News of cyberattacks seems constant these days. Recently, Equifax, a US-based consumer credit reporting agency, announced that a private customer data breach impacted 143 million people. Earlier this year, 1.5 million connected cameras around the world were hijacked in an unprecedented DDoS attack.

As cyber-attacks become more rampant, it’s hardly surprising that governments are stepping in to hold organizations more accountable. One of the most recent examples of this is the European Union’s General Data Protection Regulation (GDPR) which is set to come into effect on May 25, 2018.

New GDPR Legislation Mandates

Essentially, the GDPR mandates that businesses adhere to specific governance and accountability standards in the processing and protection of data. A big focus of this new legislation is that individuals have greater control over their personal data. Contrary to legislations in the United States, the personal data captured by organizations will remain the property of each EU citizen, entitling them to access their own data and have greater decision power over how it is used or distributed.

Should a breach occur, companies are mandated to report it to the supervisory authority within 72 hours. Failure to comply with these new regulations could result in up to $20 million euros in penalties, or 4% of the company’s global annual turnover.

Territorial Scope Of GDPR

So why should North American companies and security directors be concerned? The territorial scope of the GDPR is global. Any business that is collecting or storing personally identifiable information (PII) of EU citizens will be held accountable, regardless of where the organization is based or operating from. This includes any business collecting information from EU residents, or organizations with offices, stores, warehouses or employees in the EU.

With the deadline nearing, these North American organizations are seeking strategies that will keep them compliant across all their data collection processes. With a focus on physical security sensors and solutions, below are five steps that North American companies can start taking to become GDPR-compliant.

Step 1: Conduct A Data Risk Assessment

To better understand the implications of the GDPR, an organization must fully assess the level of risk that its data processing operations pose to the rights of EU citizens. A business should map out how data is collected, where it is stored, how long it is kept, and who has access to it. Identifying and categorising the various types of data is also critical to this evaluation. That’s because according to the GDPR, there is a clear distinction between the high, medium and low-risk data.

Companies should add varied lines of defence such as encryption, multi-layer authentication and authorisation
Through authorization, organizations can define how specific users or groups can use the security system

For instance, data derived from a video surveillance system that shows who a person is and where they are is considered high-risk. This could be a retailer that is monitoring video of people coming into its stores or an EU subsidiary office that is recording publicly-facing video footage.

Step 2: Hire A Data Protection Officer

In cases of high-risk data processing, organizations may need to appoint a data protection officer (DPO). This person must be independent of any IT, risk or VP-level functions and will be responsible for monitoring the organization’s compliance with respect to their GDPR obligations. The DPO will act as the main point of contact for all communications with the GDPR supervisory body. This means that at any point in time, the DPO should also be able to show the steps taken by the organization to protect any collected information.

Step 3: Implement Privacy By Design

The GDPR mandates that businesses with ‘high-risk data operations’ implement systems that protect privacy and secure data by default. It is therefore critical for these organizations to start talking to system integrators and suppliers about what they can do to harden their systems. After all, cyber security should be a shared responsibility. Organizations should work with partners and vendors to better understand cyber security risks and streamline internal processes such as outlining who has access to the data and identifying why and how long it should be kept.

With this understanding, companies can justify adding varied lines of defense such as encryption, multi-layer authentication and authorization. For instance, through authentication, organizations can determine if an entity—user, server, or client app—is who it claims to be, and then verify if and how that entity is allowed to access a system. Through authorization, organizations can define how specific users or groups can use the security system.

Finally, encryption protects an organization’s information and data by using an algorithm to make text indecipherable. From device to client application, these security measures help organizations safeguard against cyber threats and unauthorized access.

Step 4: Address Data Transparency

At any point in time, an EU citizen has the right to request a copy of information pertaining to them from an organization. Upon receiving this request, the company would be required to securely and remotely share video and data files with the individual. A problem could surface if other individuals are visible in this footage. Security solutions that not only facilitate information sharing but also protect privacy can help companies quickly adapt to these new laws.

Video redaction capabilities can blur out people's faces in video
Blurring out faces transfers high-risk data to the low-risk category, allowing organizations to monitor or share video while still protecting privacy

One example is having video redaction capabilities to blur out people’s faces in video. This feature transfers high-risk data to the low-risk category, allowing organizations to monitor or share video while still protecting privacy. Companies will also need to provide greater transparency by making points of contact accessible and clearly outlining data management policies.

Step 5: Engage Data Processors

According to the GDPR, any company that collects and controls private information is a Data Controller. To properly manage the collected data, companies may choose to outsource some of the responsibility to service providers, known as Data Processors.

For instance, a retailer could decide to implement a Video-Surveillance-as-a-Service (VSaaS) solution. Some advanced VSaaS providers offer numerous logs and, more importantly, strong reporting platforms that can help Data Controllers and DPOs monitor the state of their video surveillance systems. In some capacity, Data Processors are equally responsible for adhering to laws.

Considering the failure to report a breach in 72 hours could result in massive penalties, implementing a VSaaS is a great way to stay on top of potential breaches and decrease compliance upgrade costs. However, it is not a full transfer of risk. The retailer would still be responsible for issuing and managing system access privileges, ensuring password choices are robust, and essentially, limiting data to those who can view or extract it.

Counteracting Emerging Threats Through GDPR Compliance

With heavy fines looming, it is imperative that North American businesses collecting or processing any EU citizen data begin working on GDPR compliance immediately. Those filming in high-trafficked public spaces are at an even greater risk of penalty if compliance has been ignored.

