S3.E4. Data Protection Essentials for Procurement Professionals

WEBVTT
00:00:15.119 --> 00:00:18.480
Hello and welcome to Let's Talk Procurement.
00:00:18.640 --> 00:00:22.559
The only show you need to master the art of procurement.
00:00:22.960 --> 00:00:24.000
Let's go.
00:00:24.719 --> 00:00:28.559
Uh the first question is could you just introduce yourself?
00:00:28.719 --> 00:00:31.760
Give us a bit on your occupation and your experience if that's alright.
00:00:32.079 --> 00:00:32.320
Okay.
00:00:32.479 --> 00:00:33.359
Hi, I'm Sara.
00:00:33.600 --> 00:00:34.320
Pleased to meet you all.
00:00:34.479 --> 00:00:36.479
Do you want my full name or is Sarah okay?
00:00:36.560 --> 00:00:37.280
Can I just be Sarah?
00:00:38.320 --> 00:00:38.399
Cool.
00:00:38.479 --> 00:00:39.039
I'll be Sarah.
00:00:39.119 --> 00:00:39.759
Hi, I'm Sarah.
00:00:39.840 --> 00:00:40.640
Nice to meet you all.
00:00:40.880 --> 00:00:48.399
Um, my occupation firefighter, dumpster fire putter outer, general running around screaming person.
00:00:48.640 --> 00:01:00.320
Um I am vaguely and sort of directly responsible for making sure that data protection is followed and that the law is followed and that we do right by our data subjects.
00:01:00.479 --> 00:01:09.599
Um I also have a sideline in information security, risk management, um, business continuity planning, and a bunch of other stuff that comes with general compliance.
00:01:11.280 --> 00:01:12.000
Brilliant, thank you.
00:01:12.239 --> 00:01:12.640
You sound good.
00:01:14.879 --> 00:01:15.599
I always do anything.
00:01:18.239 --> 00:01:20.239
It's a thrilling job, let me tell you.
00:01:21.120 --> 00:01:25.439
So the next one is uh can you tell us something interesting about yourself?
00:01:26.319 --> 00:01:35.920
Um, I have a um level two City and Guild chainsaw qualification that um um allows me to maintain and cut down trees.
00:01:36.079 --> 00:01:37.599
I also have my own chainsaw.
00:01:37.680 --> 00:01:41.439
It's an echo, it's beautiful, I love it, and I have taken trees down with it.
00:01:41.760 --> 00:01:43.920
Have you got a name for the for the chainsaw?
00:01:44.400 --> 00:01:45.200
I haven't named it.
00:01:45.280 --> 00:01:46.400
I think that's a very male thing.
00:01:49.040 --> 00:01:50.319
I'm not into naming it.
00:01:50.480 --> 00:01:57.040
Um generally, if I was going to name it, it would probably be what my husband calls it, which is oh my god, not so close to me.
00:02:01.200 --> 00:02:04.480
Oh, I have a strimer too, but the chainsaw's more impressive.
00:02:05.680 --> 00:02:06.959
Do you want any more interesting things?
00:02:07.040 --> 00:02:08.800
Because I've I've got quite a few.
00:02:10.560 --> 00:02:13.360
There's something about you've you've written a uh a book.
00:02:14.000 --> 00:02:14.800
I've written three.
00:02:15.120 --> 00:02:15.599
Three books.
00:02:16.240 --> 00:02:16.639
Yes.
00:02:16.800 --> 00:02:21.680
Um I write about dragons and fantasy because why on earth would anybody want to write about the real world?
00:02:21.840 --> 00:02:23.680
Because it's on fire and it sucks.
00:02:23.840 --> 00:02:29.280
So I write about wonderful worlds where it's not on fire and where, you know, just occasionally dragons eat sheep.
00:02:31.599 --> 00:02:32.560
When the dragons let loose.
00:02:32.800 --> 00:02:34.400
Well, it depends if they're gonna roast the sheep first.
00:02:34.479 --> 00:02:35.759
Sometimes they do, sometimes they don't.
00:02:35.840 --> 00:02:37.919
It just depends on how crunchy they want them.
00:02:38.639 --> 00:02:42.560
I know a little I heard a little rumour that you've got some uh some fans.
00:02:43.599 --> 00:02:44.719
I have a lot of fans.
00:02:44.879 --> 00:02:49.199
I've got a bunch of of really nice school kids in Belgium who are quite obsessed.
00:02:49.360 --> 00:03:00.080
Um, yeah, I have all sorts of random emails from from people wanting to have the telephone number of my characters where I have to explain the concept of fiction to like grown adult women.
00:03:00.240 --> 00:03:01.680
Um, but that's always fun.
00:03:01.759 --> 00:03:03.599
Um, but yeah, mostly sort of kids.
00:03:03.759 --> 00:03:06.080
No, apparently it's it's junior reading.
00:03:06.159 --> 00:03:07.039
I didn't intend it to be.
