documentation

A quick walk-through of the new ISO29184 – Online Privacy notices and consent

Source and download: https://www.iso.org/standard/70331.html

With the publication of the GDPR in 2016, it quickly became clear that it would massively impact the direct marketing sector, simply because direct marketing runs on personal data.

On 25 may 2018, the GDPR came into force, changing the global mindset on data protection (and privacy by extension).

Anno 2020, 2 years after the publication, many enterprises, large and small still struggle to apply the data protection regulation and best practices.

And for the direct marketing companies, this is a particular difficult topic, after 4 years.

So, maybe, the newly (june 2020) published standard can provide a practical help to implement consent management. Please remind that the GDPR is a regulation/law… not a best practice with hints and tips.

For hints & tips and practical advice on GDPR, check the EDPB (previously known as WP29) website: https://edpb.europa.eu/our-work-tools/general-guidance_en (Check the Our Work & Tools menu).

While there has been a lot of guidance, communication & education on implementing a direct marketing that is compliant with GDPR and ePrivacy/eCommunication regulation and directives.

Even, for other markets than direct marketing where managing personal data is optional (meaning, not part of core business), you can use this guide to manage privacy or data protection notices for your newsletters and website.

Side note

The ISO 29184 is strictly and only about privacy notices and consent, it’s not an in depth guide for direct marketing, but it’s an essential part of it.

If you need more information on the EU ePrivacy/eCommunications directive , see here: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32002L0058

ISO 29184 content walk through

Document structure

After the mandatory basic chapters (Foreword, 1. Scope), the document hints to ISO 29100 in chapter 2 (Normative References) and 3. (Terms and definitions.

Important note here is that the definition of “explicit consent” has been updated to match the GDPR requirement for unambiguous affirmative consent.

Chapter 5 contains the “general requirements and recommendations”.

A major requirement (and typical for ISO compliance like in ISO9001 and ISO27001) is that you need to document the implementation of each control in this standard.

The content is structured in 5 chapters (Level 2)

  1. Overall objective
  2. Notice
  3. Contents of notice
  4. Consent
  5. Change of conditions

To read the full details, you know what to do,…

But it’s interesting to see the technical/operations controls required in this standard

General conditions on privacy notice

  • Provide information to all interested parties about your privacy practices, including
    • the identity and registered address of the data controller, and
    • contact points where the subject (in this standard the subject is called “PII principal”)
  • Provide clear and easy to understand information
    • with regards the target audience,
    • which are usually NOT lawyers or data protection specialists),
    • taking care of the expected language of your audience
  • You must determine and document the appropriate time for providing notice
    • Remember the Art. 13 and Art 14 definitions in GDPR
    • By preference, you should notify the subject immediately before collecting PII (and/or consent)
  • You must provide notices in a appropriate way
    • by preference in more than 1 way,
    • to make sure the subject can find and consult the notices,
    • digitally and in a easy accessible method
    • also after initial contact
    • As also defined in many GDPR guidelines, the consent standard refers to a multilayer approach (avoiding to provide too much information at the same time, but provide the details when needed)
  • Make sure that the privacy notice is accessible all the time.

Notice content

  • make sure you’re absolutely clear, honest and transparent about your personal data processing
  • Define, document and describe clearly
    • the processing purpose
    • each element of the processing (remember the processing definitions defined in Art. 4 of GDPR)
    • the identification of the data controller
    • the data collection details, incl
      • methods used
      • details of data collected
      • type of collection (direct, indirect, observation, inference…)
      • timing and location of collection
    • use of data, including
      • direct use without data transformation
      • reprocessing data
      • combining, like enrichment
      • automated decision making
      • transfer of data to 3rd party
      • data retention (incl backup)
    • data subject rights
      • access request
      • authentication to provide access
      • timelines
      • any fees that apply
      • how to revoke consent
      • how to file a compliant
      • how to submit a inquiry
    • Evidence about consent provided (and changed) by the subject
    • the legal basis for processing PII/personal data
    • the risks related with the data and the plausible impact to the subject privacy

Consent management

  • Identify if whether consent is appropriate
    • Remember that there are other purposes and reasons for processing data, which usually have a more stable, more solid background, like
      • contracts
      • compliance with legal obligations and regulations
      • vital interest,
      • public interest
      • (legitimate interest, which is usually way more difficult to enforce or to convince the subject)
    • Informed and freely given consent
      • how do you guarantee that the subject is providing consent without any feeling of coercing, force, conditions, …
      • Independence from other processing or consent
        • Remember the GDPR guidelines where you CANNOT force consent as
    • Inform the subject which account this processing is related to
      • provide a clear description of the identifier (userID, mail, login, …)

ISO29184 also introduces the consent lifecycle, meaning that is it’s not sufficient to provide notice at first contact with the subject, but you also need to maintain, to update and to renew it on a regular basis, taking into account that the conditions of consent might change (or might have changed after initial consent).

