GDPR: How to mitigate the risk of a customer data breach

As seen published in ITProPortal.

Tech Perspective

Steve Jones, Senior Consultant, Amido

The change in law brought about by GDPR in no way diminishes the importance of user data to customer-centric businesses. To continue to exploit the breakneck developments in artificial intelligence and machine learning which are turbocharging customer profiling and relationship mining, GDPR encourages good architectural design in putting the customer at the heart of the enterprise.

The key design decision from a best practice perspective is to consolidate all customer PII into a single data store, and to use non-descript tokens to act as alter egos (or pointers) to an individual outside of the data store. Rather than passing email addresses between systems to identify users, for example, these tokens perform the task of identifying a customer without leaking any identifiable information.

In order to find out where customer data sits within the business, first conduct a PII audit. Keep in mind that customer data could be stored in several locations – including third party systems – and in data commonly replicated across development, test and archive environments.

After the audit, consolidate PII into a single store. This is a sensible time to introduce a centralised IdAM (Identity Access Management) platform to merge any legacy or distributed ID systems currently in operation. The benefits of this stretch farther than GDPR compliance: centralising this sensitive information will reduce support and maintenance, in turn leading to time and cost savings whilst increasing the agility of the business to cater to new business models.

If you don’t already, it’s prudent to treat PII with the respect you’ve always treated PCI: now you have a single concentrated store of PII, secure it well through several overlapping layers. Encrypt data at rest and in transit; grant access sparingly and authorise access to the bare minimum required to get the job done (according to the principle of least privilege). Audit all access, and, most importantly, regularly review the access logs! The simplest way to know about any data breach is to proactively monitor the accounts that access the information.

Now you have a single store of PII, apply a privacy and consent-delegation framework over the top – user managed access (UMA) is the magic ingredient here; built on top of OAuth 2. This is the next-generation access management protocol that supports a scalable fine-grained access and revocation model.

This combination makes it ideal for the self-service consent management scenarios that GDPR introduces. As UMA is built on top of OAuth 2, authenticated users are identified by encrypted tokens passed between systems, never directly attributable information.

Introducing UMA enables businesses to develop future-ready services that a user can share, and to which they can delegate consent in advance. This is the core feature of the protocol which opens up exciting opportunities across IoT, API and app landscapes whilst ensuring private data is protected.

If Tesco had been subject to the rules of GDPR following the hack on its bank back in November 2016, it would have potentially faced a fine of £1.9 billion.

Source: 4D, February 2017

GDPR Compliance and Marketing Success

GDPR is a great opportunity for enterprises to introduce next-generation privacy and consent services, and the advantages can be profound for your organisation. These services will build trust by empowering the customer, and they also lay the foundation for introducing more personalised experiences based on rapid developments in automation, AI and machine learning.

Whilst helping you to empower your customers, privacy and consent services can also be a differentiator for your products and services, compared with your competitors. Demonstrating a proactive stance to compliance and privacy will allow you to get ahead in the marketplace, with both your customers and industry regulators.

Furthermore, this approach will naturally enhance the progressive-profiling process. As you analyse your customers’ consent ‘giving’ and ‘managing’ behaviour, you will gain a set of additional data points around the customer’s psyche for ML/AI processing, enabling a more active/active model for customer interaction.

In addition, it will encourage regular customer review of their profile, which means you can interact with them more frequently, and outside of the transaction process, opening up contact points and opportunities for gamification and sales and marketing.

Other benefits that come from GDPR preparation are that you get a clear picture of where your data resides. By doing this, you will better understand your technology services models and master sources of data. Introducing pseudonymization will enable you to take advantage of the latest technologies and tools without falling foul of Safe Harbor and other cross border legislation.

Rather than approaching GDPR apprehensively, it’s important to recognise the ways in which you can strengthen your data management, customer services and competitive edge through next-generation privacy and consent services. With the right approach and technologies in place, you can capitalise on customer data and trends, whilst also becoming GDPR compliant.

Leave a Reply

Your email address will not be published. Required fields are marked *