Simon on: RefTech renews information security management certification

Event registration and badging systems provider RefTech has once again achieved certification to the internationally recognised ISO/IEC standard in information security management.

RefTech first achieved the standard in 2015 for a three year term. Following annual audits, the company has now been re-assessed and achieved the new upgraded 2017 certification.

Simon Clayton,  chief ideas officer, RefTech said: “Achieving this international standard is a great indication that a registration company has the technical and organisational security in place to be GDPR compliant. It is the only externally assessed certification in data security and it is only achieved as a result of a complex and demanding process. We believe that we are the only event registration and badging provider to achieve this standard in information security management throughout the company, not just on its servers.”

ISO 27001 is the internationally recognised information security management standard that proves an organisation’s commitment to the security of its customer, employee and shareholder’s information. With ISO 27001 in place, RefTech is able to minimise risks to potential data security breaches and reduce errors and costs, while demonstrating credibility and trust.

The benefits of certification to ISO 27001 include:

 Proving to clients an organisation keeps their information secure

 Achieve operational excellence

 Minimise risk of potential data security breaches

 Protects reputation

 Reduces errors and costs

 Increases business profitability

 Engage employees

This independent assessment was conducted by the British Assessment Bureau, a leading certification body, and confirms that the data security policies and procedures that RefTech use to handle client event data are robust and secure. RefTech first achieved this standard in 2015 and has conducted annual audits since then. This was its first re-assessment.

GDPR: a matter of consent

Since GDPR first hit the headlines there has been an awful lot of scaremongering and/or misunderstanding over the ‘consent’ part of the regulations. Many ‘experts’ claimed that a company needed specific consent from the individual for them to use their personal data but this simply isn’t true and I think it’s a lack of understanding of the full text of the regulations that is the problem here.

Read more: An introduction to GDPR

Article 6 of the GDPR Act clearly states that there are six different lawful reasons for processing personal data and they are all equally valid. There is no hierarchy i.e. one is not better or ‘more legally binding’ than the others. One of those reasons is that you have the data subject’s ‘consent’ but the ICO says that you shouldn’t use consent if you have another legal reason for processing the personal data.

“One of the reasons for holding and processing personal data is for the legitimate interests of the data controller as long as those interests don’t override the rights and freedoms of the data subject.” In order to find out if the rights and freedoms of the data subject are impacted you should conduct a “balancing test” and in simple cases of direct marketing, the balancing test can normally be satisfied by giving the individual the right to opt-out or unsubscribe from direct marketing.

Recital 47 of GDPR goes further and says that “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest” but this again is only as long as the rights and freedoms of the data subject aren’t outweighed. To summarise that - if you have a legitimate business reason for storing personal data then you don’t actually need a person’s explicit consent.

This means that if you are holding a person’s data because they attended ‘A Conference 2017’ then it is reasonable to safely and securely store their data and contact them to ask if they would like to attend ‘A Conference 2018’ because it’s a reasonable assumption that if they attended last year’s event then they may well be interested in attending this year’s event too. Be careful not try to stretch it too far – you probably shouldn’t assume that they would also like to attend other completely unrelated events that just happen to be organised by you, or subscribe to a related magazine or other service you offer. You can take one small leap in your assumptions – from last year’s event to this year’s – but a second leap to an unrelated product may be a leap too far.

If you still aren’t sure you should take the ‘expected’ test – would the data subject reasonably expect to be invited to this year’s event? If you can morally and ethically say yes (and not because you’ve abused their data in the past), and the subject has the opportunity to opt out of the communication, then you should be fine. A good solution for other events would be to use legitimate interests for the next year’s show and have a consent tick box for “Other events that we organise that you might be interested in”.

An important point here though is that any consent tick boxes must never be checked by default and you must record exactly what the wording was at the point that the data subject agreed to it. You need to be able to prove that they consented otherwise the consent is not valid. A really important point here is that you should always document the decisions that you are making relating to this stuff because it’s a bit like your maths homework; even if you actually get the answer wrong, if you can show your reasoning and show that you thought about the legitimate interest and the data subject’s rights then you should be fine.

The ICO want us all to be more responsible and think ethically about how we all use personal data. We will be explaining the other legal reasons for storing and using data in our next blog to be published in January.

Lies, damn lies and GDPR

By Simon Clayton, chief ideas officers and GDPR practitioner, RefTech 

Are you fed up of reading conflicting information about GDPR? Are you receiving a deluge of emails from companies proclaiming that unless you sign up and give consent then you will never hear from them again and then you will miss out on their offers / newsletter etc.? At last count I’ve received 40 of these emails, many from companies who have never even contacted me before, perhaps thinking that this is their last opportunity to contact me, even though they haven’t felt the need to previously. On one hand it’s very annoying, but on the other, it’s very interesting to see the number of companies who actually have my data.

