Feature AVOIDING


GDPR


Over the last 18 months, it’s clear that GDPR has contributed to the complete overhaul of the way we handle our data. So many facilities have made strides forward and for the right reasons. Yet for some, GDPR is felt as a weight on the shoulders of their building and the occupants within – but does it need to be? For those playing the word association


game, the word pressure is usually synonymous with GDPR. It wasn’t too long ago that the phrase ‘GDPR’ sent shudders down the spine of facility managers trying to desperately understand the new regulation, let alone prepare for it. Fast forward almost a year and a half


from the 25th May 2018, a lot has changed. Generally,


beginning to understand the regulation, with some questioning why data hasn’t


facility managers are now always


been handled this meticulously. For data handlers themselves, although this isn’t the case for everyone, steps have been taken in the right direction with many improving the way they handle confidential data and sensitive information. Yet, there’s still a looming pressure for the facilities that hold vast amounts of personal data to get GDPR right. For a year and a half now, fines and dented reputations have been hanging over the head of so many data handlers. Even those who have worked hard to improve their processes and meet the new standards haven’t always been able to keep up.


So this drives the question, are we in danger of GDPR fatigue?


UK under pressure


As we’ve seen in the news, those that aren’t compliant run the risk of heavy fines. The latter half of 2019 has certainly uncovered a string of data breach investigations as we now begin to see a number of organisations, big and small, succumb to the pressure of


34 fmuk


data protection. In one of this year’s larger cases,


the Information Commissioner’s


Office (ICO) has stated its intent to fine British Airways £183m under GDPR. This comes after a data breach concerning the personal data of approximately half a million customers. British Airways representatives described the incident as surprising and disappointing with top analysts highlighting that this should act as a reminder that GDPR covers anyone handling data. While that’s true, these news stories shouldn’t add to the ongoing pressure that data handlers are experiencing. Instead, this should be used as a motive to drive data handlers to seek a simpler, yet effective approach towards data protection.


Keeping teams on track


Put simply, GDPR doesn’t need to be the oppressive regulation that it’s seen to be. For those managing facilities and feeling the pressure, or even worse, falling short with data protection, it’s important to take a step back and get the basics right. For


facility managers with a large


workforce and managing multiple sites, it’s key to remember that not all individuals will become a GDPR compliance specialist. With that in mind, it’s imperative that facility managers have the correct internal processes in place to support occupants, and as experts have continually emphasised, raise education on the subject to at an appropriate level. If you take the shredding process as an example, data handlers should understand the security level that they’re required to cut at. For example,


highly


sensitive documents should be destroyed by cross-cut shredding to a level of P-5 or above, whereas documents containing less important data can be destroyed at the lower P-4 security level. It’s this


level of education and understanding that could be information out


FATIGUE


the difference between compliance and a GDPR breach. Routine is also crucial. When facilities are


dealing with paper documents containing highly confidential or sensitive information, shredding procedures should be encouraged as part of a routine. Whilst it’s a step in the right direction to own an internal shredder system, it’s not enough if they’re not being used correctly. Facility managers need to consider practical factors such as the size of paper they are shredding and what size shredder is going to be most suitable based on the building space available. With this in mind, data handlers should


be encouraged to deal with confidential documents and shred them at the point of use as soon as they are no longer needed. For facilities with a high number of external visitors, it’s important that paper documents are destroyed as soon as possible, keeping sensitive


of sight for


visitors and third parties. Whole documents left waiting to be disposed are at risk too. The use of internal shredders guarantees instant document security by reducing the risk of misplaced, lost or stolen printouts. Without routine, facilities can be subject to uncertainty, mounting pressure and leading to GDPR burnout.


A data procedure is for life


Avoiding this fatigue is paramount for right now. To implement an effective data security process, continual investment (both time and financial) is key. As we know, data protection has changed, and facilities must now support those within to assure compliance. Pressure is invited upon those that have, and still continue to, approach GDPR in the wrong way - it has never been enough to view it as an afterthought. Only when data security is taken seriously will facility managers truly be able to alleviate the pressure associated with GDPR.


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37  |  Page 38  |  Page 39  |  Page 40  |  Page 41  |  Page 42  |  Page 43  |  Page 44