Privacy by Design & Privacy Auditing NBIC Ronald Koorn, 12 april 2013
Agenda
1. Privacy-ontwikkelingen 2. Uitkomsten KPMG privacy survey 3. Privacy by Design 4. Privacy Auditing
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
2
Schema WBP Melding
Regelgeving WBP Transparantie
Doelbinding
Grondslag
Beleid Niet-EU-landen
Vrijstellingen
Maatregelen
Verwerkingen Persoonsgegevens
Procedures
Compliance Rechten
Kwaliteit
Beveiliging
Gedragscode
Bewerker
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
3
Raakvlakken met privacy
Compliance
Juridisch
Integriteit MVO / CSR
Privacy
Documentmanagement/ Bewaartermijnen
Bedrijfsprocessen Controls / Auditing
Beveiliging Gegevenskwaliteit
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
4
Privacy-ontwikkelingen: in het nieuws DNA hack could make medical privacy impossible – Researchers could find your name by taking samples from a distant cousin
Wisconsin Researcher Charged With Stealing Cancer Data For China
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
5
Privacy-ontwikkelingen: wet- & regelgeving Huidig wetgeving:
Wbp & WGBO
Overig: cookies/telecom, HR, e.d.
Nieuwe EU-verordening:
Genetische gegevens
Data Privacy Officer
Kinderen / toestemming ouders
Privacy Impact Assessment
Meldplicht datalekken
Bewaartermijnen & vernietiging (‘Right to be forgotten’)
Toezicht CBP (en IGZ & OPTA)
Boetes
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
6
KPMG privacy survey
Uitkomsten KPMG privacy survey Veel privacy incidenten Het aantal privacyincidenten in Nederland is hoog Hebben binnen uw organisatie de afgelopen 3 jaar privacy incidenten plaatsgevonden? 18,0% 16,0% 14,0% 12,0% 10,0% 8,0% 6,0% 4,0% 2,0% 0,0%
Financiele sector
ICE
Industrie
Detailhandel
Publieke sector
Topje van de ijsberg: Overige enquêtes
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
8
Uitkomsten KPMG privacy survey Privacy is niet gelijk aan beveiliging.
= © 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
9
Uitkomsten KPMG privacy survey Privacy is niet gelijk aan beveiliging.
Privacy • • • • • • •
Privacybeleid Melding Rechten betrokkenen Doelbinding Proportionaliteit Gegevenskwaliteit Gegevensuitwisseling (incl. buiten EU)
Beveiliging • • • • • • •
Beveiligingsbeleid Gegevensclassificatie Logische beveiliging Fysieke beveiliging Incidentmanagement Beschikbaarheid Naleving
• • • •
Beveilgingsorganisatie Personele beveiliging ICT-beheer Systeemontwikkeling
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
10
Uitkomsten KPMG privacy survey Privacy staat niet hoog op de prioriteitenlijst Privacy krijgt onvoldoende prioriteit
Complexiteit wet - en regelgeving Onvoldoende aandacht / prioriteit Gebrek aan tijd / capaciteit Gebrek aan kennis Operationeel maken en toepassen van regelgeving Complexiteit ICT Complexiteit van de eigen organisatie Kosten / budget Menselijke factor (meewerken, fouten maken) Overig 0,0%
5,0%
10,0%
15,0%
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
20,0%
11
Uitkomsten KPMG privacy survey Gevoel van compliance Privacy compliance 7,5%
3,1% 4,1%
7,5%
3,1% 4,1%
Zijn we al
Zijn we al
Binnen nu en een paar jaar Binnen nu en een paar jaar Verdere toekomst Verdere toekomst
20,1%
Nooit 65,2%
65,2%
Nooit
Weet niet / geen antwoord Weet niet / geen antwoord
Toegepaste evaluatiemiddelen voor het Totaal bepalen van mate van privacybescherming Privacy Quick-scan
14%
WBP Zelfevaluatie (interne audit)
11% 14%
14% 44%
Privacy audit (interne audit) Privacy audit (externe audit)
Geen van deze 3%
Weet niet
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
12
Privacy by Design
Uitgangspunten
• • •
Privacy by Design is geen „rocket science‟
•
Privacy by Design gaat niet zozeer om steeds dikkere muren om persoonsgegevens heen, maar met name om minder persoonsgegevens te verwerken
• • • • •
„Enhancing‟ is niet voor niets als term gekozen
Privacy by Design omvat meer dan identiteitsbeschermer c.q. pseudo-identiteiten Privacy by Design is niet één concept, maar kan met diverse maatregelen worden gerealiseerd
Privacy by Design ontstaan in Nederland, invoering hier ook gestart Privacy by Design-oplossingen niet alleen internetgerelateerd Stapsgewijs toe te passen Privacy by Design is een manier van denken en niet louter invoering van technologie
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
14
Privacy Enhancing Technologies (PET): effectiviteitsmodel
Complexiteit toepassing
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
15
„PET-trap‟: voorbeelden
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
16
Voorbeeld: scheiding gegevensdomeinen
Privileges
Monitoring
Pseudo-domein I
Database
Bewerker/ Betrokkene
Aanbieders diensten
Identiteitsdomein
Identiteitsbeschermer (TTP)
Diensten
Diensten
Privileges Monitoring
Database
Pseudo-domein II
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
17
Voorbeeld TTP-gebaseerde pseudonomiseringsoplossing
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
18
Voorbeeld: traumasysteem
Autorisatielaag (inloggen en koppeling met rollen)