The majority of these companies probably don’t have to contact their entire database. But they are doing it under the guidance of some self proclaimed ‘expert’ who is telling them that they have to have explicit consent to be able to store a person’s data (you don’t – ‘consent’ is only one of the six lawful reasons to store data).  

Even the BBC got it wrong; an incorrect news item sat on their website for three days until they corrected it. They only corrected it because I (and presumably others) complained to them and pointed out their error; they said that having consent was the only way a company could store and process a person’s data.

A myth has to be strong for the BBC to fall for it and this myth seems to have perpetuated itself into fact, which means I am getting totally fed up pointing this fallacy out to other people. I’ve even had to step away from a GDPR Facebook group I belonged to after several heated discussions with people who simply didn’t believe me because they had heard ‘facts’ to the contrary. The final straw was a heated discussion with a woman who runs a club who told me in no uncertain terms that under GDPR she has to contact all her members and ask them for permission to continue to store their data.

Think about it; this is a club that people sign up to voluntarily and pay to join, whose member benefits include a newsletter and other contact from the club. The very nature of joining a club is that you want them to have your details, and you expect to hear from them so that you can get involved. The club’s secretary actually thinks that they have to get explicit permission from each member to be able to just fulfil the benefits of the membership. I asked her what they would do if someone joins but withholds consent (as they must be able to do if you’re using consent as your legal basis for processing data) but she couldn’t answer that one!

Think how ludicrous that sounds? It’s utter madness to think this and it’s not what GDPR states at all. You don’t need consent if you have a ‘legitimate interest’ to store a person’s data – which means that it is quite reasonable for you to continue to store your members’ data because it’s a legitimate part of their membership.

GDPR is actually a reasonable piece of legislation, designed to protect the individual. It’s not out to confuse or over complicate business, but to make us all think about what data we collect and to use it responsibly. It is a little rough around the edges and some parts need further clarification and examples, but its heart is in the right place.

Stop listening to the experts, read the ICO’s guidelines yourself and if something seems silly, then it’s probably is and not actually part of GDPR at all.

GDPR: Take it to the limit

My GDPR blogs should now be making you think about how and why you are collecting and storing data, so I’d like to now discuss storage limitations; i.e. how long you are able to store data for.

GDPR is focused on encouraging responsible stewardship of data, and being responsible means not storing data indefinitely. The shift in responsibility means a shift in mind-set: an organisation does not own a person’s data anymore; it is simply on loan for a given task.  Keep this in mind and consider what is fair and reasonable to the data subject and do not ‘outstay your welcome’. 

Although you cannot store your data indefinitely, there are no hard and fast rules. How long you store it for is up to you to a certain extent but you have to document how long you are storing it for and justify why this length of time was chosen. You have to ‘show your workings out’ and show that your rational is robust and totally considerate of the data subject.

If you have an annual event, you should be able to justify holding registration data for eighteen months, working on the premise that  if someone came to your event in 2016 then you can hold their data and use ‘legitimate interest’ and the PECR ‘soft opt in’ caveat  to contact them about the 2017 event. If they don’t come to that event, then you will probably have to work much harder to justify holding their data for the 2018 event. That said, if you can prove that a significant percentage of your audience only attends your events every other year then you may have a case. The justification is for the ICO, so it has to be documented and robust enough to stand up to investigation, should that occur.  

If you cannot fully justify holding the data, then you will have to delete or anonymise it.  Remember though, not all data is equal; whilst passport and bank details should be kept for the bare minimum amount of time (you cannot justify keeping hold of such sensitive information for longer than necessary), you should be able to justify keeping a contact name and email address for a lot longer.

Your privacy policy has to tell your data subject up front at the time of collection, exactly how long you are going to store their data for, or at least tell them how you will work out the storage time. It may not be a finite fixed time – such as a year. You may wish to be more fluid, for example ‘for six months after the last event that you attended.’   

This is another great example of how GDPR will be encouraging companies to adopt better data practices that are not just good for the data subject, but much better for business too. No business should be clinging on to data that simply isn’t relevant to them any more.

GDPR is open to interpretation and there is a reason for that; it has been introduced to encourage organisations to think about how they use data and to be considerate of the data subject, not just follow a check list.

GDPR: too good to be forgotten

We’ve all received emails we don’t want – regardless of whether they’re relevant or not. Normally, it’s just a case of scrolling down and clicking the “unsubscribe” link and as long as the company sending the email is responsible then you won’t hear from them again. Some people wrongly assume that clicking an unsubscribe link will delete you from that company’s database and in fact under article 16 of the GDPR, there is a “right to erasure” which is sometimes known as the right to be forgotten. Unfortunately, this right can’t be applied in these circumstances because there is another law which prevents companies from emailing people who have opted out of marketing communications. That law is called the “Privacy and Electronic Communications Regulations” (frequently known as PECR) and because of that, any company that you have opted out of marketing communications from has a legal obligation to maintain a record of that on their suppression list and a legal obligation is one of the reasons that the right to erasure can be denied.

