PC PORTAL

Experienced. Trusted. Solutions.

Blog

By

Data protection impact assessments for health research: what’s changed under GDPR?

Since GDPR came into effect on 25 May this year, the health regulations have been updated to incorporate more stringent requirements around protecting personal information during healthcare research. The newly updated Health Research Regulations 2018 have raised the bar for carrying out a data protection impact assessment (DPIA). This post is the first in a series I’ll be writing about GDPR, privacy and health data.

We all know privacy by design is a cornerstone of the General Data Protection Regulation. The first building block to that foundation is carrying out a DPIA (commonly referred to as a privacy impact assessment). In November, the Data Protection Commissioner published guidance for data controllers and processors whose business activities may require them to carry out a DPIA. It is available as a free PDF here. 

More specifically for the health sector, the Health Research Regulations 2018 make it mandatory to perform a DPIA in all cases that involve processing personal data for research purposes. They remove all risk to the data subject – and that is a good thing.

The revised rules apply to a wide variety of stakeholders, including research bodies, pharmaceutical companies, academic institutions, higher education institutes, and other research-related bodies such as those attached to hospitals. Equally, technology companies may carry out research involving health information and they too need to comply with this requirement.

The Health Research Board has published guidance for researchers to reflect the new data protection landscape. Broadly speaking, they compel researchers to take suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects.

This essentially breaks down into two key questions researchers need to ask ahead of any impact assessment exercise:

Is there a risk to the rights and freedoms of the data subject?

Consider this keeping in mind the data subject rights under GDPR, which includes the right to access, rectification, objection, and portability. The Data Protection Commissioner has published a free report which describes these rights.

Have you mitigated those risks?

Do you have policies in place, and are they published online in a transparent way? Have you done a data mapping or data inventory exercise? Do you have an appropriate legal basis for processing information? Are you archiving information in line with retention schedules? Do you have a process in place for a subject access request?

By definition, a DPIA involves assessing the impact of risks to the data subject, and to their rights and freedoms. The nature of research means you don’t know beforehand what the outcome will be. You may discover during the exploration process that there is the potential to use the same information for a different purpose.

The Health Research Regulations 2018 will lead to many, many more DPIAs in the future. Research groups are likely to need external assistance to carry them out. To get ready for this new level of compliance, it is worth familiarising themselves with the DPIA process.

At BH Consulting, we have developed a privacy impact assessment template which guides our clients in identifying the risks associated with data processing. Get in touch to find out how we can help.

Tracy Elliott is a senior data protection consultant with BH Consulting. Check back over the coming weeks for more posts about data protection and health research.

 

The post Data protection impact assessments for health research: what’s changed under GDPR? appeared first on BH Consulting.

By

Cyber News Rundown: WeChat Ransomware

Reading Time: ~2 min.

Touch ID Used to Scam Apple Users

Two apps were recently removed from the Apple App Store after several users reported being charged large sums of money after installing the app and scanning their fingerprint. Both apps were fitness-related and had users scan their fingerprint immediately so they could monitor calories or track fitness progress. But the apps launched a payment confirmation pop-up with the user’s finger still on the device to charge any card on file for the account. Luckily, the apps were only available for a brief period before being removed and refunds issued.

Signet Jewelers Expose Customer Order Data

Signet Jewelers, the parent company for Kay and Jared jewelers, was informed last month by an independent researcher of a critical flaw in their online sites. By simply altering the hyperlink for an order confirmation email, the researcher was able to view another individual’s order, including personal payment and shipping information. While Signet resolved the issue for future orders, it took additional weeks to remedy the flaw for past orders.

WeChat Ransomware Hits over 100k Chinese Computers

In the five days since December began, a new ransomware variant dubbed WeChat Ransom has been spreading quickly across China. With over 100,000 computers currently infected and thousands more succumbing each day, WeChat has made a significant mark. Though it demands a ransom of only roughly $16 USD, the variant quickly begins encrypting the local environment and attempts to steal login credentials for several China-based online services. Fortunately, Tencent banned the QR code being used to send ransom payments and disabled the account tied to it.

Nearly 100 Million Users Compromised in Quora Breach

Servers containing sensitive information for nearly 100 million Quora.comusers were recently compromised by unknown hackers. In addition to personal information about users, any posts or messages sent over the service were also breached. While informing affected users of the leak, Quora stated that all password data they store was fully encrypted using bcrypt, which makes it considerably more expensive and time-consuming for the hackers to break the algorithms and obtain the data. 

Marriott Hotels Breach Leaves Half a Billion Users Vulnerable

In one of the largest data breaches to date, Marriott International is under fire for exposing the personal data of nearly 500 million individuals. A class-action lawsuit has been filed against the hotel chain. For many victims, their names, home addresses, and even passport information was available on an unsecured server for nearly four years after the company merged with Starwood, whose reservation systems were already compromised.

The post Cyber News Rundown: WeChat Ransomware appeared first on Webroot Blog.

By

Introducing Microsoft 365 freelance toolkit—a solution to launch and scale your freelance workforce

Microsoft 365 freelance toolkit is a curated set of tools, templates, and best practices to help our customers launch, execute, and manage freelance programs at scale.

The post Introducing Microsoft 365 freelance toolkit—a solution to launch and scale your freelance workforce appeared first on Microsoft 365 Blog.