News of cyberattacks seems constant these days. Recently, Equifax, a US-based consumer credit reporting agency, announced that a private customer data breach impacted 143 million people. Earlier this year, 1.5 million connected cameras around the world were hijacked in an unprecedented DDoS attack.

As cyber-attacks become more rampant, it’s hardly surprising that governments are stepping in to hold organizations more accountable. One of the most recent examples of this is the European Union’s General Data Protection Regulation (GDPR) which is set to come into effect on May 25, 2018.

New GDPR Legislation Mandates

Essentially, the GDPR mandates that businesses adhere to specific governance and accountability standards in the processing and protection of data. A big focus of this new legislation is that individuals have greater control over their personal data. Contrary to legislations in the United States, the personal data captured by organizations will remain the property of each EU citizen, entitling them to access their own data and have greater decision power over how it is used or distributed.

Should a breach occur, companies are mandated to report it to the supervisory authority within 72 hours. Failure to comply with these new regulations could result in up to $20 million euros in penalties, or 4% of the company’s global annual turnover.

Territorial Scope Of GDPR

So why should North American companies and security directors be concerned? The territorial scope of the GDPR is global. Any business that is collecting or storing personally identifiable information (PII) of EU citizens will be held accountable, regardless of where the organization is based or operating from. This includes any business collecting information from EU residents, or organizations with offices, stores, warehouses or employees in the EU.

With the deadline nearing, these North American organizations are seeking strategies that will keep them compliant across all their data collection processes. With a focus on physical security sensors and solutions, below are five steps that North American companies can start taking to become GDPR-compliant.

Step 1: Conduct A Data Risk Assessment

To better understand the implications of the GDPR, an organization must fully assess the level of risk that its data processing operations pose to the rights of EU citizens. A business should map out how data is collected, where it is stored, how long it is kept, and who has access to it. Identifying and categorising the various types of data is also critical to this evaluation. That’s because according to the GDPR, there is a clear distinction between the high, medium and low-risk data.

Companies should add varied lines of defence such as encryption, multi-layer authentication and authorisation
Through authorization, organizations can define how specific users or groups can use the security system

For instance, data derived from a video surveillance system that shows who a person is and where they are is considered high-risk. This could be a retailer that is monitoring video of people coming into its stores or an EU subsidiary office that is recording publicly-facing video footage.

Step 2: Hire A Data Protection Officer

In cases of high-risk data processing, organizations may need to appoint a data protection officer (DPO). This person must be independent of any IT, risk or VP-level functions and will be responsible for monitoring the organization’s compliance with respect to their GDPR obligations. The DPO will act as the main point of contact for all communications with the GDPR supervisory body. This means that at any point in time, the DPO should also be able to show the steps taken by the organization to protect any collected information.

Step 3: Implement Privacy By Design

The GDPR mandates that businesses with ‘high-risk data operations’ implement systems that protect privacy and secure data by default. It is therefore critical for these organizations to start talking to system integrators and suppliers about what they can do to harden their systems. After all, cyber security should be a shared responsibility. Organizations should work with partners and vendors to better understand cyber security risks and streamline internal processes such as outlining who has access to the data and identifying why and how long it should be kept.

With this understanding, companies can justify adding varied lines of defense such as encryption, multi-layer authentication and authorization. For instance, through authentication, organizations can determine if an entity—user, server, or client app—is who it claims to be, and then verify if and how that entity is allowed to access a system. Through authorization, organizations can define how specific users or groups can use the security system.

Finally, encryption protects an organization’s information and data by using an algorithm to make text indecipherable. From device to client application, these security measures help organizations safeguard against cyber threats and unauthorized access.

Step 4: Address Data Transparency

At any point in time, an EU citizen has the right to request a copy of information pertaining to them from an organization. Upon receiving this request, the company would be required to securely and remotely share video and data files with the individual. A problem could surface if other individuals are visible in this footage. Security solutions that not only facilitate information sharing but also protect privacy can help companies quickly adapt to these new laws.