This is something that FlyBe, Honda and Morrisons all know too well as the ICO found them in breach of PECR in 2017 for emailing people who had previously opted out of marketing communications and fined them a total of £93,500!

The other thing to remember is that GDPR says consent must be as easy to withdraw as it is to give. So you need to make sure that your unsubscribe mechanisms are as easy as possible and crucially – are working correctly. I see plenty of poor unsubscribe mechanisms that ask me to enter the email address they sent the email to but most email clients don’t make it easy to find that out and if you have multiple email addresses it can be very frustrating. Finally, make sure you’re archiving the list of unsubscribe requests somewhere safely because if you rely on an online platform to manage that for you and they get it wrong and lose the list then you will be the one the ICO comes for if you email people you shouldn’t!  

GDPR: Reasons to be Lawful

There are six lawful reasons to store and process data. I covered one – ‘legitimate interests’ – in my last blog so I thought the next obvious step would be to explain the other five.

Read more: a matter of consent.

I’ll start in order of least general relevance to the majority of the conference industry, so we can quickly get the less interesting ones out of the way, and focus on the more relevant reasons. I’ll also use the terms set out in the act to avoid confusion:

1. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; it would be in the public interest for the Police to keep data pertaining to an individual’s criminal record for example. The ‘right to be forgotten’ is not an absolute right in this case!
2. Processing is necessary for compliance with a legal obligation to which the controller is subject; it may be a legal requirement for a company to keep data relating to a person’s financial transactions – for accounting for example.
3. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;it’s perfectly acceptable to keep data relating to someone who you are starting a contract with, or that you are hoping to start a contract with. This could relate to a non-financial contract too.
4. Processing is necessary in order to protect the vital interests of the data subject or of another natural person; the operative words here are ‘vital interests’, meaning that it is perfectly legal to process data that could make a difference to the data subject. There isn’t yet an official definition of ‘vital interests’ but you can assume ‘life or death’ as safe. This reason becomes applicable to events because it means that you can quite legitimately store data that relates to a person’s allergies, relevant medical issues or their disabilities. This also brings up the fact that the data you hold on one person could be legitimately processed under different sections of this act. For example, you could hold a person’s name and contact details under ‘legitimate interest’ and their dietary requirements under ‘vital interest’. It could also mean that you may need to keep parts of their data for longer periods than others. For example, you may have no justification for keeping their dietary requirements, but can keep contact details so you can market to them for another run of the same event. Each of these different reasons for processing their data, and your desired retention period needs to be clearly stated in your privacy policy – but we will cover that in a future blog.
5. The data subject has given consent to the processing of his or her personal data for one or more specific purposes; this is the one that has alarmed everyone. As I have said before, if you can use any of the other five reasons for storing data, then do so. Do not go down the route of asking consent unless it is your only option.

If you do need to ask for consent, then you have to make sure that you ask for it clearly and on a granular level. Article 7 covers the conditions for consent and they are listed on page 17 of our GDPR white paper, which you can view here.

This option is very relevant when asking delegates to register for an event. I can categorically state that your event registration form will have to change under GDPR. When collecting data, consent has to be asked for in a clear and concise manner and not buried deep within the small print. Specific questions need to be asked; you cannot simply bundle consent into one ‘catch all’ statement that simply states ‘marketing’ – you must separate multiple purposes and reasons for using their data into different questions.

You also cannot dictate that consent is part of the deal – for example, that the subject is only allowed to enter an event or receive goods if they give their consent to receiving your newsletter – something you might be able to do if you were only using legitimate interests.

A data subject must give consent in an affirmative nature – i.e. they have to actively say yes, rather than simply not saying no. Equally, pre-ticked boxes that the subject has to untick are not allowed.

You also have to be able to prove that your data subject gave their consent and document exactly what they consented to. In 2016 Honda was fined £13,000 for marketing to people whose data was fed into their central database by their dealers. The dealers may have got permission to use the data, but mandatory fields were not filled in so they could not prove that they had specific permission to do so although interestingly, this was under Privacy and Electronic Communications Regulations (PECR) rather than GDPR so don’t think that just being GDPR compliant is enough!

Consent policies can change over time and so you must keep an audit trail of exactly what wording each data subject has agreed to. And obviously, you can’t change your policy and then assume that just because your data subject has agreed to a past policy that they give their permission for a newer one.

