When GDPR is enforced in May 2018 there will be new requirements for employers for secure management of personal information internally. This means the end of internal email. Learn more about why you should stop with email and what a simple and cost-effective solution looks like.
What is GDPR?
GDPR is the European Union’s new data protection act. It will be enforced on May 25, 2018, and applies to all businesses that manage personal information on EU-citizens, e.g. the employees of a German company. The aim of the new legislation is to provide EU citizens greater control and influence on their personal data and how they are handled by businesses and employers.
EU means business with the new legislation and will carry out follow-ups and revisions. The fine for failure to comply is no laughing matter (up to 20 M EUR or 4% of the turnover, depending of what is highest).
An important aspect in GDPR is that personal data must be treated in a secure manner.
What does personal data mean?
In GDPR, personal data can be many things, from name, address, place, online-ID, health information, income, etc.
Examples of scenarios where personal data may occur naturally within internal communication:
- Management follow-ups (material for salary reviews, recruitment material, CV:s, etc)
- HR-discussions about personnel (individual support, etc)
- Economic management (salary specifications, etc)
Note that according to GDPR, it’s especially important to provide extra safeguards for sensitive personal data. Examples of sensitive personal data can be personal data about an employee’s private life and health, e.g. matters that can be discussed between an employee and his or her boss or HR person.
Implementing extra safeguards for sensitive personal data, requires both the right tools and a communication policy.
The end of internal email
So, what about email, this tool that everyone loves to hate? Is it safe to send sensitive personal data, e.g. as text in email or as attachments? The answer is NO! It is simply not secure to use email. With standard email all text and attachments are sent in clear text over the internet and is relatively easily accessible to hackers and other malevolent technical people.
An attack could mean that sensitive personal data about a corporation’s employees, contained in email communication, is leaked and published on the internet. The damage may be catastrophic for both corporation and employees and with the introduction of GDPR there is also the threat of multi million fines.
Now when email is no longer a valid solution for communication of sensitive personal data, a secure alternative for internal corporate communication is needed. Such alternatives were previously lacking at a reasonable cost. Both corporations and the EU therefore used to disregard this problem.
When GDPR is introduced, email may no longer be used for management of sensitive personal data.
Enterprise messaging for secure management of sensitive personal data
Enterprise messaging is a solution on the rise. Enterprise messaging also has the advantage that sent messages and files can be easily edited and removed.
With enterprise messaging, communication takes place in so called chat channels. A channel can be public, private, or 1-on-1. A channel has a name that describes the theme for matters to be discussed in the channel. This means that information and discussions end up in the right place, compared to email where everything, no matter what topic, ends up at the top of the receiver’s INBOX.
In order for enterprise messaging to be a real solution for the management of sensitive personal data, an established communication policy is also needed.
The importance of a communication policy
With older and unstructured tools, such as email, it has previously been impossible to establish a policy for internal communication. With corporate chat, this has now become a real possibility. But what does a communication policy really mean?
”A communication policy is an established agreement on how to communicate in specific situations.”
It is very important that a communication policy is established and thereby well anchored with senior management as well as HR. The policy must bring up especially important situations and clarify how communication shall be handled in these contexts. For the policy to last and evolve there must also be a role and person responsible for the policy.
As for managing communication with sensitive personal data and similar information, we recommend the following policy:
In the dialogue between an employee and a boss, the boss is responsible for making sure that discussion and communication around personal data is carried out in private chat channels. In this way a satisfactory level of security can be guaranteed. The policy should establish a naming convention for the dedicated private chat channels.
- Discussion is going on between an employee and boss, and touches upon sensitive personal data
- The boss realizes that the discussion is related to sensitiv personal data
- The boss creates a new private chat channel dedicated to the topic
- The boss invites the employee to the created channel
- The discussion is moved to the channel and continues there
In a dialogue between and employee and an HR-person, the HR-person has the same responsibility as the boss in the example above.
It is reasonable that the HR-manager is responsible for establishing, spreading and applying the communication policy. The CIO is responsible for introducing and managing the enterprise messaging solution.
GDPR-secure your internal communication with a enterprise, with a related communication policy.
See the following material for further information about GDPR:
- Protection of Personal Data – European Union.
- EU Legislation – Data Protection – European Union.
- Questions and Answers – Data protection reform – European Union.