{"id":12574,"date":"2018-06-14T08:30:06","date_gmt":"2018-06-14T16:30:06","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2018\/06\/14\/news-6343\/"},"modified":"2018-06-14T08:30:06","modified_gmt":"2018-06-14T16:30:06","slug":"news-6343","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/06\/14\/news-6343\/","title":{"rendered":"Is your company part of the GDPR 'mobile loophole'?"},"content":{"rendered":"

<\/p>\n

Credit to Author: Jack Gold| Date: Thu, 14 Jun 2018 08:13:00 -0700<\/strong><\/p>\n

Mobile tech, and especially mobile brought into companies through BYOD, has unique challenges for companies that need to comply with General Data Protection Regulations (GDPR<\/a>) \u2014 and that\u2019s virtually all companies, not just the ones in Europe. The regulations compel companies to manage personal data and protect privacy, and they provide individuals to have a say in what and how data about them is used.<\/p>\n

GDPR has several disclosure and control requirements, such as providing notice of any personally identifiable data collection, notifying of any data breaches, obtaining consent of any person for whom data is being collected, recording what and how data is being used, and providing a right for people whose data is being collected to see, modify, and\/or delete any information about them from corporate systems.<\/p>\n

The problem is many corporate systems now extend into mobile branches that include smartphones and, in some cases, tablets. Analysts at J.Gold Associates, LLC.\u00a0estimate that in about 35 to 50 percent of cases, these devices are not actually corporate devices, but personal devices being used by employees of the company in their daily work. As a result, these devices, which often contain corporate data from being connected\/synced to back office systems, and including data about individuals, are subject to the same regulations and restrictions of GDPR as larger systems (e.g., PCs and servers). (Note: I am the principal analyst at\u00a0J.Gold Associates.)<\/em><\/p>\n

GDPR also applies to any corporate-developed apps that have been deployed to mobile devices. Apps such as CRM, sales force automation, marketing and sales, and customer service are all potentially affected by GDPR.<\/p>\n

We estimate that 65 to 75 percent of enterprises do not have a full management suite available on mobile devices that can set appropriate policies and monitor data use and data flow, all of which is necessary to comply with GDPR. Moreover, our research shows the vast majority of companies indicate they can\u2019t say with certainty what\u2019s actually on a user\u2019s mobile device. This is a direct challenge to GDPR compliance.<\/p>\n

This mobile \u201cloophole\u201d in GDPR compliance is not often discussed. Yet the ability for employees to store and potentially share individual data about business partners and customers represents a real possibility that companies that thought they were compliant may not be.<\/p>\n

This is a new area just starting to be recognized by many enterprises, and I expect that next couple of years we\u2019ll see fairly lax enforcement by the authorities as many kinks are worked out in what\/how non-compliance is determined, pursued and penalized. Yet there is still a very real threat that enforcement could become stringent, particularly if it is shown that a data breach or other misuse of data has occurred.<\/p>\n

Data breaches of mobile devices can be particularly problematic, as so few enterprises actually know if their mobile devices (or BYOD smartphones) have been breached. Indeed, our research shows that 65 percent of companies either believe their mobile devices have never been hacked or don\u2019t know if they\u2019ve been breached. Given that 50 to 65 percent of users answer yes when asked if they have ever experienced a data breach on their mobile devices, it\u2019s clear there is a major shortcoming in enterprise knowledge and management of mobile security.<\/p>\n

What should enterprises subject to GDPR do about mobile? First and foremost, treat mobile devices as the corporate data repositories that they are. Many employees have corporate data on their devices, whether in apps or in personal data bases.<\/p>\n

Next, create a policy around mobile corporate data. This needs to be as comprehensive as, and an extension of, the general GDPR strategy of the company. Finally, once realized, this policy needs to be fully implemented and monitored by the use of capable mobile management tools.<\/p>\n

With relatively few companies deploying a full suite of EMM tools<\/a> that could make this transition possible, it\u2019s likely not many companies currently can become fully mobile compliant without making some significant technology investments. And while specialized “protected” areas like Samsung Knox and Google for Work help to secure data, that may not be enough without the additional EMM management capabilities.<\/p>\n

Given the potential penalties imposed (up to 4 percent of corporate revenues per incident), it\u2019s imperative that companies evaluate the threats to compliance posed by the plethora of mobile devices and users and take the necessary steps now to bring them into compliance.<\/p>\n

http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

Credit to Author: Jack Gold| Date: Thu, 14 Jun 2018 08:13:00 -0700<\/strong><\/p>\n

\n
\n

Mobile tech, and especially mobile brought into companies through BYOD, has unique challenges for companies that need to comply with General Data Protection Regulations (GDPR<\/a>) \u2014 and that\u2019s virtually all companies, not just the ones in Europe. The regulations compel companies to manage personal data and protect privacy, and they provide individuals to have a say in what and how data about them is used.<\/p>\n

GDPR has several disclosure and control requirements, such as providing notice of any personally identifiable data collection, notifying of any data breaches, obtaining consent of any person for whom data is being collected, recording what and how data is being used, and providing a right for people whose data is being collected to see, modify, and\/or delete any information about them from corporate systems.<\/p>\n

To read this article in full, please click here<\/a><\/p>\n<\/section>\n<\/article>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[11062,10643],"tags":[10554,5897,714],"class_list":["post-12574","post","type-post","status-publish","format-standard","hentry","category-computerworld","category-independent","tag-mobile","tag-privacy","tag-security"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/12574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=12574"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/12574\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=12574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=12574"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=12574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}