The focus and drive towards greater innovation in the oil and gas sector is setting new goals and creating new boundaries. A fundamental aspect of the industry’s advancement is people, and one of the main changes tech will deliver is a more in-depth understanding of how employees work.
Knowing more about our workforce through wearable tech to monitor performance and even the increasing use drone technology involve the processing of personal information. All of this comes together to enable us to drive efficiencies but it also means we must pay much greater attention to the data we collect and how we manage it.
As the new General Data Protection Regulation (“GDPR”) comes into effect on 25 May 2018, there is no better time to take a ‘fresh eyes’ approach to data.
The GDPR will be the most substantial and significant change in data protection for a generation. Data protection rules are going through a lot of changes, some of which are the most far-reaching in the last 20 years. Prepared in line with the burgeoning digital economy, the GDPR will completely replace existing laws.
New fines will be introduced along with the GDPR, Penalties will increase to as much as 4% of your annual worldwide turnover or 20 million euros, whichever is the higher for breaches. This very much brings the issue of privacy into the Boardroom. And, while from a financial perspective, no organisation would want to find itself exposed or in breach of the regulation, the reputational risk of a breach could potentially far outweigh the cost of a fine.
Careful and timely preparation is vital. Those implementing the changes now are finding that the new law can be used as leverage to ‘put your arms’ around the data to better understand it and learn from it.
Some of the key changes include:
• Implementing security breach protocols to ensure a business can report incidents involving personal information to the regulator within 72 hours;
• Ensuring employment contracts and data protection policies meet very specific requirements setting out what rights individuals have;
• Updating internal policies to accommodate new individual rights, such as the right to have data deleted that is no longer needed (“the right to be forgotten”);
• Handling subject access requests in a shorter time period (from 40 days to one month); and
• Reviewing contracts with suppliers that use personal data to ensure that they meet new contracting requirements.
So, with a new focus on privacy from at the highest level, and the opportunity that exists in the digital age, being prepared for GDPR will allow organisations in the oil and gas sector to redefine the industry, while at the same time building a trust and confidence in an age where data is most definitely king.
Ross McKenzie is the head of privacy at Burness Paull.
Recommended for you
