Technology insight
On 27 June, the CIPP held the first of a series of roundtables to discuss the implications for the industry of the impending implementation of the European Union General Data Protection Regulation (GDPR). The roundtable was held in the CIPP’s boardroom at Goldfinger House, Solihull GDPR roundtable report
Participants Noreen Begg, Omni Cyber Security Nick Carlson , interim Associate Director of Marketing, CIPP (covering Vickie Graham on maternity leave) Andy Collins , managing director, Omni Cyber Security Suzanne Gallagher, head of operations for the payroll bureau, Armstrong Watson Simon Garrity , business development manager and sales manager, CIPP Elaine Gibson , educational director, CIPP Julie Lock , service development director, MHR Mike Nicholas , editor, Professional in Payroll, Pensions and Reward Ken Pullar, chief executive officer, CIPP Jacqueline Raison , company secretary, SD Worx UK Graeme Walker, HCM compliance product manager, Advanced Computer Software Claire Wright, quality and data protection officer, MHR Ken opened the discussions explaining why the CIPP was holding the roundtable. Following introductions, the attendees explained their role in data protection issues for their employer and clients, and their concerns about the GDPR, and set out their hopes and aims going forward from this initial meeting. Graeme Walker explained that ACS have many different products and we’re looking at how GDPR affects them. We need to see what we have to do, how much responsibility lies with us, the software supplier, and how much with the customer. There’s not a lot out there relating to the software company, most of it is about the customer. Julie said that the big part of what we
need to do is somehow help, educate, nurture and direct organisations to GDPR readiness. MHR did a survey to understand GDPR readiness within our client base and on the back of that picked the phone up to the CIPP. We’re happy to share all the results because there is a big problem around the corner and we need just make people aware. Claire observed that data privacy is not a regulated industry, so it’s not taken seriously. MHR needs to understand what GDPR means to their product but, more clearly, as a controller or a processor, what are our responsibilities. That’s something we’re working with the Information Commissioner’s Office (ICO) on as well, to seek some more clarification. And obviously to ensure MHR are compliant as well, so responsible for our policies, procedure and processes. Andy Collins explained that though there are some additional responsibilities under GDPR companies that already have good data protection policies and procedures in place now are not a million miles away from the GDPR requirements. Organisations must start somewhere with this and it’s going to be an ongoing process but if they can get to a point where, in my view, they’ve satisfied the outlines of the standard then, I think, they’re in a better place than most. Noreen revealed her technical background, having diverted to compliance. Quite a few customers are enquiring about GDPR. Suzanne said that with 1,500 payrolls GDPR is a real headache for her and some clarity would be welcome. It’s a case of what does this mean to my day to day operations within the bureau. I almost need a set of guidelines and rules that if I
follow these and tick that box then I’m clear and happy. That’s what I’m looking for. Jacqueline revealed that Recital 77 of the GDPR suggests that a bunch of interested people could get together as a trade association and could work with the supervisory authorities to create a code of conduct. That code could say this is human resources’ (HR’s) and payroll’s answer to what the following two undefined terms of the GDPR mean: ‘state of the art’ and ‘appropriate organisational and technical measures’. Jacqueline’s particular goal is to get together a group of like-minded people who could go and talk to one of the supervisory authorities potentially with writing a code of conduct for the industry. It was noted that ICO has developed a code of conduct which the industry could piggy-back or take over to represent the profession of payroll and HR because of the way they’re interlinked. The following topics and issues were identified as suitable for inclusion in the code of conduct: ● Objectives of the code of conduct ● Definition of the GDPR ● Scope / status of GDPR (e.g. national laws) ● Data subject rights (e.g. right to be forgotten) ● Gap analysis ● Data retention ● Consent processing ● Privacy by design ● Portability issues. Concerns about what GDPR might mean for potential and existing contracts were discussed. Would customers only renew or sign up with providers that can give unlimited liability under the GDPR even though they might not have the financial backing? Q
51
| Professional in Payroll, Pensions and Reward |
Issue 34 | October 2017
Made with FlippingBook Online newsletter