GDPR & Brexit: protecting confidential data, document protection and DRM

Brexit, GDPR & the need to protect confidential documents.

There is much confusion over the subject of GDPR, data protection, and what is personal data. In the event of a ‘hard’ Brexit this is likely to worsen. Here we discuss how to protect confidential documents and data for GDPR compliance.

The recent ‘Brexit’ events in the UK concerning the EU regulation General Data Protection Directive (GDPR) have served to remind us that we have to take protecting confidential documents seriously. In the event of a ‘hard Brexit’ the status of the UK changes from being within the EU for data protection purposes to being a ‘third country’. That means it does not have the benefit of any contractual agreements for data protection into and from the EU. However, most companies will still be looking to comply with GDPR to the best extent possible until there is more legal clarity. And anyone transferring personal data between the EU or processing EU citizen’s personal data will still need to comply with GDPR.

Protection of personal data

It is well understood that personal data have to be protected, but how do you decide when data become personal and does it change if combined with other data? Generally you have to protect confidential documents which include data that identify a living individual, although that can be balanced against the likely harm that disclosure of the data will make (as a rule of thumb disclosing six names and email addresses may be valid when all the recipients expect that, but disclosing 50 or 60 would not be, and the recipients should be in the bcc list), and that’s just for a name and an email address!

The same is true when you need to protect documents with proprietary information or protect confidential documents with secret or restricted information. One unprotected document is one thing. But you have to take positive steps to protect confidential documents where there are several or the document is highly confidential. And where we have to protect confidential documents containing personal information it is easier to do it for all documents rather than get it wrong.

Are the normal document handling tools suitable?

Most of today’s applications are built around the idea of group working on documents and sharing documents for editing. But that is not what we want to be doing with confidential documents. So we need to use special applications that actively prevent authorized users from being able to use Save or Save As commands, and are able to block use of the Print Screen key, screen grabbers and so on. In particular, if you have protected confidential documents for use by specific recipients you do not want them to be passed on and read by people who are not authorized. Therefore you will be looking for applications that can protect confidential documents in the workplace, at one level, and also enable you to distribute confidential documents in a controlled manner to recipients outside the corporate network or local domain.

What can you do to protect confidential documents from disclosure?

In the digital workplace protecting confidential documents from disclosure means that we are going to have to use encryption, so that only someone who is authorized and has access to a decryption key is able to open the document in an unprotected form. But then you have the problem that anyone who can open the protected document can do what they like with it, which is not much protection unless you can then prevent them from copying, cutting and pasting, screen grabbing, or saving the confidential document in unprotected form.

This is the downside of file encryption products. They prevent unauthorized access, but authorized users can do what they like with the file or document once it is decrypted. And there is nothing to prevent users giving away the encryption key so you are not necessarily limiting access to certain parties anyway. It is merely a transaction built on trust (the trust being that the document and the key will not be shared with others).

So document protection solutions that also use DRM (to control document use) and licensing controls (to control distribution) need to be in place to control document sharing and use.

Can we control protected documents by network access controls?

Previously organizations (including government bodies) have relied upon separating networks protecting confidential documents that are restricted, but the erosion of the network boundary, and the increase in the use of Bring Your Own Devices (BYOD) to take copies onto storage that fits comfortably inside a wallet or purse have meant that the actual document content must be protected, and more rigorously than before.

So specially designed applications are needed to provide the functionality of restricting use to single or ranges of IP addresses to reflect the corporate structure without losing the flexibility of being able to also authorize outsiders access were this is relevant (proprietary data, government confidentiality, medical and so on).

Locklizard, through their Digital Rights Management (DRM) enforcing applications Locklizard Safeguard and Safeguard Enterprise, have been developing and delivering document security applications that address these requirements and many more.

Locklizard PC installed Viewer applications have been developed to avoid the need for the authorized user to enter a key or ‘log in’ using ID/password. There is nothing therefore to be able to give away to anyone who has acquired a copy of a protected confidential document. Licensing controls enforce what users can view a document and keys are transparently and securely relayed and locked to authorized devices.

Document and user validation, expiry and revocation

Licensing controls are very extensive, and may require a user of a protected confidential document to be online every time they open it, or online after a number of days so that their authority can be verified and any changes made by the Administrator to their document access rights can be enforced.

Further controls are available to help stop protected confidential documents from continuing to be usable after their normal legal retention period (which can be 6 years for ordinary financial matters and 20 years after death for some personal medical information). When using Locklizard for protected confidential documents, end dates can be individually tailored to meet differing requirements, and can be altered after being issued, by Administrators where this is necessary.

This may be as a result of authorization being removed because the user has left the organization or a change in role or location makes it no longer appropriate to have access to some or all of the protected confidential documents. It could also be the result of changes to regulations or to prevent use of outdated documents.

Both users and documents can be instantly revoked and user access to individual or all documents ceased automatically. This ensures access to personal and confidential data is no longer available when use has been stopped and therefore there is no risk of accidental or deliberate exposure. It may be very helpful in order to demonstrate that unlawful processing has ceased in the event of a GDPR audit.

Tracking document use and tracing leaks

Sometimes it may be necessary to show who the authorized user is. This can be because copying a protected confidential document is so important to a thief that an actual camera is used to make copies of the screens being displayed (printing such documents should always be forbidden by the Administrators). It is impossible to stop this. Locklizard support the addition of dynamic watermarks on viewed (and printed) confidential documents that show who the authorized user was that allowed the screen to be copied. Generally authorized users do not want to be associated with document piracy, especially when it is easy to identify them, so they avoid disclosing protected information.

Document use can be logged so you can see when documents were used, by who and when. This helps with GDPR compliance for audit because it is important to be able to demonstrate where personal data is used or printed and distributed.