The last part of the ISO 29184 are annexes with interesting user interface examples.

The perfect document set

To make the online privacy and consent management work, this ISO/IEC 29184 will not do on itself as the standard links to the following documents:

  • (FREE, EN – FR) ISO 27000: ISMS vocabulary
  • (*) ISO27001: ISMS, Information Security Management Systems
  • (*) ISO27002: Code of practice for ISO 27001)
  • ISO27701: PIMS, Privacy Information Management System, the privacy or data protection extension of ISO27001
  • (FREE, EN – FR) ISO29100: Privacy framework
  • ISO29151: Code of Practices – Privacy Framework (the ISO27002 version of ISO29100)
  • ISO29134: PIA, Privacy Impact Assessment (foundation of the DPIA in GDPR)

References

Free downloads

ISO Public documents: https://ffwd2.me/FreeISO

If not available for free download, then you’ll need to purchase the ISO standards documents from the ISO e-shop or from the national standards organisation (like NBN for Belgium, NEN for Netherlands, …)

Visio – PDCA cycle graphics (EN, FR, NL)

This visio has a editable version of the PDCA cycle hosted on Wiki pedia as image.

Source: https://en.wikipedia.org/wiki/PDCA

Text is available under the Creative Commons Attribution-ShareAlike License  this license applies to this work too.

Quoted from source:

PDCA (plan–do–check–act or plan–do–check–adjust) is an iterative four-step management method used in business for the control and continuous improvement of processes and products.[1] It is also known as the Deming circle/cycle/wheel, the Shewhart cycle, the control circle/cycle, or plan–do–study–act (PDSA). Another version of this PDCA cycle is OPDCA.[2] The added “O” stands for observation or as some versions say: “Observe the current condition.” This emphasis on observation and current condition has currency with the literature on lean manufacturing and the Toyota Production System.[3] The PDCA cycle, with Ishikawa’s changes, can be traced back to S. Mizuno of the Tokyo Institute of Technology in 1959.[4]  

Download available on my Github library: Visio – PDCA cycle graphics

Note-to-self: MNM van KSZ (Minimale normen – Sociale Zekerheid)

Minimale Normen / Normes Minimales van de KSZ (Kruispuntbank van de Sociale Zekerheid) gebaseerd op de ISO27001/ISO27002

“De toepassing van de minimale normen informatieveiligheid en privacy is verplicht voor instellingen van sociale zekerheid overeenkomstig artikel 2, eerste lid, 2° van de wet van 15 januari 1990 houdende oprichting en organisatie van een Kruispuntbank van de Sociale Zekerheid (KSZ). Bovendien moeten de minimale normen informatieveiligheid en privacy eveneens toegepast worden door alle organisaties die deel uitmaken van het netwerk van de sociale zekerheid overeenkomstig artikel 18 van deze wet. Tenslotte kan het sectoraal comité van de sociale zekerheid en van de gezondheid de naleving van de minimale normen informatieveiligheid en privacy ook opleggen aan andere instanties dan de hogervermelde.  ”

Bookmark:

(NL) https://www.ksz-bcss.fgov.be/nl/gegevensbescherming/informatieveiligheidsbeleid

(FR) https://www.ksz-bcss.fgov.be/fr/protection-des-donnees/politique-de-securite-de-linformation

(edit)

Opmerking: voor alle duidelijkheid, op zich zijn deze documenten geen nieuwigheid maar buiten de SZ zijn deze normen minder gekend… vandaar dat het toch nuttig is om ze bij te houden als geheugensteun en referentie. Je komt er sneller mee in contact als je denkt…

Useful resources for GDPR starters

I realise, this braindump will never be finished, so come back once in a while to check for updates. Work in progress…

But let’s turn around the thing a bit, you certainly must have smart ideas or articles on GDPR for starters that belong on this list! Let me know and I’ll add it to the list.
Of course, with the proper credits!

DISCLAIMER: These resources are provided / authored by different people, companies, vendors, each of them copyrighted by the original owner.
The resources below are just a collection or interesting documentation, need to have, without any preference or commercial interest for any party.

