Merge branch 'st20'

Articles/st20_gdpr_what_it_means.md

@@ -0,0 +1,146 @@
+# Data for Good and Evil
+
+Before considering the legal aspects of data collection and processing, consider the *power* of data. Below are two cases where data has had a large impact on society. They are just examples and we could easily find many more.
+
+## Saving Lives
+
+"A clinical trial looked at the potential for a new type of bowel screening to save lives. Following 170,432 people for an average of 11 years, the trial showed that this one off screening could save thousands of lives, through early diagnosis and prevention, and led to it being adopted by the NHS in England. Patient data was used to identify appropriate people for the trial and then to monitor what happened to them after screening."
+
+https://understandingpatientdata.org.uk/case-study/screening-bowel-cancer
+
+
+## Subverting Democracy
+
+"We have found evidence of formally organized social media manipulation campaigns in 48 countries, up from 28 countries last year. In each country there is at least one political party or government agency using social media to manipulate public opinion domestically."
+
+http://comprop.oii.ox.ac.uk/research/cybertroops2018/
+
+# General Data Protection Regulation (GDPR)
+
+The GDPR is a Europe-wide regulation.
+
+The GDPR deals with the security and confidentiality of personal
+information.  In short, it demands that anyone who collects, stores or
+processes personal information does so securely.
+
+The regulations state that data is required to be ‘processed in a
+manner that ensures appropriate security of the personal data,
+including protection against unauthorised or unlawful processing and
+against accidental loss, destruction or damage, using appropriate
+technical or organisational measures’
+
+Rather than just expect "best efforts", GDPR demands that at the
+design stage and during execution, any data collection or processing
+will be combined with appropriate technical and procedural controls
+that ensure that personal data is secure. This is known as "data
+protection by design".
+
+In the UK, the GDPR is implemented as the Data Protection Act 2018.
+
+## Requirements
+
+GDPR requires:
+
+ - That no more personal data is collected than necessary
+ - Access to personal data is managed and minimised
+ - Confidentiality, Integrity and Availability (known as the CIA triangle) of the data are protected
+ - Resilience and usable back-ups in case of incident
+ - Regular testing of the effectiveness of measures implemented
+
+
+## Rights
+
+The GDP gives the public a set of rights concerning their data:
+
+### The Right to be Informed
+
+Simply put, when data is collected about an individual, they should be informed clearly.
+
+### The Right of Access
+
+Individuals about whom data is collected have the right to access that data.
+
+### The Right to Rectification
+
+Individuals have the right to have their data corrected if it is inaccurate or incomplete. 
+
+### The Right to Erasure
+
+Individuals have the right to request that their data is removed from a system.  The request may be denied if it is required for valid and legal reasons.
+
+### The Right to Restrict Processing
+
+Individuals have the right to request that rocessing of their personal
+data is halted if they believe their it is inaccurate and not have it
+resume until the issue is resolved.
+
+### The Right to Data Portability
+
+For electronic records, users of a system can request their data to be made available in a portable format.  For example, you should be able to request all of your e-mails from your e-mail provider in a format that you can then import into another e-mail service.
+
+### The Right to Object
+
+Individuals have the right to object to their data being used in some circumstances.  This includes automated decision making and profiling, which an individual might feel will result in detrimental outcomes if there is not a human making the decision.
+
+### Exemptions 
+
+These rights can sometimes be restricted. For example, in legal
+investigations, journalism, confidentiality of references, and so on,
+there are legitimate reasons to restrict the rights of individuals for
+a greater good.
+
+# GDPR and Security
+GDPR requires that whoever is responsible for data collection, the Data Controller, is accountable for the security of that data and appropriate technical and organisational measures are in place to ensure, and be able to demonstrate, that processing of personal data is performed in accordance with the regulations.
+
+## Four Aims
+
+The data security aspects of the GDPR are intended to lead to an organisation being capable of the following:
+
+ 1. Manage security risk
+ 2. Protect personal data against cyber attack
+ 3. Detect security events
+ 4. Minimise the impact
+
+
+The specifics of each depend on the type and volume of data collected and the scale of the organisation. That is, all controls should be "appropriate", based on:
+
+ - the state of the art of the technology
+ - cost of implementation
+ - the nature, scope, context and purpose of processing’, and
+ - the severity and likelihood of the risk being realised.
+
+The National Cyber Security Centre (NCSC) give some examples of security measures:
+
+ - Tracking and recording of all assets that process personal data,
+   including end user devices and removable media.
+ - Minimising the opportunity for attack by configuring technology
+   appropriately, minimising available services and controlling
+   connectivity.
+ - Actively managing software vulnerabilities, including using
+   in-support software and the application of software update policies
+   (patching) and taking other mitigating steps, where patches can’t
+   be applied.
+ - Managing end user devices (laptops and smartphones etc) so that you
+   can apply organisational controls over software or applications
+   that interact with or access personal data.
+ - Encrypting personal data at rest on devices (laptops, smartphones,
+   and removable media) that are not subject to strong physical
+   controls.
+ - Encrypting personal data when transmitted electronically.
+ - Ensuring that web services are protected from common security
+   vulnerabilities such as SQL injection and others described in
+   widely-used publications such as the OWASP Top 10.
+ - Ensuring your processing environment remains secure throughout its
+   lifecycle.
+
+## Impact
+
+In the particular case of minimising impact, you should consider:
+
+ - minimising the impact of a personal data breach
+ - capability to restore systems and services (backups, backup sites, backup schedules)
+ - how to manage the incident appropriately
+ - ensuring you have enough information to learn lessons for the future
+
+
+