00:03:07.120 --> 00:03:08.879
Some of it's a bit dark, and uh, yeah.
00:03:09.039 --> 00:03:10.159
But there you go, it is.
00:03:10.240 --> 00:03:17.520
So, yes, I I do character sessions for for schools where I have to go and do interviews from by the kids as if I'm the character.
00:03:17.759 --> 00:03:18.639
They're fun.
00:03:20.879 --> 00:03:24.560
So, yeah, I do have random fans, lots of random fans.
00:03:24.719 --> 00:03:29.520
Um, I've also just started a DD, some DD groups, so I'm also being a dungeon master.
00:03:29.599 --> 00:03:33.919
I've just written my first dungeon master adventure, which is a haunted house thing for Halloween.
00:03:34.159 --> 00:03:36.159
So, yeah, I'm getting into that as well.
00:03:37.360 --> 00:03:38.240
I do work as well.
00:03:38.479 --> 00:03:39.199
Can you say your name?
00:03:39.360 --> 00:03:41.520
Your dungeon, your dungeon and dragon name?
00:03:41.680 --> 00:03:44.080
Um uh dungeons and dragon name, my name is Arla.
00:03:44.479 --> 00:03:45.840
My character's called Arla.
00:03:46.000 --> 00:03:50.639
Arla is a level 15 cleric of Odin, and she's really cool.
00:03:50.719 --> 00:03:51.919
She's much cooler than I am.
00:03:52.080 --> 00:03:53.039
Much cooler than I am.
00:03:53.120 --> 00:03:55.919
She can raise giants from the dead and has done.
00:03:56.319 --> 00:03:57.520
Do you did you name it?
00:03:57.599 --> 00:04:00.159
Did you name her after the Arla dairy farm?
00:04:00.479 --> 00:04:01.840
Not exactly, no.
00:04:02.000 --> 00:04:03.599
Um, although I do quite like milk.
00:04:03.759 --> 00:04:07.360
No, um, it was just it's part of her sister's name.
00:04:07.520 --> 00:04:12.319
She was sister's called Togala, and she killed her sister by accident, so she took Arla as her name.
00:04:12.400 --> 00:04:13.360
That's why it ended up that way.
00:04:13.439 --> 00:04:15.599
It was just the milk is just a coincidence.
00:04:15.840 --> 00:04:16.879
Although they do make cheese.
00:04:19.120 --> 00:04:19.759
She doesn't.
00:04:19.920 --> 00:04:21.040
I wish she did have a chainsaw.
00:04:21.120 --> 00:04:23.360
No, she has a battle axe, which is actually really cool.
00:04:23.600 --> 00:04:25.600
But she's better with the magics.
00:04:26.720 --> 00:04:33.600
We could definitely do a whole episode on uh oh, I could I could give you an entire yeah, you don't want to do that.
00:04:33.759 --> 00:04:38.240
No, if you want to talk about procurement, you should stop me right now and redirect me, dude.
00:04:39.360 --> 00:04:47.279
Okay, I mean, not quite about procurement in terms of quick fire questions, but um if you can only have one meal for the rest of your life, what would it be?
00:04:48.399 --> 00:04:50.160
Egggy fried bread.
00:04:51.920 --> 00:04:57.040
I know that sounds ridiculous, but I I'm a little bit I'm a little bit obsessed with white food.
00:04:57.360 --> 00:05:05.519
Love white food, and mostly the food I eat is white food, so macaroni cheese and chicken nuggets that aren't chicken because I don't eat animals because it's mean.
00:05:05.680 --> 00:05:09.519
Um, and I like um uh toast and and eggs and stuff.
00:05:09.600 --> 00:05:12.720
So you yellow is kind of white to white food, right?
00:05:12.879 --> 00:05:16.319
Egggy fried bread is my absolute favourite food in the world.
00:05:16.560 --> 00:05:18.160
I would never get bored of eggy fried bread.
00:05:18.240 --> 00:05:22.959
As long as there was ketchup to eat it with it, I have to have ketchup, which I realise isn't white, but for some reason ketchup's a thing.
00:05:23.040 --> 00:05:23.759
I think it's the vinegar.
00:05:23.920 --> 00:05:24.319
I don't know.
00:05:24.480 --> 00:05:26.319
So yeah, egggy fried bread.
00:05:27.839 --> 00:05:30.720
Very much associated to the white to the white food there.
00:05:31.279 --> 00:05:32.000
I like white food.
00:05:32.079 --> 00:05:32.879
I do like white food.
00:05:32.959 --> 00:05:39.120
I don't know what it is about white food, it's it's low-level stress in terms of food processing.
00:05:39.279 --> 00:05:48.240
So um, if you eat something spicy, there's a lot of process and thought and and and sensory stuff that goes into that, particularly if your lips start tingling, which I'm not a huge fan of, right?
00:05:48.399 --> 00:05:50.879
So so bland, white, boring.
00:05:51.040 --> 00:05:55.199
I don't get surprised by it, therefore it doesn't take quite so much effort to eat it.