Table of contents

First of all, before you start with GDPR you must have read the GDPR text.
It’s not as bad (you mean: legalese) as you might suspect.

GDPR official text

You might want to have it a bit more condensed to start.

Vocabulary / Grammar

Do not get confused: European Council vs Council of the European Union vs Council of Europe

More info at:

http://www.caneurope.org/publications/blogs/1295-what-is-the-european-council-or-the-council-of-the-european-union%C2%A0

https://www.coe.int/en/web/about-us/do-not-get-confused

GDPR Table of contents

Once you get through the legal texts… you’ll quickly understand that the GDPR text itself at least lacks 1 important thing: A table of contents (TOC).

This TOC by Intersoft Consulting might help: bookmark https://gdpr-info.eu/

It provides a nice overview of the GDPR Recitals (= reasons the articles of the GDPR have been adopted).

There are 173 recitals, the and the TOC provides a quick topic overview at https://gdpr-info.eu/recitals/.

Also the site provides an overview of the GDPR structure

  • 11 Chapters
  • Sections per chapter
  • 99 Articles (spread over sections / chapters

GDPR Library by EC

https://ec.europa.eu/commission/priorities/justice-and-fundamental-rights/data-protection/2018-reform-eu-data-protection-rules_en

GDPR Adequacy decisions

Working Party 29

http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:31995L0046

“The composition and purpose of Art. 29 WP was set out in Article 29 of the Data Protection Directive, and it was launched in 1996.”

https://en.wikipedia.org/wiki/Article_29_Data_Protection_Working_Party

The European Data Protection Board (EDPB) will replace the Article 29 Working Party under the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

WP29 articles

Newsroom overview: http://ec.europa.eu/newsroom/article29/news.cfm
Guidelines: http://ec.europa.eu/newsroom/article29/news.cfm?item_type=1360

WP 29 Advisory

The Article 29 Working Party Issues Final Guidelines on Data Protection Officers (“DPO”) is available here.

More info

  • Bird & Bird article, explaining
    1. Accountability means that DPO assessments need to be kept up-to-date and can be requested at anytime
    2. No “a la carte” DPO appointments
    3. Big data now an example of ‘regular and systematic monitoring’
    4. Preferably, the DPO should be located within this EU
    5. There can only be one DPO, but supported by a team
    6. Duty to ensure the confidentiality of communications between the DPO and employees
    7. Senior managers including Head of HR, Marketing or IT individuals are barred from serving as the DPO
    8. The GDPR does not prevent the DPO from maintaining records of processing
  • For a redline comparison with the earlier draft, click here.

ISO Standards related to GDPR

ISO29100 (Privacy Framework)

PIA: ISO 29134

Get the ISO29100 privacy standard for free at:

http://standards.iso.org/ittf/PubliclyAvailableStandards/c045123_ISO_IEC_29100_2011.zip

ISO27001 (Information Security)

Mandatory ISO27001 documents: ISMS mandatory documentation checklist

Mapping GDPR to ISO27001 schema

Implementing GDPR with ISO27001

https://pecb.com/oldwebinar/26-may-2018-from-gdpr-to-sustainable-gdp

GDPR at a glance

https://www.twobirds.com/~/media/pdfs/gdpr-pdfs/bird–bird–guide-to-the-general-data-protection-regulation.pdf (Credits for Moritz Anders).

Data access request

As published on LinkedIn: The Nightmare Letter: A Subject Access Request under GDPR (By: Constantine Karbaliotis)

You can download the docx Word version in EN (here) and in NL translated version (here).

Useful Tools

Open Source

Monarc – Risk Assessment: http://Monarc.lu

CNIL – DPIA Tool 

CNIL guides for PIA: https://www.cnil.fr/en/PIA-privacy-impact-assessment-en

Implementation Guidance

Visualisation sheet

Have a look what Jonas Holdensen has published, a marvelous sheet to provide a visualization on GDPR.

Also he has provided a nice overview on the DPO requirements & tasks under GDPR.