Video redaction capabilities can blur out people's faces in video
Blurring out faces transfers high-risk data to the low-risk category, allowing organizations to monitor or share video while still protecting privacy

One example is having video redaction capabilities to blur out people’s faces in video. This feature transfers high-risk data to the low-risk category, allowing organizations to monitor or share video while still protecting privacy. Companies will also need to provide greater transparency by making points of contact accessible and clearly outlining data management policies.

Step 5: Engage Data Processors

According to the GDPR, any company that collects and controls private information is a Data Controller. To properly manage the collected data, companies may choose to outsource some of the responsibility to service providers, known as Data Processors.

For instance, a retailer could decide to implement a Video-Surveillance-as-a-Service (VSaaS) solution. Some advanced VSaaS providers offer numerous logs and, more importantly, strong reporting platforms that can help Data Controllers and DPOs monitor the state of their video surveillance systems. In some capacity, Data Processors are equally responsible for adhering to laws.

Considering the failure to report a breach in 72 hours could result in massive penalties, implementing a VSaaS is a great way to stay on top of potential breaches and decrease compliance upgrade costs. However, it is not a full transfer of risk. The retailer would still be responsible for issuing and managing system access privileges, ensuring password choices are robust, and essentially, limiting data to those who can view or extract it.

Counteracting Emerging Threats Through GDPR Compliance

With heavy fines looming, it is imperative that North American businesses collecting or processing any EU citizen data begin working on GDPR compliance immediately. Those filming in high-trafficked public spaces are at an even greater risk of penalty if compliance has been ignored.

Starting with a comprehensive risk assessment, hiring a qualified DPO, upgrading technology with built-in privacy and security mechanisms, and in some cases, working with data processors can help North American businesses get on track to full GDPR compliance. Regardless of these new laws, these practices will ultimately benefit the organization as a whole, as new threats emerge globally.

Share with LinkedIn Share with Twitter Share with Facebook Share with Facebook
Download PDF version Download PDF version

Author profile

In case you missed it

How Can Remote or Internet-Based Training Benefit Security?
How Can Remote or Internet-Based Training Benefit Security?

Internet-based training has long provided a less-expensive alternative to in-person classroom time. There are even universities that provide most or all of their instruction online. However, the COVID-19 pandemic has expanded acceptance even more and increased usage of internet-based meeting and learning tools. We asked this week’s Expert Panel Roundtable: How can remote or Internet-based training benefit the physical security market?

How is AI Changing the Security Market?
How is AI Changing the Security Market?

Artificial intelligence is more than just the latest buzzword in the security marketplace. In some cases, smarter computer technologies like AI and machine learning (ML) are helping to transform how security operates. AI is also expanding the industry’s use cases, sometimes even beyond the historic province of the security realm. It turns out that AI is also a timely tool in the middle of a global pandemic. We asked this week’s Expert Panel Roundtable: How is artificial intelligence (AI) changing the security market?

Moving to Sophisticated Electric Locking
Moving to Sophisticated Electric Locking

