Upload
marlene-berry
View
213
Download
0
Embed Size (px)
Citation preview
The Good Practice Guide – what we look for during an Audit of a Credit Union
Billy HawkesData Protection Commissioner
Credit Unions
Why Audit?
• Part of overall supervision strategy– Accountability of Organisations
• “Selective to be Effective”
• Assist organisation audited
• Draw lessons for Sector
• Improve Sectoral Guidance
Audit Statistics
2005 - 3 2006 - 8 2007 - 25 2008 - 28
2009 - 302010 - 332011 - 282012 - 40
0
5
10
15
20
25
30
35
40
'05 '06 '07 '08 '09 '10 '11 '12
Range of organisations audited.
• Department of Social Protection
• Customs Information System (CIS)
• Local Authorities• Schools• Sporting Bodies
• Credit Unions• Banks • Health Sector• Charities• Supermarkets• LinkedIn• Facebook
Key recommendations in Credit Union Audit Reports
• Data Controller/Processor Contracts (section 2C)
• Data Retention Policy
• Network Security• CCTV• Recording of Calls• Audit Trails
Audit ResourceTo assist organisations selected for audit
by the Irish DPA
http://www.dataprotection.ie/documents/enforcement/AuditResource.pdf
Appendices
• Sample Illustrative Audit Questions
• Self-Help Checklist on Data Protection Policy
• Common Audit Recommendations
• “Need to Know” Access Control Policies
• Internal Access Security Checklist
Data BreachesData Security Breach Code of Practice: non-mandatory but recommended all breaches reported to DPA
http://www.dataprotection.ie/docs/07/07/10_-_Data_Security_Breach_Code_of_Practice/1082.htm
• Breach Notification Guidance- ePrivacy Regulations 2011 (SI 336 of 2011)
http://www.dataprotection.ie/docs/Breach_Notification_Guidance/901.htm
• Sectoral / Geographical approach
• Complaints
• Media reports - public interest
• Developing Data Protection Codes of Practice
Selection Criteria
Selecting Organisation for Audit
• Informal contact with Organisation
• Letter of intention to audit
• Date and time for audit
• Duration of audit
Pre-audit Planning and Scope
• Request for documentation
• Examine received documentation
• Check Data Protection registration details
Pre-audit Planning and Scope
• Check for any ongoing or previous complaints
• In house discussion to determine potential issues
• Assign appropriate personnel for audit (2)
• Engage external expertise?
Pre-audit Planning and Scope
• Develop audit manual for inspection team (audit resource document appendix 8)
• Questions based on the eight Data Protection principles
• Possible pre-audit ‘overview’ meeting
Data Protection Acts 1988 & 2003 - Section 10(1A)
"The Commissioner may carry out or cause to be carried out such investigations as he or she
considers appropriate in order to ensure compliance with the provisions of this Act and to
identify any contravention thereof".
Data Protection Acts 1988 & 2003 - Section 24
All authorised officers have specific powers and associated rights of access, including:
• Arriving unannounced at the premises of a particular data controller or data
processor• Inspecting, copying or taking extracts of
data.
The Audit• Co-operative
• Face to face discussion
• Audit an aid to both parties
• Opportunity for target organisation to raise Data Protection issues
‘Amicable Resolution’ • Strong enforcement powers if necessary to
achieve compliance.
• Irish approach: “speak softly but carry a big stick”
• Achieve “best practice” rather than mere compliance.
• “Best practice” cannot not be enforced.
The Audit – High Level
• Meet with Managers with relevant responsibility / expertise of the areas under inspection
• Introduction and step through of areas to be covered in the audit
• Examine high level data protection policies
The Audit – Local Level
• Meet with local managers & frontline staff with responsibility/expertise of the areas under inspection
• Discuss data protection policies locally
• Meet staff with day to day experience of local procedures
The Audit
Question?
Does High Level Policy = Local Level Procedure?
Audit Process
• An organisation selected for audit is usually given a number of weeks notice of the audit.
• They may be asked to provide in advance any relevant documentation on its data protection practices.
• The audit normally includes one or more on-site visits by an audit team from the Office. During these visits, the Audit Team will meet with selected staff of the organisation. They will also usually inspect electronic and manual records.
The Audit
• Draft report issued • Follow up questions
- clarification
• In house discussion
• Final report issued
The Audit - Recommendations• Data Retention Policy
• Data Collection Methods
• Staff Training and Awareness
• Use of PPSN
• Transfers of personal data to/from third parties
The Audit - Recommendations
• Policies relating to the disclosure of personal data
• Security of data including access controls
• Appropriate data controller to data processor contracts
• Disclosure and breach policies
• CCTV
The Audit – Follow up
• Audit noted in Commissioner’s Annual Report
• Further contact with organisation re: implementation of Report recommendations
• Follow-up audit if necessary
How to prepare for an audit
• Read our Audit resource http://www.dataprotection.ie/viewdoc.asp?DocID=894&m=f
• Self assess against the questions posed in the Audit resource before we arrive!
• Be open and transparent with us.• Ensure all staff are aware of the powers to inspect
personal data available to the audit Team
Key Areas of Recommendations in Credit Union Audit Reports
• Use of PPSN: • Data
Controller/Processor Contracts (section 2C)
• Data Retention Policy
• Network Security• CCTV• Recording of Calls• Audit Trails
Guidance – Key Points (1)
• The Board of Management is the entity legally responsible for how the credit union as a data controller processes all personal information– Not the Manager or staff
Guidance – Key Points (2)
The Board of Management in each credit union should ensure a Data Protection Policy is drawn up outlining how all personal data is processed within the credit union.
Guidance – Key Points (3)
PPSNs:• Provision of PPSN not mandatory to set up
membership account• Detailed guidance re PPSNs issued to ILCU/CUDA
August 2010
Guidance – Key Points (4)Copies of photo id may be sought for anti-money laundering purposes (Criminal Justice Act, 1994) but the practice where members have their photograph taken and scanned onto CU systems should not be mandatory. All members should be given an opportunity to refuse consent.
Guidance – Key Points (5)
• Contracts should be drawn up and signed between credit unions and all third parties processing personal data on behalf of credit union e.g. debt collection services.
• Any processing of information by debt collectors, when undertaken on behalf of a credit union must be undertaken in full compliance with the Data Protection Acts.
Guidance – Key Points (6)• If a credit union is using a debt collector, under the
Data Protection Acts 1988 & 2003, the debt collector must be registered with the Office of the Data Protection Commissioner as a data processor.
• If a credit union uses an unregistered debt collector, the credit union is disclosing the information to a debt collector who is already breaching the law.
Published Audit Reports
Department of Social ProtectionOffice of the Revenue CommissionersFacebookCarlow Institute of Technology
http://www.dataprotection.ie/docs/Audit- Reports/1293.htm
Thank YouOffice of the Data Protection CommissionerCanal HouseStation RoadPortarlingtonCo LaoisPhone: LoCall 1890 252231
057 8684800Fax: 057 8684757Email: [email protected]: www.dataprotection.ie
36