00:05:56.399 --> 00:05:58.720
So I'll bite my tongue not to say something outrageous.
00:05:58.800 --> 00:06:00.319
So we'll just we'll just move on to the next one.
00:06:00.480 --> 00:06:02.160
You can say anything as outrageous as you like.
00:06:02.319 --> 00:06:03.439
I am not I am not a lot of it.
00:06:03.920 --> 00:06:04.399
I know you are.
00:06:04.480 --> 00:06:06.000
No, no, I'm just thinking of the listeners.
00:06:06.240 --> 00:06:06.720
Oh, okay.
00:06:07.040 --> 00:06:08.319
Yeah, yes, okay.
00:06:08.399 --> 00:06:10.399
Let's not offend the listeners, that would be bad.
00:06:12.800 --> 00:06:17.839
Okay, the next question is um a trolley is heading down a track heading towards two people.
00:06:18.079 --> 00:06:22.560
You have the option to pull the lever and switch it to a different track where it hits one person.
00:06:22.720 --> 00:06:24.800
Would you do it or would you leave it?
00:06:26.720 --> 00:06:28.160
Okay, so trolley problem.
00:06:28.240 --> 00:06:29.279
This is one of those fun ones.
00:06:29.439 --> 00:06:31.439
I am quite obsessed with the good place.
00:06:31.920 --> 00:06:36.879
So I have actually lived through many, many examples, many examples of the trolley problem.
00:06:37.279 --> 00:06:44.399
I believe that the solution which was come up with by Michael uh towards the end was I solved the trolley problem.
00:06:44.560 --> 00:06:45.439
I kill myself.
00:06:45.600 --> 00:06:48.160
No trolley driving to kill anybody.
00:06:49.279 --> 00:06:52.879
But if I have to stay on and I have to, I would rather kill one person than two.
00:06:54.959 --> 00:06:55.279
Okay.
00:06:55.839 --> 00:06:58.720
Unless I know them, and then it becomes a whole other decision.
00:06:59.759 --> 00:07:03.360
Or if there's an animal anywhere nearby, I don't, I don't, I don't know the number of animals.
00:07:03.519 --> 00:07:05.519
People would die before animals with me.
00:07:07.120 --> 00:07:08.480
Hit a person, hit a dog.
00:07:08.639 --> 00:07:10.319
Definitely the person's going down.
00:07:12.000 --> 00:07:17.519
So the next uh quick five questions, probably the only well, the last two are procurement-related ones.
00:07:17.600 --> 00:07:19.120
I know it's taken us this long to get into them.
00:07:19.439 --> 00:07:19.759
It's okay.
00:07:20.959 --> 00:07:27.279
The last the second last one is uh what's your worst procurement slash buying decision that you've made?
00:07:28.720 --> 00:07:30.160
That's a very good question.
00:07:30.319 --> 00:07:33.279
Um, I am an impulsive buyer of books.
00:07:34.079 --> 00:07:44.800
Um I realise the listeners can't see this, but behind me I I am sat in a very large library that is now so full that there are books stacked in piles on the floor because there is no shelf space left.
00:07:45.040 --> 00:07:47.040
So I'm a I'm buy books.
00:07:47.839 --> 00:07:48.800
You haven't read them all right.
00:07:49.279 --> 00:07:51.439
Oh yes, everything it's a working library.
00:07:51.600 --> 00:07:55.439
I could tell you what's in every single one of them if you wanted me to, but that's beside the point.
00:07:55.600 --> 00:08:01.600
So as far as sort of regret goes, I have a couple of really, really big books.
00:08:01.839 --> 00:08:10.240
Now I don't regret them in terms of oh my god, they're the most beautiful books in the world, but they cost me a fortune and I have nowhere sensible to store them.
00:08:10.560 --> 00:08:14.079
And oversized books don't fit on shelves, and then that that's a problem.
00:08:14.319 --> 00:08:17.920
Um, other than that, what else do I regret?
00:08:18.079 --> 00:08:20.000
Oh, I just bought a hovel in France.
00:08:20.240 --> 00:08:23.040
That was, I mean, the plan was good.
00:08:23.279 --> 00:08:29.519
The plan was good, but now we've actually got the property, which you can't live in because it's a hovel.
00:08:29.680 --> 00:08:33.679
Um, I'm now stuck with trying to find someone to make it less hovel-like.
00:08:33.840 --> 00:08:40.559
However, nobody will actually do the work unless I pay them like£200,000, which by the way, the work is not worth that.
00:08:40.720 --> 00:08:44.480
And also I had to speak to them in French to get them to do it, which is very difficult.
00:08:44.639 --> 00:08:47.759
Um, so yes, that's turning into a bit of a nightmare, but it is what it is.
00:08:47.840 --> 00:08:49.440
We'll get there eventually.
00:08:50.399 --> 00:08:52.000
It's an interesting procurement, isn't it?
00:08:52.080 --> 00:08:53.919
We should say about that alone.