If you prefer the file in pdf or word, then download the file here: www.kortlink.dk/rhpx

GDPR Privacy Courses (work in progress)

Region Provider Course URL
WW IAPP CIPT, CIPP/E, CIPM, https://iapp.org/train/gdprready/
WW PECB PECB Certified Data protection Officer https://pecb.com/en/education-and-certification-for-individuals/gdpr
BE DP Institute Data Protection Officer Certificatie Training https://www.dp-institute.eu/nl/opleidingen/
WW IT Governance GDPR https://www.itgovernance.co.uk/data-protection-dpa-and-eu-data-protection-regulation
WW Cranium GDPR & Privacy

And some more

Legislative background

 

Note-to-self: ISO27001 & ISO27002 downloads & tools

Just a quick note if you are looking in to ISO27001 documents, to implement IT security in a best-practices-way, bookmark these:

ISO27001 specific material

BTW: there is a very interesting GDPR-ISO27001 mapping example/exercise published on the ISO27001Security.com website: GDPR-ISO27k mapping

And as a surplus, have a read of the PCI-DSS, aka the ISO27001 for Banks

Check the free download section of the ISO standards organization at: ffwd2.me/FreeISO

Note-to-self: DNS naming best practices for internal domains and networks

Just a few days ago, I’ve got a question from a customer regarding the DNS naming best practices for internal DNS and AD domains…

As it’s not a daily job to setup a new AD domain and internal DNS (from scratch…), so it might help to share the results of my investigation, that have lead to confirm my practical experiences.

Apparently it’s a pretty frequent topic on AD and network platforms. Plus there are some strict technical guidelines that apply here, even for internal DNS configurations…

The short answer, as best practice:

  • Microsoft strongly recommends to register a public domain and use subdomains for the internal DNS.
  • So, register a public DNS name , so you own it. Then create subdomains for internal use (like corp.pgeelen.be, dmz.pgeelen.be, extranet.pgeelen.be) and make sure you’ve got your DNS configuration setup correctly.

Below more detailed explanation. Luckily enough there is some nice reading material out there to prove the statement, so make sure you bookmark this page 😉

But first we need to clarify a few things…

AD Domain vs DNS name

The AD domain name is NOT the same as the DNS name, but they are linked.

AD Domain names are mainly used within AD operations, mostly LDAP queries for AD functionality, while DNS is rather a network level solution for name resolution on IP level (to solve the machines or application names to IP addresses).

Essentialy this difference allows you to use a ‘internal’, private AD domain name and use a public, registered DNS name.

When you look into discussions and documentation on this topic, you’ll also see that the AD domain short name is referred as NetBIOS Name (as in the AD logon name <DOMAIN>\<username>).

For example

  • AD Domain name: CORP
  • DNS name: corp.pgeelen.be

See here for more explanation: https://technet.microsoft.com/en-us/library/bb676377

You can also ‘unlink’ the AD domain name from the DNS name, then you get a disjoint namespace, as explained in previous link.

For Example

  • AD Domain naam : CORP
  • DNS naam: intranet.pgeelen.be

Check this forum discussion: https://social.technet.microsoft.com/Forums/windowsserver/en-US/f6ac34e8-4b35-4c3b-a60f-179f68d6eb24/ad-domain-name-vs-dns-domain-name?forum=winserverDS

And also: https://technet.microsoft.com/en-us/library/cc978018.aspx

Dummy DNS name vs official DNS name

In the past, lots of people chose to use a dummy, unofficial TLD (top-level-domain) for their internal network, likedomain.lan, domain.local of domain.internal (and also domain.internalhost)

But this can get you in serious trouble.

Because these names are not supported by internet standards, the most important RFC on this is: RFC 2606 (http://tools.ietf.org/html/rfc2606)

This RFC standard is very explicit on chosing domain names for voor private testing and documentation

  • .test
  • .example
  • .invalid
  • .localhost

But also for documentation some 2nd level domains are reserved

  • example.com
  • example.net
  • example.org

As you can see, these names are created for testing and not for production.

Plus, if the public naming standards change or additional names are released you might be using a name you don’t own and that can be routed to the internet, which conflicts with the initial use.

Therefore the technical conclusion is fairly straight forward: register a public DNS name and use it for your internal DNS resolution.

So the use of <yourinternaldomain>.be is technically correct but it doesn’t stop there.

There are some important consequences.

Allow me to take the discussion a step further.

You have to make a choice on the DNS zones:

  • using a single DNS zone
  • Using subdomains
  • using different DNS zones

 

Using a single namespace (for internal and external hosts)

Some customers use the same DNS zone for internal and external usage. But there are some important disadvantages:

  • mismatch between security zones (like intranet, extranet, dmz and) and DNS naming
  • when adding / merging domains the DNS is subject to redesign
  • less flexible, less automated DNS operations
  • conflict in authority with internal DNS and external DNS (managed by internet provider)

You might face some practical issues like:

  • conflicts in DNS,
  • instable operations and sub-optimal performance
  • network issues
  • complex configuration
  • less or no automated DNS operations, more manual operations
  • keeping DNS under control is less obvious

Plus, you’ll face some consequences regarding network security, by the lack of segregation of (DNS) duties.