Consent relating to children’s data is a completely different matter and at the moment the acts around it are a little fuzzy as it’s written with information society services in mind (social media and the like). Thankfully it isn’t generally relevant to our industry, so we don’t need to worry about this.

It is important to remember that none of these reasons to store personal data are carte blanche to keep data indefinitely. You need to have a data retention policy that says how long you will keep personal data for – or at least, how you decide how long to keep the data for. More on that and also privacy policies in an upcoming blog.

Simon on: Facing the Facts

Facial recognition is going to take the events world by storm and the humble barcode will soon be a relegated to the past. So say the people selling it, but seriously?

Even Apple couldn’t get it to unlock the new iPhone as promised and that was demonstrated rather embarrassingly to over 1000 people, including the worlds press.

The failed demo had an immediate impact on Apple’s shares, but they have already bounced back because they are Apple and the new iPhone has a lot of other great features (that probably do work). Let’s look at the facts about facial recognition.

The tech debate

One of the companies selling facial recognition systems for exhibition registration has recently said that it is a faster way to produce a badge than simply scanning a barcode.

They may say this, but where’s the proof? The perfect answer to the naysayers like me would be a video on their website showing a real time demonstration of the system in use. It would be very simple to demonstrate and film, but they don’t have one – which hardly exudes confidence.

I don’t believe it for one minute and I challenge any company that’s peddling facial recognition exhibition registration systems to a time challenge against our trusty barcode scanners.

The barcode is an amazing invention and one that has stood the test of time because it’s easy, cheap, fast and effective. With one little bleep of the scanner, the barcode is read, the information is matched to the registration data and a badge is printed.

The facial recognition systems I have seen so far are dramatically slower, or simply don’t work. Have you ever been processed by a passport system in the time a barcode scanner would take to make one little bleep? Or, like me, have you stood there for 30 seconds or more? I’m pretty confident that the technology used at airports is state of the art so why would facial recognition exhibition registration systems be faster? There is a slim chance that the system I mention above is utterly amazing but I’ve not seen it yet.

Facial recognition also relies on you having accurate and security checked facial data to match the facial scan to, so you will need up-to-date photographs of all of your visitors – all logged, confirmed and stored.

If security is of the upmost importance then you will still need to confirm that the person in the photo is the person that they say they are. Unless you are going to run identity checks against legal photo ID, you only have that person’s word for it and you cannot guarantee that they are who they say they are.

Biometric data

There have also recently been news stories about AI facial recognition being able to learn to recognise a person’s political stance, their sexuality and their propensity for crime. If this technology does gain traction, we will see human rights laws and conditions being applied to its use to ensure it can’t be used for discrimination. It’s a rather scary proposition and we may end up with a public backlash against facial recognition being used at all.

Additionally, the storing of biometric data will take your data into a special category when the GDPR comes into force next May. Biometric data is particularly sensitive personal data with increased conditions to control its storage and usage.

GDPR is causing enough confusion without these extra conditions to consider. On one provider’s website they say that the data is encoded and would never be able to be turned back into a picture but that doesn’t actually matter. Under GDPR – any biometric data that can uniquely identify or confirm the identity of a person is special category data which will require much higher levels of consent and protection.

This website also suggests that their data is stored securely on their servers on the internet. Does that mean they need an internet connection for it to work? What happens if the connection drops during a busy period – presumably check-in would just stop? During a recent exhibition, we were experiencing a connection speed of 300kbps which could cripple a registration system that relies on internet connection and that was central London!

Police trialled a state-of-the-art facial recognition system at this year’s Notting Hill Carnival and it couldn’t even tell the difference between a young woman and a balding man, according to a rights group worker invited to view it in action. They said it proved worse than useless: it prompted 35 false matches and one wrongful arrest of somebody incorrectly tagged as being wanted on a warrant for a rioting offense.

High-level security

Facial recognition could be useful for an extremely high level security event – such as the G8 summit, but these events are few and far between.

A bog-standard exhibition will never need that level of security – or be able to justify paying for it. It would be far easier for organisers to verify identities by checking the delegate’s photo ID. At some events we then take a photo of the delegate while they stand there and print it on their badge so staff on the doors can double check when they enter the event.

People are accustomed to using barcodes and use them for everything from event tickets to airport boarding passes. They have been around a long time because they work and they work quickly. Look at the speed in which a cashier scans the items at the supermarket check out. It’s fast – faster than you can pack your damned groceries! That’s a barcode at work.

Do you really think it would be quicker if the supermarket barcode scanner was replaced by a product recognition scanner that had to match its physical form to a database? It would be a step backwards in speed and a step forwards in cost.

So don’t write off the barcode – it’s cheap, reliable, fast and effective. It will never be replaced by a technology that’s slower, less accurate and expensive (and may not always work). If it ain’t broke why try to fix it?