In part one of this feature, we introduced the shotbolt – a solenoid actuator – as the workhorse at the heart of most straightforward electric locking systems. Shotbolts remain at the core of most sophisticated electric locking solutions as well. But they are supplemented by materials and technologies that provide characteristics suited to specialist security applications. Here we look at some more demanding electric locking applications and contemporary solutions. Preventing forced entry Where the end of the shotbolt is accessible, the electric holding force can be overcome by physical force. That’s why anti-jacking technology is now a frequent feature of contemporary electric solenoid lock actuators. Anti-jacking, dead-locking or ‘bloc’ technology (the latter patented by MSL) is inherent to the way the locking assembly is designed to suit the requirements of the end application. The patented bloc anti-jacking system is highly effective and incorporated into many MSL shotbolts deployed in electric locking applications. The bloc technology uses a ring of steel balls in a shaped internal housing to physically jam the actuated bolt in place. A range of marine locks is widely used on Superyachts for rapid lockdown security from the helm Real life applications for MSL anti-jacking and bloc-equipped shotbolts include installation in the back of supermarket trucks to secure the roller shutter. Once locked from the cab, or remotely using radio technology, these shutters cannot be forced open by anyone with ‘undesirable intentions’ armed with a jemmy. A range of marine locks is widely used on Superyachts for rapid lockdown security from the helm. While anti-jacking features are an option on these shotbolts, consideration was given to the construction materials to provide durability in saltwater environments. Marine locks use corrosion-proof stainless steel, which is also highly polished to be aesthetically pleasing to suit the prestigious nature of the vessel while hiding the innovative technology that prevents the lock being forced open by intruders who may board the craft. Rotary and proportional solenoids sound unlikely but are now common A less obvious example of integrated technology to prevent forced override is a floor lock. This lock assembly is mounted beneath the floor with round-top stainless-steel bolts that project upwards when actuated. They are designed to lock all-glass doors and are arguably the only discreet and attractive way to lock glass doors securely. In a prestigious installation at a historic entranceway in Edinburgh University, the floor locks are remotely controlled from an emergency button behind the reception desk. They act on twin sets of glass doors to quickly allow the doors to close and then lock them closed with another set of subfloor locks. No amount of stamping on or hitting the 15mm protruding bolt pin will cause it to yield, thus preventing intruders from entering. Or leaving! Explosion proofing In many environments, electric locking technology must be ATEX certified to mitigate any risk of explosion. For example, remote electric locking is used widely on oil and gas rigs for stringent access control, general security and for emergency shutter release in the event of fire. It’s also used across many industrial sectors where explosion risks exist, including flour milling, In many environments, electric locking technology must be ATEX certified to mitigate any risk of explosionpowder producers, paint manufacture, etc. This adds a new dimension to the actuator design, demanding not only intrinsically safe electrical circuits and solenoid coils, but the careful selection of metals and materials to eliminate the chance of sparks arising from moving parts. Resilience under pressure The technology boundaries of solenoids are always being pushed. Rotary and proportional solenoids sound unlikely but are now common. More recently, while not directly related to security in the traditional sense, proportional solenoid valves for accurately controlling the flow of hydrogen and gases now exist. Magnet Schultz has an extensive and somewhat innovative new range of hydrogen valves proving popular in the energy and automotive sectors (Fig. 2-6). There’s a different kind of security risk at play here when dealing with hydrogen under pressures of up to 1050 bar. Bio security Less an issue for the complexity of locking technology but more an imperative for the effectiveness of an electric lock is the frequent use of shotbolts in the bio research sector. Remote electric locking is commonplace in many bioreactor applications. Cultures being grown inside bioreactors can be undesirable agents, making 100% dependable locking of bioreactor lids essential to prevent untimely access or the unwanted escape of organisms. Again, that has proven to be topical in the current climate of recurring coronavirus outbreaks around the world. More than meets the eye In part one, I started by headlining that there’s more to electric lock actuation in all manner of security applications than meets the eye and pointed out that while electric locking is among the most ubiquitous examples of everyday security, the complexity often involved and the advanced technologies deployed typically go unnoticed.Integrating the simplest linear actuator into a complex system is rarely simple For end users, that’s a very good thing. But for electro-mechanical engineers designing a system, it can present a challenge. Our goal at Magnet Schultz is to provide a clearer insight into today’s electric locking industry sector and the wide range of locking solutions available – from the straightforward to the specialized and sophisticated. Integrating the simplest linear actuator into a complex system is rarely simple. There’s no substitute for expertise and experience, and that’s what MSL offers as an outsource service to designers. One benefit afforded to those of us in the actuator industry with a very narrow but intense focus is not just understanding the advantages and limitations of solenoid technology, but the visibility of, and participation in, emerging developments in the science of electric locking. Knowing what’s achievable is invaluable in every project development phase.