So: Single DNS domain is absolutely not advised.

Using different DNS names and zones

It’s completely the opposite of the previous approach. From DNS level, this is fairly simple setup, but you need to duplicate or multiply DNS configurations. And from a user perspective it might be complex or confusing, or not transparent, and inconsistent

DNS sub-domains

This is a frequently used technique to use the same TLD (top level domain) and separate the zones by subdomain. Eg “intranet”, “extranet”, “DMZ” for ‘internal’ zones en just plain <domain>.<tld> for public DNS.

For example:

  • intranet.pgeelen.be or corp.pgeelen.be (if your AD is named ‘CORP’ )
  • extranet.pgeelen.be for applications or partner facing websites
  • DMZ.pgeelen.be for applications that need DMZ for data protection or publication,
  • and master suffix .pgeelen.be for public websites (managed by your Internet Provider)

The forum post I mentioned earlier discusses a technique called “DNS split brain”:

In fact you have one DNS name space, but with sub spaces per zone.

This is a bit more complicated setup as you need to make sure the DNS servers forward the requests to the applicable zones correctly.

And it does require some planning and cooperation with your internet provider.

Microsoft strongly suggests to work with subdomains, within a publicly registered TLD domain.

Check: Creating Internal and External Domains op https://technet.microsoft.com/en-us/library/cc755946(WS.10).aspx

Design Option Management Complexity Example
The internal domain is a subdomain of the external domain. Microsoft strongly recommends this option. For more information, see Using an Internal Subdomain. Easy to deploy and administer. An organization with an external namespace contoso.com uses the internal namespace corp.contoso.com.
The internal and external domain names are different from each other. For more information, see Using Different Internal and External Domain Names. More complicated than previous option. An organization uses contoso.com for its external namespace, and corp.internal for its internal namespace.

 

On top of that you need to be aware of a few rules regarding naming standards: https://support.microsoft.com/en-us/kb/909264

 

To conclude, please find some useful reference info in one spot below:

Note-to-self: #FIM2010 Stencils & icons

Source: https://social.technet.microsoft.com/Forums/en-US/7a7b3df0-35d1-48a5-9577-e2c435b39128/how-to-become-a-fimster?forum=ilm2

As mentioned by Ross Currie, you need a shortcut to this, as you keep losing this little gem…

https://skydrive.live.com/?cid=b905f742cf6d28e2&id=B905F742CF6D28E2%21164

Announcing the public availability of the #MIMWAL for #MIM2016 project, now available as an Open Source Project on GitHub

Source: https://social.technet.microsoft.com/Forums/en-US/e613bbd9-5a2a-46c2-8d91-5f1e0116521b/announcing-the-public-availability-of-the-mimwal-project-now-available-as-an-open-source-project-on?forum=ilm2

Announcing the public availability of the MIMWAL project, now available as an Open Source Project on GitHub.

The MIMWAL is a Workflow Activity Library (WAL) for building complex workflows in the Microsoft Identity Manager (MIM) 2016 and Forefront Identity Manager (FIM) 2010 R2 solution.

The WAL is a powerful solution accelerator for MIM / FIM that provides foundational activities which can be combined to create complex workflows to implement business processes within a MIM / FIM solution simply by configuration instead of coding for days and months.

MIMWAL Features

  • Building-block Workflow Activities
  • Conditional Execution Capability for Building-block Activities
  • Support for Iteration Over a Collection of Values in Building-block Activities
  • Deep Resolution Capability for FIM Lookup Grammar
  • Rich Library of Workflow Functions
  • UI Framework for Building Additional Custom Workflow Activities
  • Support for ETW Event Tracing
  • Optimization of Update Requests
    • Combining multiple updates into a single request per resource per activity
    • Issuing update request only when resource is actually modified.

More information

Please visit the MIMWAL site at http://aka.ms/MIMWAL for information on project source code, releases and documentation, and discussion forums.

Please post any questions or discussions about the MIMWAL project on this forum, which can also be found at http://aka.ms/MIMWAL/Forum

MIMWAL Links

Note-to-Self: #MIM2016 online documentation is live

Just got the news that the MIM 2016 online documentation is published.

You can find the Microsoft Identity Manager 2016 Developer Reference at: http://aka.ms/mim2016devref

It contains:

On TechNet you can find the MIM 2016 Technical Library at:http://aka.ms/mim2016techref