Logicalaag (geprogrammeerde procedures ten behoeve van versleuteling en ontsleuteling) Gegevenslaag Patiëntendatabase Beveiligingsdatabase Tabel medische gegevens
Deels versleutelde NAW-tabel
Tabellen met rollen, gebruikers en autorisaties
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
19
Aanpak 1. Doelbinding: noodzaak verwerking? 2. Gegevensclassificatie & risicoanalyse: PET gewenst? 3. Basisontwerp: bepalen PET-vorm
4. Detailontwerp: technische uitwerking benodigde PET-maatregelen 5. Ontwikkeling: „make or buy PET‟? 6. Testen: hanteren privacyregels 7. Implementatie: PET-specifieke procesaanpassing nodig? 8. Beheer & onderhoud: geen of gereguleerde doorbreking PET mogelijk 9. Evaluatie/audit & bijstelling: complete managementcyclus
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
20
Eisen pseudonomisering College Bescherming Persoonsgegevens (CBP) heeft aangegeven dat pseudonimisering moet voldoen aan: Vakkundig gebruik van pseudonimisering, met eerste encryptie bij de bron Gebruik technische en organisatorische maatregelen om herleidbaarheid van de versleuteling („replay back‟) te voorkomen
Verwerkte gegevens zijn niet indirect identificerend Onafhankelijk deskundig oordeel (audit) voor aanvang van verwerking en periodiek geeft aan dat aan voorwaarden is voldaan Pseudonimiseringsoplossing is helder en volledig beschreven in openbaar document, zodat iedere betrokkene de garanties van oplossing kan afleiden
In de concept EU-privacyverordening wordt gesteld: gepseudonimiseerde gegevens = persoonsgegevens
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
21
Privacy by Design is méér dan methode om persoonsgegevens te beschermen Privacy by Design kan!
Privacy by Design willen!
Al vele malen succesvol toegepast
Bevordert de informatiekwaliteit
Technieken zijn beschikbaar
Naleving privacyreglement
Beperkte invloed op ontwikkelkosten
geautomatiseerd afgedwongen Geeft innovatief imago Biedt betere inzage- en controlemogelijkheden (ook voor burgers)
Privacy by Design moet!
Privacy by Design mag!
Eenvoudiger voldoen aan Wbp
Attitude van beslissers en projectleiders
Is voorwaardenscheppend voor
Positieve houding bij privacy-
vertrouwen van burger Maakt werken met gevoelige
betrokkenen en operational/ICT-auditors Rol Privacy Officer…?
persoonsgegevens mogelijk © 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
22
Privacyauditing
Privacy-instrumenten College Bescherming Persoonsgegevens Privacy Quick Scan Privacy Zelfevaluatie (evt. met externe review) Privacyaudit
Privacycertificering o.b.v. privacyaudit (resulterend in “Privacy Proof”-certificaat) Aangevuld met diverse richtlijnen en CBP Richtsnoer “Beveiliging van persoonsgegevens” (nieuwe versie van februari 2013)
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
24
Doelstellingen privacyaudit Verhogen privacybewustzijn Identificeren kritieke risicogebieden en maatregelen Vaststellen compliancestatus met eigen privacypolicy en relevante wet- en regelgeving Aantonen privacycompliance voor klanten, zorgverleners en andere belanghebbenden (toezichthouders, pers, e.d.)
Ontwikkelen verbeterplan
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
26
26
Raamwerk privacyaudit
April 2001 Raamwerk ontwikkeld door CBP en ICT-auditors
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
27
Onderwerpen privacyaudit V1
Voornemen & Melding
V2
Transparantie
V3
Doelbinding
V4
Rechtmatige grondslag
V5
Gegevenskwaliteit
V6
Rechten van de betrokkenen
V7
Beveiliging
V8
Verwerking door bewerker
V9
Gegevensuitwisseling buiten EU
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
28
Aanpak privacyaudit
Fase 1
Bepalen doel, scope, diepgang & aanpak
Fase 2
Opstellen auditaanpak
Fase 3
Identificeer wet- en regelgeving (gedragscode)
Fase 4
Opstellen normenkader
Fase 5
Identificeer persoonsgegevens, verwerkingen & in/externe gegevensuitwisseling
Fase 6
Review documentatie, eigen waarnemingen & validatie
Fase 7
Reportage, presentatie en eventuele certificering
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
29
„Privacy proof‟-certificaat
Basis is positieve conclusie privacy audit
Certificeringschema
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
30
Normenkader
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
31
Tenslotte
Discussiestellingen
Privacybewustzijn is fundament
Privacy is vrijwel een nonissue bij programmeren
Wat zijn belangrijkste redenen om Privacy by Design al dan niet bij ontwikkeling te betrekken
Het is duidelijk wie verantwoordelijk is voor privacynaleving
Hoe zwaarder de toegangsbeveiliging, hoe meer privacygevoelige gegevens benodigd zijn
Voldoen aan NEN 7510 is bijna toereikend voor privacycompliance
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
33
Zo zwaar is privacycompliance niet !
© 2013 KPMG Advisory N.V., a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in The Netherlands. The KPMG name, logo and ‘cutting through co mplexity’ are registered trademarks of KPMG International.
34
Vragen ? Drs.ing. Ronald Koorn RE Partner KPMG IT Advisory Postbus 43004 3540 AA Utrecht Tel. 06 – 2292 8127
[email protected]