00:08:54.080 --> 00:08:57.360
Just how to procure a house in France and what not to do.
00:08:57.679 --> 00:09:01.759
Uh yeah, don't listen to the French estate agents, would be number one on my list.
00:09:02.480 --> 00:09:07.679
Be aware that if a house costs£20,000, that's not what that house costs, that's just what you're buying it for.
00:09:10.080 --> 00:09:10.720
Yeah.
00:09:11.279 --> 00:09:13.600
French French procurement nightmares.
00:09:13.679 --> 00:09:15.519
I I could yeah, fill reams.
00:09:15.679 --> 00:09:16.320
Anyway, yes.
00:09:16.399 --> 00:09:16.799
Next question.
00:09:16.879 --> 00:09:17.919
You had one more, I think.
00:09:18.240 --> 00:09:21.039
Next question was uh the one we we asked quite a few.
00:09:21.120 --> 00:09:26.320
We're building a little zoo, so we're trying to work out what animal would be best in procurement and why.
00:09:26.879 --> 00:09:27.519
Hmm.
00:09:28.159 --> 00:09:30.720
See, there's a lot of possible answers to this.
00:09:30.799 --> 00:09:37.279
You could go with, you know, an eagle owl because you are wise and see all, but honestly, that doesn't directly apply, does it?
00:09:37.440 --> 00:09:38.960
How about a capybara?
00:09:40.000 --> 00:09:46.799
I think your capy baras, because your capibas are like the most chill animals on the planet.
00:09:46.960 --> 00:09:50.879
You can do anything you like to a capybara and it'll just sit there and take it.
00:09:51.039 --> 00:09:55.200
Plus, they're friends with everybody and they just wumble around being chilled.
00:09:55.440 --> 00:09:56.320
Capy baras are.
00:09:56.559 --> 00:09:57.120
Oh wow.
00:09:57.360 --> 00:09:58.799
The call's useless there, look.
00:09:58.960 --> 00:10:00.480
That's that's what she's actually just said.
00:10:00.720 --> 00:10:01.440
Yeah, yeah.
00:10:05.679 --> 00:10:07.039
Capibaras are awesome.
00:10:07.120 --> 00:10:10.960
That they just chill with everybody, they're friends with the entire animal world.
00:10:11.759 --> 00:10:20.000
I think that depends on which person you're dealing with, those are because I'm sure you've experienced useless ones or the odd one.
00:10:22.720 --> 00:10:25.120
She has worked with Luke One, by the way, listeners.
00:10:26.559 --> 00:10:27.039
Very close.
00:10:27.440 --> 00:10:30.320
Oh, he's definitely, definitely not ranked as one of the useless ones.
00:10:30.399 --> 00:10:32.480
There are far more useless than Locke.
00:10:35.039 --> 00:10:37.440
The bar is a lot lower, so it's uh it's alright.
00:10:37.759 --> 00:10:39.440
Yeah, you're definitely above the bar.
00:10:39.600 --> 00:10:40.799
Definitely above the bar.
00:10:41.120 --> 00:10:43.679
Some of my bestest friends are in procurement.
00:10:44.000 --> 00:10:44.399
Thank you.
00:10:44.480 --> 00:10:45.759
That's very kind of you to say.
00:10:47.039 --> 00:10:50.399
Can I ask a really simple question to start with that I think everyone would like to know?
00:10:50.480 --> 00:10:56.320
What is data protection and why does it why why why do I care about it or as an everyday okay?
00:10:56.559 --> 00:10:59.519
In a nutshell, you care about it because you're a data subject.
00:10:59.600 --> 00:11:01.519
So you have personal data, I assume.
00:11:01.679 --> 00:11:02.080
Yes.
00:11:02.320 --> 00:11:06.399
So everybody has a personal data, and personal data is data that is ascribed to them.
00:11:06.559 --> 00:11:12.960
So it's uh things like your name, your address, your telephone number, not always as an individual, sometimes context.
00:11:13.039 --> 00:11:16.559
So the more data you have, the more you can individually identify that person.
00:11:16.879 --> 00:11:20.879
And the whole point of data protection is to protect that data.
00:11:21.039 --> 00:11:30.399
So we want to make sure that when you buy something dodgy off Amazon, Amazon don't then turn around and tell the entire world about this dodgy thing you just bought.
00:11:30.799 --> 00:11:32.720
Okay, just an instance.
00:11:32.960 --> 00:11:44.320
So we want to make sure we protect people's data because we are also protecting ourselves in the process, and also because the law has an awful lot of penalties to it that nobody wants to be on the receiving end of.
00:11:44.480 --> 00:11:45.679
So that's a good idea too.
00:11:45.759 --> 00:11:47.440
And it is a law, it's a requirement.
00:11:47.600 --> 00:12:02.159
So we we have to be compliant, it's important, and it's everybody's problem because believe it or not, pretty much everybody in business has access to some personal data, even if it's just the email addresses of colleagues or or people in other businesses, it's still personal data that will identify an individual.
