5 Things HR Leaders Should Know about GDPR
The General Data Protection Regulation (GDPR) is bringing a great wave of change to companies worldwide. With stricter rules around data privacy, security, and accountability – effective May 25, 2018 – companies in and outside the EU are making data protection a top priority.
GDPR will reach far beyond the EU (where the law is taking effect), as its regulations apply to all companies that process personal data of European citizens. That could mean a candidate applying to your company, or an existing employee residing in the EU, even if you’re a US-based employer.
HR handles huge amounts of personal data, so the race is on to identify potential GDPR compliance issues. It’s likely that your HR organization is (or will be) completing business process inventories and making changes in the way you address the rights of data subjects, data retention rules, and more.
And here’s another important consideration: Not only must you comply with GDPR, you must also ensure that all HR tech or SaaS vendors you work with are in compliance as well. Last year, Outmatch began working with TrustArc, a leading privacy compliance and risk assessment company, to assess our readiness for GDPR. This has helped us, as a Data Processor, to identify operational enhancements that should be made before the new regulations take effect.
Things HR Leaders Should Know About GDPR
Here are a few keys things that you, the Data Controller – and by extension your Data Processors – will be held accountable for when it comes to GDPR. (There are more considerations than this, but these will help get you thinking about the right questions to ask when evaluating your vendors).
1. Lawful Basis for Processing Data
To collect and process data of EU residents, you must have a legal basis for doing so. Under GDPR, you can do this by obtaining consent from Data Subjects, or by processing data for the purposes of legitimate interests pursued by the Data Controller. You’ll see consent is a common approach in scenarios such as marketing, but it’s not our recommendation for HR data. While you should always check with your company’s data protection officers and legal counsel, we expect most of our clients to use pursuit of legitimate interests (hiring and developing great employees!) as their legal basis for processing data.
2. Cross-Border Data Transfers
According to GDPR, you must have a lawful basis for transferring personal data from the European Economic Area (EEA) to countries such as the US. There are a few ways to do this. At Outmatch we use Standard Contractual Clauses (also referred to as Model Clauses), which describe the data we collect and transfer on behalf of our clients, how we protect it, etc. We append this to our agreements with clients who request it, and this provides the lawful basis for transferring data.
3. Rights of Data Subjects
This involves the right of Data Subjects to be notified of the purposes for which their personal data will be processed, the right to access and change their personal data, and the “right to be forgotten,” along with several other rights. At Outmatch, we have internal processes set up and ready to help you handle these rights management requests when you receive them.
4. Data Security
Security under GDPR means not only protecting personal data, but also making sure it’s available, accessible, and used solely for its intended purpose. Outmatch protects data using industry best practices such as encryption in transit and encryption at rest, as well as securely developing and testing our software and regularly scanning our systems for vulnerabilities. We make sure data is available using redundant servers in our data centers, regular backups, and we have a disaster recovery site and plan in the event of a major incident. We also make commitments to clients and individuals through our privacy policy that our use of personal data is limited to the purposes for which it was collected, and we enforce the same commitments on our partners.
5. Records of Processing Activities
This states that you must keep records of processing activities that involve personal data. As one of your Data Processors, we’ve mapped all of our processes involving your candidates’ and employees’ personal data into ready-to-use templates, which you can use as part of your business process inventories, or in your privacy and/or data protection impact assessments.
The Bottom Line
When it comes to the considerations above, or anything related to GDPR, Outmatch has you covered. If you’d like to learn more about data processing and GDPR, please contact us. We’re happy to answer any questions you have.