安全人需要知道的GDPR
大家可能已經(jīng)聽(tīng)說(shuō)過(guò)GDPR的新法律，又稱(chēng)“通用數據保護條例”。該法律由歐盟制定并在2018年5月25日生效。它適用于任何處理歐盟（EU）居民個(gè)人信息的組織，無(wú)論這個(gè)組織在世界的哪個(gè)地方。其中，GDPR要求組織維護任何歐盟居民個(gè)人信息的隱私和安全。為確保符合GDPR，理解和實(shí)施一些關(guān)鍵原則也是必要的。
You may have heard of a new law called GDPR, or the General Data Protection Regulation. This law was developed by the European Union and takes effect 25 May 2018. It applies to any organization that handles the personal information of any resident in the European Union (EU), regardless of where in the world that organization is located. GDPR requires organizations to maintain the privacy and security of any EU resident’s personal information. To ensure compliance with GDPR, some key principles need to be understood and implemented.
人們有隱私權。組織需要通過(guò)限制他們收集和處理的個(gè)人數據并保護這些數據來(lái)尊重他們的隱私。隱私義務(wù)適用于任何信息，不論是單獨使用還是與其他信息一起使用，都可以識別生活在歐盟的個(gè)人。這些信息可以是地址，護照號碼，駕駛執照號碼，財務(wù)詳情，生物識別信息，工會(huì )會(huì )員資格，醫療史，位置數據，性別，宗教或政治取向有關(guān)的信息。該規定適用于“自然人”，即有生命的個(gè)人。以下是應該遵循的GDPR的一些主要原則：
People have a right to privacy.Organizations need to respect their privacy by restricting what personal data they collect and process and by safeguarding that data. Privacy obligations apply to any information, either by itself or used with other pieces of information, that could identify an individual person living in the European Union. This information could be items such as addresses, passport numbers,driver’s license numbers, financial details,biometrics,union memberships,medical history, location data, or information relating to a person’s sexual,religious, or political orientation. The regulation applies to a ‘natural person,’ meaning a living individual. Here are some of the main tenets of GDPR that should be followed:
-
個(gè)人資料應以合法，公正和透明的方式處理。
-
人們需要被告知正在收集什么信息以及為了什么目的而收集。
-
個(gè)人數據應按指定的，明確的和合法的目的收集。它不得用于與這些目的相沖突的其他任何原因。
-
個(gè)人資料只有在需要時(shí)才能保存和處理，并且不超過(guò)此時(shí)間。
-
個(gè)人資料必須保持最新和準確。
-
人們有權收到其數據副本，或者可以要求不再使用他們的個(gè)人數據。在某些情況下，他們可以完全刪除它。
-
組織必須采取適當的安全措施來(lái)保護個(gè)人數據免受意外或不當影響而導致數據的非法破壞，遺失，變更或披露。
-
此外，組織需要確保所有處理個(gè)人數據的工作人員都經(jīng)過(guò)適當的培訓知道如何保護這些數據。
-
Personal data for individuals shall be processed lawfully, fairly, and in a transparent manner.
-
People need to be told what is being collected and for what purpose.
-
Personal data shall be collected for specified, explicit, and legitimate purposes. It shall not be used for any other reasons that conflict with these purposes.
-
Personal data shall only be kept and processed for as long as it is required for that purpose and for no longer than that.
-
Personal data must be kept up-to-date and accurate.
保護個(gè)人數據的措施必須確保適當的水平來(lái)保障數據的敏感性。由于與數據相關(guān)的風(fēng)險變得更大，所以應該花費更多的努力和措施來(lái)保護數據。這些措施也應該進(jìn)行定期審查并適時(shí)更新。有關(guān)于隱私和安全決議的記錄有助于合規。
The protection measures that are in place to secure personal data must ensure a level of protection appropriate to the sensitive nature of the data. As the risk associated with data becomes greater, so should the effort and expense of measures to protect the data.These measures should be regularly reviewed and updated as appropriate.Well-documented records about privacy and security decisions and measures help to show compliance with the requirements.
此外，當數據轉移給外部第三方或歐盟以外的各方時(shí)，組織在法律上必須采取合同和盡職調查等措施來(lái)保護個(gè)人。最后，在個(gè)人數據泄露的情況下，組織應該在知悉后72小時(shí)內報告違規行為。組織未能遵守GDPR可能導致高達其全球收入的4％的罰款，這也使得GDPR成為財務(wù)成本最高的全球法規之一。
In addition, organizations are legally bound to employ measures, such as contracts and due diligence reviews,to protect personal data when transferring it to external third parties or parties outside the European Union. Finally, in the case of a personal data breach, organizations shall report the breach within 72 hours after becoming aware of it. Failure for organizations to comply with GDPR can result in fines up to 4% of their global revenue, making GDPR one of the most financially costly global regulations in the world.