00:12:02.320 --> 00:12:04.720
So we all have to know about it and look after it.
00:12:05.519 --> 00:12:06.399
Succeed enough.
00:12:06.480 --> 00:12:08.320
I can do I can do it in less words if you like.
00:12:08.559 --> 00:12:09.440
No, no, that's good.
00:12:09.519 --> 00:12:10.559
That's good, that's really helpful.
00:12:10.639 --> 00:12:21.519
I think a lot of people take it for I don't know, I don't know if it's ignorance or just for granted or what it is, but a lot of a lot of suppliers, for example, will say they don't process any data.
00:12:21.679 --> 00:12:25.919
Um, but then you ask them how they're talking to me right now and and how they phoned me last week.
00:12:26.320 --> 00:12:33.039
Basically, a lot of people don't equate business personal data with being personal data, but it still is.
00:12:33.200 --> 00:12:39.840
I mean, if you have a work email address, my work email address is my first name, my last name, and the company I work for, that narrows it down quite a bit.
00:12:40.000 --> 00:12:42.559
That is a piece of personal data that will personally identify me.
00:12:42.720 --> 00:12:44.960
Therefore, you still need to look after that data.
00:12:45.120 --> 00:12:50.799
Even in instances where all you're doing is, I don't know, buying paper for the printer.
00:12:50.960 --> 00:12:59.120
If you are exchanging those sorts of details with the person you're buying paper from, you need to have a data sharing agreement in place so that you're doing it properly and within the law.
00:13:00.399 --> 00:13:06.000
Do you think the average person cares about their data being protected or not?
00:13:06.240 --> 00:13:07.279
It's a good question.
00:13:07.440 --> 00:13:10.960
Um, most people don't care if it requires them to do something.
00:13:12.559 --> 00:13:18.320
Um, a lot of people leave Alexa running and don't turn Alexa off, and Alexa picks up all sorts of things.
00:13:18.399 --> 00:13:20.480
So, you know, a lot of people don't seem to care.
00:13:20.639 --> 00:13:25.840
There's a lot of people who just like just what do you say about Luke 10 clicking accept on all the cookies on the websites?
00:13:26.159 --> 00:13:27.600
It just doesn't read in terms of it.
00:13:27.679 --> 00:13:28.720
Yeah, it doesn't read absolutely.
00:13:29.039 --> 00:13:30.480
There are quite a few people that do that.
00:13:30.639 --> 00:13:33.919
Um, but there are some people that really don't want their data out there.
00:13:34.080 --> 00:13:39.120
I mean, I don't use social media because I don't want to be well sucked into that black hole of nonsense.
00:13:39.200 --> 00:13:41.200
But also, I don't want that much of my data out there.
00:13:41.279 --> 00:13:42.639
I'd rather be a little bit, you know.
00:13:42.799 --> 00:13:48.559
But then I think about how much data the bank has on me or Amazon has on me, and I think, yeah, they know more about me than God does.
00:13:48.639 --> 00:13:51.679
So but I wouldn't want that information to be spread.
00:13:51.759 --> 00:13:55.679
I mean, then you get into things like, well, the NHS has to protect data.
00:13:55.840 --> 00:14:01.679
What if you get, you know, diagnosed with some horrible disease and you don't want everyone to know, and the NHS were just putting it on a website somewhere?
00:14:02.879 --> 00:14:17.279
Interesting, actually, because when my um my wife was giving birth, and not like specifically in the moment, but during that time, um, the midwife don't have access to her like standard blood tests and heart rates and any results she's done before.
00:14:17.519 --> 00:14:18.960
That is purely separate.
00:14:19.120 --> 00:14:23.039
And and we at the time we were thinking, well, why can't you just look at that?
00:14:23.120 --> 00:14:24.240
Like, what's what's the big harm?
00:14:24.320 --> 00:14:25.519
It's all it's all the NHS.
00:14:25.600 --> 00:14:30.559
But they were saying, you know, it's it's people don't necessarily consent to that and it's for specific purposes.
00:14:31.039 --> 00:14:33.440
You can if it's a matter of life or death.
00:14:33.519 --> 00:14:43.279
So there's actually um it actually says in the law that processing personal data is illegal unless you fall under one of these seven legal bases.
00:14:43.360 --> 00:14:50.080
Now, technically in the law it's six, but the data protection, data, uh, sorry, digital use and access act of this year has increased that number to seven.
00:14:50.159 --> 00:14:52.000
So there are now seven legal bases.
00:14:52.159 --> 00:14:54.879
One of the legal bases is called vital interests.
00:14:55.120 --> 00:15:02.639
Just so there's any salesman out there, that does not mean the vital interests of the company, you know, selling more stuff is not a vital interest, just so we're clear.
00:15:02.879 --> 00:15:06.639
Vital interest means someone could die, and it could be the person or someone related to them.
00:15:06.720 --> 00:15:13.200
So an instance of this is you know somebody at work has a really bad uh peanut allergy and they carry an EpiPen, right?
