安全人需要知道的GDPR
大家可能已經(jīng)聽說過GDPR的新法律，又稱“通用數(shù)據(jù)保護條例”。該法律由歐盟制定并在2018年5月25日生效。它適用于任何處理歐盟（EU）居民個人信息的組織，無論這個組織在世界的哪個地方。其中，GDPR要求組織維護任何歐盟居民個人信息的隱私和安全。為確保符合GDPR，理解和實施一些關(guān)鍵原則也是必要的。
You may have heard of a new law called GDPR, or the General Data Protection Regulation. This law was developed by the European Union and takes effect 25 May 2018. It applies to any organization that handles the personal information of any resident in the European Union (EU), regardless of where in the world that organization is located. GDPR requires organizations to maintain the privacy and security of any EU resident’s personal information. To ensure compliance with GDPR, some key principles need to be understood and implemented.
人們有隱私權(quán)。組織需要通過限制他們收集和處理的個人數(shù)據(jù)并保護這些數(shù)據(jù)來尊重他們的隱私。隱私義務(wù)適用于任何信息，不論是單獨使用還是與其他信息一起使用，都可以識別生活在歐盟的個人。這些信息可以是地址，護照號碼，駕駛執(zhí)照號碼，財務(wù)詳情，生物識別信息，工會會員資格，醫(yī)療史，位置數(shù)據(jù)，性別，宗教或政治取向有關(guān)的信息。該規(guī)定適用于“自然人”，即有生命的個人。以下是應(yīng)該遵循的GDPR的一些主要原則：
People have a right to privacy.Organizations need to respect their privacy by restricting what personal data they collect and process and by safeguarding that data. Privacy obligations apply to any information, either by itself or used with other pieces of information, that could identify an individual person living in the European Union. This information could be items such as addresses, passport numbers,driver’s license numbers, financial details,biometrics,union memberships,medical history, location data, or information relating to a person’s sexual,religious, or political orientation. The regulation applies to a ‘natural person,’ meaning a living individual. Here are some of the main tenets of GDPR that should be followed:
-
個人資料應(yīng)以合法，公正和透明的方式處理。
-
人們需要被告知正在收集什么信息以及為了什么目的而收集。
-
個人數(shù)據(jù)應(yīng)按指定的，明確的和合法的目的收集。它不得用于與這些目的相沖突的其他任何原因。
-
個人資料只有在需要時才能保存和處理，并且不超過此時間。
-
個人資料必須保持最新和準確。
-
人們有權(quán)收到其數(shù)據(jù)副本，或者可以要求不再使用他們的個人數(shù)據(jù)。在某些情況下，他們可以完全刪除它。
-
組織必須采取適當?shù)陌踩胧﹣肀Ｗo個人數(shù)據(jù)免受意外或不當影響而導(dǎo)致數(shù)據(jù)的非法破壞，遺失，變更或披露。
-
此外，組織需要確保所有處理個人數(shù)據(jù)的工作人員都經(jīng)過適當?shù)呐嘤?xùn)知道如何保護這些數(shù)據(jù)。
-
Personal data for individuals shall be processed lawfully, fairly, and in a transparent manner.
-
People need to be told what is being collected and for what purpose.
-
Personal data shall be collected for specified, explicit, and legitimate purposes. It shall not be used for any other reasons that conflict with these purposes.
-
Personal data shall only be kept and processed for as long as it is required for that purpose and for no longer than that.
-
Personal data must be kept up-to-date and accurate.
保護個人數(shù)據(jù)的措施必須確保適當?shù)乃絹肀Ｕ蠑?shù)據(jù)的敏感性。由于與數(shù)據(jù)相關(guān)的風(fēng)險變得更大，所以應(yīng)該花費更多的努力和措施來保護數(shù)據(jù)。這些措施也應(yīng)該進行定期審查并適時更新。有關(guān)于隱私和安全決議的記錄有助于合規(guī)。
The protection measures that are in place to secure personal data must ensure a level of protection appropriate to the sensitive nature of the data. As the risk associated with data becomes greater, so should the effort and expense of measures to protect the data.These measures should be regularly reviewed and updated as appropriate.Well-documented records about privacy and security decisions and measures help to show compliance with the requirements.
此外，當數(shù)據(jù)轉(zhuǎn)移給外部第三方或歐盟以外的各方時，組織在法律上必須采取合同和盡職調(diào)查等措施來保護個人。最后，在個人數(shù)據(jù)泄露的情況下，組織應(yīng)該在知悉后72小時內(nèi)報告違規(guī)行為。組織未能遵守GDPR可能導(dǎo)致高達其全球收入的4％的罰款，這也使得GDPR成為財務(wù)成本最高的全球法規(guī)之一。
In addition, organizations are legally bound to employ measures, such as contracts and due diligence reviews,to protect personal data when transferring it to external third parties or parties outside the European Union. Finally, in the case of a personal data breach, organizations shall report the breach within 72 hours after becoming aware of it. Failure for organizations to comply with GDPR can result in fines up to 4% of their global revenue, making GDPR one of the most financially costly global regulations in the world.