GDPR Center of Excellence (CoE) to help organizations improve their privacy posture and achieve compliance with the European General Data Protection Regulation and other global privacy regulations.

What is the GDPR Center of Excellence?

The GDPR CoE coordinates CSA's privacy activities globally with the objective of establishing global standards for privacy compliance. The center focuses on cloud computing, IoT and Blockchain, with cloud being the initial focus.

It aims to improve the level of privacy offered to individuals in their use of technology, to increase transparency and accountability, and accelerate the adoption of privacy designed technology services.

The CoE creates a network of technology customers and providers, subject matter experts, and resources with the goal of defining compliance solutions, and awareness and educational material for privacy.

What resources does it have to help with privacy in the cloud?

Two documents were produced and currently in practice to help organizations evaluate themselves and ultimately comply with requirements—the GDPR Code of Conduct and the Privacy Level Agreement (PLA) Code of Practice.

GDPR Code of Conduct

The CSA Code of Conduct for GDPR Compliance provides a consistent and comprehensive framework for complying with the EU's GDPR. The CSA Code of Conduct is designed to offer both a compliance tool for GDPR compliance and transparency guidelines regarding the level of data protection offered by the Cloud Service Provider.

GDPR Code of Conduct (COC) self-assessment on the STAR registry

The GDPR COC self-assessment is an evidenced based self-assessment. Your submission is vetted thoroughly by our GDPR experts and once approved, you can file a PLA Code of Conduct (CoC): Statement of Adherence and your organization will be posted on the registry. After publication, your company will receive authorized use of a Compliance Mark, valid for one year. You are then expected to revise your assessment every time there is a change to the company policies or practices related to the service under assessment.

The GDPR COC is still in the self-assessment stage, but a third-party certification will be available as soon as the CSA COC and Certification Mechanism has been approved by the CSAs Data Protection Authority (DPA) (est. Q3).

Establish a security-conscious culture.

It makes sense no matter where you fall in the supply chain to take data privacy seriously. The CSA GDPR COC can help you establish a security-conscious culture. GDPR requires organizations to identify their security strategy and adopt adequate administrative and technical measures to protect personal data. Thanks to CSA's research, the CSA GDPR COC provides the roadmap that will facilitate your organization's efforts to ensure, your processes will become more consolidated, ensuring good governance, compliance and prove that all-important due diligence. Additionally, your data will be easier to use, and you will realize an underlying value and ROI.

For more information and to discuss with one of our experts, contact us at [email protected].

You can access the GDPR Code of Conduct here. The PLA Code of Practice is available here.