On May 25, 2018, the General Data Protection Regulation (GDPR) of the European Union became operational (Hoofnagle et al., 2019). The General Data Protection Regulation (GDPR) establishes stringent regulations for collecting, using, and protecting personal data. It offers individuals the right to know what personal data is being collected about them, the right to have that data erased, and the right to object to using that data (Hoofnagle et al., 2019). Moreover, it gives individuals the right to have such data deleted. The General Data Protection Regulation (GDPR) applies to any organization, regardless of its physical location, that manages the personal information of EU residents.
The principles of privacy guide the European Union’s approach to privacy by design and the right to be forgotten. Privacy by design means that privacy should be built into all aspects of an organization’s operations (Intersoft Consulting, 2018). Thus this includes ensuring that personal data is only collected for specific, legitimate purposes and is kept secure. Privacy by design is the concept that privacy should be built into the design of products and services from the ground up rather than being added on as an afterthought. The right to be forgotten is the right of individuals to have their data erased under certain circumstances. Personal data should be erased when information is not required for original processing (Intersoft Consulting, 2018). So this right will not be a guarantee where it is in collusion with the freedom of expression. Lastly, the right to be informed is the right of individuals to be informed about the collection and use of their data for transparency (Intersoft Consulting, 2018). When data collection is done directly, the individuals should be informed about the time of storage and privileges of the information subject.
The EU’s approach to privacy is significant because it is one of the world’s most comprehensive and stringent regimes. The EU’s policy is also practical because it influences the development of international privacy standards. There are different practices that Red Clay Renovations could do in order better to protect the privacy of their customers and employees. One suggestion would be to have a clear and concise privacy policy that is easily accessible to everyone (Hoofnagle et al., 2019). So this policy should outline what information is being collected and how it will be used. Customers and employees should be able to opt-out of having their information collected. Another suggestion would be to encrypt all sensitive data (Hoofnagle et al., 2019). Thus this includes customer credit card information, social security numbers, and other personal information that could be used for identity theft. Red Clay Renovations should also consider encrypting all company emails to prevent sensitive information from being intercepted. So this will help protect data in transit and at rest. Another proposal would be to limit access to sensitive data.
Only employees who are authorized to access this information should be given access. A system should also be to track who accesses what data and when. I suggest the Red Clay Renovations institute regular security audits (Markopoulou et al., 2019). These audits should check for system vulnerabilities and identify areas where improvements need to be made. The other proposal which should be critical is to keep up to date with privacy laws and regulations (Markopoulou et al., 2019). So this includes EU privacy laws and regulations. Red Clay Renovations should have a process in place for regularly reviewing and updating the privacy policy in line with any changes in the law.
References
Intersoft Consulting. (2018). Key Issues. General Data Protection Regulation (GDPR). https://gdpr-info.eu/issues/
Hoofnagle, C. J., van der Sloot, B., & Borgesius, F. Z. (2019). The European Union general data protection regulation: what it is and what it means. Information & Communications Technology Law, 28(1), 65–98. https://doi.org/10.1080/13600834.2019.1573501
Markopoulou, D., Papakonstantinou, V., & De Hert, P. (2019). The NIS Directive, ENISA’s role, and the General Data Protection Regulation are the new EU cybersecurity framework. Computer Law & Security Review, 35(6), 105336.
write