00:15:13.440 --> 00:15:21.279
If that person starts having anaphylactic shock, and you tell a first aider or a first responder that they have a peanut allergy, you are covered under that vital interest.
00:15:21.519 --> 00:15:27.039
So if your wife had had serious problems or there was a need for that data, it could have been shared if necessary.
00:15:29.200 --> 00:15:30.799
What are the other ones?
00:15:31.120 --> 00:15:34.480
Okay, so the first one, the first one's the one everyone knows, which is consent.
00:15:34.639 --> 00:15:34.879
Yeah.
00:15:35.120 --> 00:15:36.399
Okay, so that is consent.
00:15:36.480 --> 00:15:40.399
And the big thing about consent is it has to actually be proper consent.
00:15:40.480 --> 00:15:41.759
So you have to tell the person.
00:15:41.840 --> 00:15:43.759
So you can't just say we're gonna keep your data.
00:15:43.840 --> 00:15:44.799
Do you want us to?
00:15:45.039 --> 00:15:48.879
You actually have to explain why, what you're gonna use it for, how long you're gonna keep it.
00:15:49.039 --> 00:15:51.840
So consent, it also has to be something that's freely given.
00:15:51.919 --> 00:15:55.840
So you can't, you know, those pre-tick boxes used to have, yeah, you can't do those anymore.
00:15:55.919 --> 00:15:58.240
No, they have to actually actively tick to say that they're willing.
00:15:58.320 --> 00:15:59.440
So consent's a big one.
00:15:59.600 --> 00:16:03.200
Um, under that, you've got um uh a sort of a contractual.
00:16:03.600 --> 00:16:08.960
So contractual obligation is you've signed a contract with somebody and you're going to share data because of that contract.
00:16:09.120 --> 00:16:18.720
If you have that, which is where procurement comes in, usually there's going to be a data sharing agreement or there's going to be a data processing agreement, depending on what kind of contractual relationship you're going to have.
00:16:18.879 --> 00:16:27.759
If you think about it, the reason our companies can keep data on us is because we have contractual obligations because we've signed an employee contract.
00:16:27.919 --> 00:16:29.919
So that all comes under contract, right?
00:16:30.080 --> 00:16:36.480
And then you is that when you get terms like uh data processor, data controller, some of the data.
00:16:36.639 --> 00:16:38.559
So yeah, data processor, data control.
00:16:38.799 --> 00:16:41.840
Data controller is the person who makes the decisions about the data.
00:16:42.000 --> 00:16:43.759
So they're ultimately responsible.
00:16:43.919 --> 00:16:48.000
They're the ones that say we're going to process it in this way, we're going to do this with it, blah, blah, blah.
00:16:48.240 --> 00:16:54.879
A data processor is someone usually employed by the data controller to then go and do other processing with it.
00:16:55.039 --> 00:16:59.600
So another example of this would be um what's a really good example that I've got?
00:16:59.759 --> 00:17:01.360
Um, oh, I've got one.
00:17:01.519 --> 00:17:03.679
So um the companies are security clearance.
00:17:03.759 --> 00:17:11.599
So they they are the data controller of their employees' information for the security clearance, but they then send it to a third party who processes that clearance.
00:17:11.680 --> 00:17:14.799
So they become the data processor for the data controller.
00:17:15.119 --> 00:17:18.000
Ultimately, none of these people actually own that data.
00:17:18.160 --> 00:17:19.519
The data subject does.
00:17:19.759 --> 00:17:23.519
Hence the reason data subjects have rights, which lots of people don't know about.
00:17:24.559 --> 00:17:27.759
Can a legal entity be a data subject, or is it always an individual?
00:17:28.079 --> 00:17:30.160
It's it's a natural living person.
00:17:30.319 --> 00:17:33.200
Notice I said living, dead people don't have these rights.
00:17:36.400 --> 00:17:36.960
That's crazy.
00:17:37.279 --> 00:17:39.119
Just living people have rights.
00:17:39.920 --> 00:17:45.680
So yeah, entities come companies are entities, they may be legal people, but they're not people people.
00:17:45.839 --> 00:17:48.319
So they're not naturally living, generally speaking.
00:17:49.759 --> 00:17:51.039
Does gender matter?
00:17:52.319 --> 00:17:54.000
Does gender make a difference?
00:17:54.960 --> 00:17:55.279
No.
00:17:56.319 --> 00:17:57.759
No, it's it's all peoples.
00:17:58.079 --> 00:17:59.839
Peoples who are living with a heartbeat.
00:18:00.240 --> 00:18:02.559
If I identify as dead, would I?
00:18:03.359 --> 00:18:04.640
That's an interesting question.
00:18:04.799 --> 00:18:08.400
I I don't think I think you'd struggle to identify as dead.
00:18:09.119 --> 00:18:18.960
Although I did hear about a woman whose data was um was was corrupted, and they identified her as dead, and she's been alive, and she can't get them to make her alive again because the computer won't let them.