Starting with a comprehensive risk assessment, hiring a qualified DPO, upgrading technology with built-in privacy and security mechanisms, and in some cases, working with data processors can help North American businesses get on track to full GDPR compliance. Regardless of these new laws, these practices will ultimately benefit the organization as a whole, as new threats emerge globally.

Download PDF version

Author Profile

In case you missed it

BCDVideo Signs OEM Deal With Dell EMC: Positive Impact For Surveillance Storage
BCDVideo Signs OEM Deal With Dell EMC: Positive Impact For Surveillance Storage

In a significant move for the video security market, BCDVideo has announced that it is set to become Dell EMC’s OEM partner in the video surveillance space. For nearly a decade, the Chicago-based company has been known as a key OEM partner of Hewlett Packard Enterprise (HPE), providing storage and networking technology to security integrators on a global scale. This latest partnership will allow BCDVideo to take their offerings to the next level. BCDVideo Vice President Tom Larson spoke to SecurityInformed.com to discuss the reasoning behind the deal, and how the program will benefit partners, integrators, and end-users alike. Expanding BCDVideo's Product Offering For BCDVideo, the HPE OEM program has been widely acknowledged as a success, allowing the company to leverage a globally recognized brand and provide high-quality, reliable solutions across video networking and access control. Nevertheless, explains Larson, HPE server solutions are primarily suited to large-scale enterprise projects, and are therefore unable to accommodate for the growth in small- and medium-sized surveillance applications. The global collaboration with Dell EMC will allow BCDVideo to open up a broader product offering, building on success in the larger enterprise market to offer tailored solutions to SMEs. Our aim is to look at all best of breed technology to serve the video surveillance marketplace, and that means multiple partnerships” Support For Integrators By leveraging Dell EMC’s sophisticated digital storage platforms, BCDVideo will now be able to offer a more cost-effective solution to integrators, without sacrificing the resilience and IT-level service that BCDVideo is known for. With access to Dell EMC’s expansive global sales and technical teams, the company hopes to expand its reach, all-the-while providing partners with around-the-clock technical support and a five-year on-site warranty. Customers should be reassured that BCDVideo will continue to offer HPE platforms, service, and support. “Our aim is to look at all best-of-breed technology to serve the video surveillance marketplace, and that means multiple partnerships,” says Larson.  “The addition of Dell EMC to our portfolio is a major win for BCDVideo, for Dell EMC, and for our integrators.” The global collaboration with Dell EMC will allow BCDVideo to open up a broader product offering Meeting Surveillance Market Demands At the technology level, assures Larson, Dell EMC’s server offering is well suited to handle the increasing video resolution and growing camera count demanded by the surveillance industry. At the larger end of the spectrum, the company’s Isilon Scale-Out NAS solution can handle tens of petabytes of data, making it ideal for large-scale security applications such as city-wide surveillance and airport security. Dell EMC storage solutions are already proving successful at major international airports including Dubai and Abu Dhabi, each with a camera count in the 1000s.Dell EMC and BCDVideo together are ensuring our customers get the right solutions designed for the surveillance market” For Dell EMC, the new partnership means the ability to expand on this success in the enterprise market, leveraging BCDVideo’s surveillance expertise and high-level customer service to offer tailored solutions for lower-volume applications. Since its inception, BCDVideo has differentiated itself in the security space by providing a high level of IT service to integrators making the transition to IP systems. By combining resources, the partners will be able to service VMS and analytics companies, software vendors, and access control providers, as well as traditional business integrators. Ken Mills, General Manager Dell EMC Surveillance, explains: “Surveillance storage is not just about capacity, it is also about performance and reliability. Dell EMC and BCDVideo together are ensuring our customers get the right solutions designed for the surveillance market.” Accomodating For Growth BCDVideo is well placed to accommodate this anticipated growth. Last year, the company opened a new 51,000-square-foot global headquarters in Illinois, home to 90 separate stations within their Innovation Center where each system is customised according to integrator needs. The new facility allows for expanding business with new and existing partners in the security market.

How To Prepare For Active Shooter Incidents | Infographic
How To Prepare For Active Shooter Incidents | Infographic

This Active Shooter infographic summarises information about trends among active shooter incidents, and outlines how an organization can develop a plan before tragedy occurs, including:   Statistics on the numbers and types of recent active shooter incidents. A profile of common traits among active shooters. How to prepare beforehand, and what to do when the police arrive. How organizational planning ensures maximum preparedness. Pre-attack indicators to look for. Be sure to share this information with coworkers and managers. Awareness is key to preventing active shooter incidents, and to minimising their tragic consequences. When sharing this infographic on your website, please include attribution to  SecurityInformed.com More resources for active shooter preparedness: How hospitals can prepare for active shooter attacks Six steps to survive a mass shooting Technologies to manage emergency lockdowns  How robots can check for active shooters  Background checks to minimise insider threats Gunfire detection technologies for hospitals, retail and office buildings 21 ways to prevent workplace violence in your organisation Non-invasive security strategies for public spaces    

How Should Your Security Company Measure Total Cost Of Ownership (TCO)?
How Should Your Security Company Measure Total Cost Of Ownership (TCO)?

How much does a security system cost? We all know that total costs associated with systems are substantially higher than the “price tag.” There are many elements, tangible and intangible, that contribute to the costs of owning and operating a system. Taking a broad view and finding ways to measure these additional costs enables integrators and users to get the most value from a system at the lowest total cost of ownership (TCO). However, measuring TCO can be easier said than done. We asked this week’s Expert Panel Roundtable to share the benefit of their collective expertise on the subject. Specifically, we asked: How should integrators and/or end users measure total cost of ownership (TCO) when quantifying the value of security systems?