00:18:19.039 --> 00:18:22.640
So she's been officially dead for four years, but natural fact she's not dead.
00:18:22.799 --> 00:18:26.160
Yeah, so these weird things are do anything.
00:18:26.240 --> 00:18:28.400
And and everyone's just like, well, can't we just fix the computer?
00:18:28.640 --> 00:18:30.640
No, you know, can't fix the computer.
00:18:30.960 --> 00:18:31.440
Very weird.
00:18:31.519 --> 00:18:32.720
I don't think it's this country, by the way.
00:18:32.799 --> 00:18:35.519
I think it's somewhere like Germany, but yeah, she's kind of stuck.
00:18:35.680 --> 00:18:36.720
But these things happen.
00:18:36.799 --> 00:18:37.359
Where was I?
00:18:37.440 --> 00:18:44.160
Oh, yeah, so uh consent, uh contractual, then we've got um uh public interest, so or public public task.
00:18:44.240 --> 00:18:50.640
So you've got people like the police, they can hold data because well, they're stopping us from killing each other on trains, all those kind of fun things.
00:18:50.720 --> 00:18:59.279
So they get to hold data for that reason, specific purpose, they can't then decide to you know ring you up and go, we've got your information because you robbed this house the other week.
00:18:59.440 --> 00:19:02.400
We'd like to put you down for some raffle tickets for the police ball.
00:19:02.480 --> 00:19:03.119
You can't do that.
00:19:03.200 --> 00:19:05.920
That that's a change of purpose, definitely not allowed.
00:19:06.160 --> 00:19:09.519
Um, they've then got um a sort of statutory obligation.
00:19:09.759 --> 00:19:22.480
So there's a there's a difference between public public trust public interest, which could include the NHS, and then having something like the police, which have a uh statute authority where they have to be able to do this, so they can go do that.
00:19:22.640 --> 00:19:25.039
Um, we've got um oh legitimate interest.
00:19:25.119 --> 00:19:26.160
Oh, I hate legitimate interest.
00:19:26.319 --> 00:19:26.960
I like this one.
00:19:27.359 --> 00:19:37.759
Oh, legitimate interest, legitimate interest is an absolute nightmare, and everyone wants to use it because they think it's like a get out of jail free card.
00:19:38.160 --> 00:19:42.640
So the concept with legitimate interest, and this is where it gets really, really complicated.
00:19:42.880 --> 00:19:56.720
But the concept is you can you write a legitimate interest assessment where you say that the the data subject are gonna benefit more than you are from this processing of their data, and it's not anything that they wouldn't expect, and yada yada yada.
00:19:56.799 --> 00:19:59.039
So, for example, you have an event, right?
00:19:59.119 --> 00:20:02.559
You have a a Big thing, people come to London and they all attend this event.
00:20:02.720 --> 00:20:06.799
And you've taken their data and you state on the purpose it's for managing the event.
00:20:06.880 --> 00:20:10.960
So it's for giving out passes and tickets and for taking information off people, right?
00:20:11.039 --> 00:20:11.680
For the event.
00:20:11.839 --> 00:20:16.400
Afterwards, you're like, we'd like to sell, we'd like to sell some stuff to people at the event.
00:20:16.880 --> 00:20:18.480
Yeah, you didn't say that on your purpose.
00:20:18.559 --> 00:20:28.240
So you then have to create this legitimate interest where you explain that actually, because they attended this event, they would be very, very interested in having this training that comes afterwards that you're going to try and sell them.
00:20:28.319 --> 00:20:32.240
It's directly related to the thing they had the event about, and you have to balance it basically.
00:20:32.480 --> 00:20:42.400
It's it's always a little bit like playing Russian roulette with the ICO, because you never really know if it's going to be accepted or not until it either is or it isn't.
00:20:42.720 --> 00:20:45.119
Yeah, by which time it's usually too late.
00:20:45.200 --> 00:20:47.200
So it's actually quite stressful.
00:20:47.359 --> 00:20:49.440
But yeah, legitimate interest is another one.
00:20:49.519 --> 00:20:50.319
We also have one.
00:20:50.640 --> 00:20:51.839
What's it called?
00:20:52.319 --> 00:20:53.200
It's the new one.
00:20:53.279 --> 00:20:59.279
So the digital use and access, which oh, oh, that was an interesting law that they passed.
00:20:59.359 --> 00:21:06.319
So the digital use and access um one enabled a new legal basis, which is something like is it regulated?
00:21:06.880 --> 00:21:07.599
What's it called?
00:21:07.680 --> 00:21:08.799
I'm sure it's called something.
00:21:08.880 --> 00:21:09.359
No, it's not.
00:21:09.440 --> 00:21:11.680
Hold on one second, it'll come to me in a minute.
00:21:12.400 --> 00:21:13.359
What's it called?
00:21:13.599 --> 00:21:15.440
Something like regulated legitimate interest.
00:21:15.519 --> 00:21:24.799
And basically what it is is it's the assumption that people like the police and the NHS can automatically have legitimate interest and they don't need to fill out an LIA.
00:21:25.039 --> 00:21:29.359
So because they are who they are, basically it means the government can take more data off you and use it.
00:21:29.440 --> 00:21:32.880
And I think it's because they want to bring in these electronic ID things as well.
00:21:34.559 --> 00:21:37.680
So they have a legitimate interest for keeping it, and I'm just like, mm-hmm, okay.
00:21:37.759 --> 00:21:39.359
We've talked about vital interests already.
00:21:39.440 --> 00:21:42.160
So vital interest is if someone's dying, and I think that's all of them.
00:21:42.240 --> 00:21:43.200
Did I cover them all?
00:21:43.359 --> 00:21:46.000
Consent, contract, legal, oh, legal obligation.
00:21:46.160 --> 00:21:48.640
So legal obligation means you require by law to do it.
00:21:48.720 --> 00:21:54.880
So that could be as an employer, you have to take a copy of people's passports to show that you've checked their right to work.
00:21:55.440 --> 00:22:02.559
Legal obligation, vital interest, public tarse, the police or whatever, uh, legitimate interest, and then there's like regulatory legitimate interest.
00:22:03.119 --> 00:22:04.880
That's the only way you're allowed to process data.
00:22:04.960 --> 00:22:08.319
If you can't fit into any of those, you are not legally allowed to process it.
00:22:08.640 --> 00:22:15.359
It's impressive that you managed to uh to come up with all seven categories and give us uh an explanation on that.
00:22:15.519 --> 00:22:19.359
I'm not sure that we could do the procurement cycle or the categories of that.
00:22:19.440 --> 00:22:25.599
So uh you mentioned the procurement cycle's either got seven or twelve or twenty-four.
00:22:26.160 --> 00:22:27.359
How many steps it's got, yeah.
00:22:27.759 --> 00:22:34.720
Oh, we've got we've got the seven the seven principles of GDPR, GDPR, we've got seven legal bases, and those are the the two main things.
00:22:34.880 --> 00:22:40.960
Then we've got like the depending on how it's been taken from the the data subject, data subject rights, which there's about 12 of.
00:22:41.119 --> 00:22:42.319
We don't have that many.
00:22:42.799 --> 00:22:45.440
Depends on the ICO, and what's their what's their problem?
00:22:46.559 --> 00:22:48.319
Where do you want to start?
00:22:48.720 --> 00:22:50.079
Well, what does it stand for?
00:22:50.400 --> 00:22:53.440
Okay, ICO, the infation commissioner's office.
00:22:53.759 --> 00:23:01.359
They are the independent um public body who monitor the GDPR and PECA.
00:23:01.440 --> 00:23:04.559
Um and and those I should probably say what PECA is as well, shouldn't I?
00:23:04.640 --> 00:23:09.039
Yes, Privacy and Electronic Communications Act, um, and the Digital Use and Access Act.
00:23:09.119 --> 00:23:11.359
So they're the ones that sit there giving those fines out.
00:23:11.440 --> 00:23:14.400
You know, when everyone goes, oh, the fines, the fines are scary.
00:23:14.559 --> 00:23:17.200
Um, they're the guys that give the fines, except they don't.
00:23:17.440 --> 00:23:26.640
If you look at the German version of this, so in Germany, they have um an ICO in every single one of their states, and then a main one over the top.
00:23:26.799 --> 00:23:32.240
And since the the law came out in 2016, they've delivered something like 218 fines.
00:23:32.799 --> 00:23:37.839
Whereas if you look at our ICO, we have a single one and in the same time period they've delivered 16.
00:23:38.799 --> 00:23:40.400
Can you name and shame the single one?
00:23:40.480 --> 00:23:41.359
Is it public info?
00:23:41.519 --> 00:23:43.519
Uh oh yes, it's on the they post it on the website.
00:23:43.599 --> 00:23:45.680
That's one of the reasons we don't want to fall foul of the ICO.
00:23:45.759 --> 00:23:48.799
It's not necessarily the fine, it's the fact that they publish everything on their website.
00:23:48.880 --> 00:23:50.880
And so the reputational damage is the big deal.
00:23:51.039 --> 00:23:54.720
Um, uh the big one was um they had one with uh British Airways.
00:23:54.880 --> 00:24:03.519
So quite recently they find British Airways a mega fuck ton of money because you see, I said the word I knew I was going to at some point, but a whole load of money, right?
00:24:03.680 --> 00:24:08.160
Um, because they they lost their data, their their data subjects' data.
00:24:08.240 --> 00:24:10.079
They didn't have a secure system, I think.
00:24:10.400 --> 00:24:19.119
So losing that it's not necessarily using it in the wrong way, it's also if you collect the data and then you just it just disappears, you can get fired.
00:24:19.359 --> 00:24:23.839
Well, one of the well, the seven principles, one of the seven principles is integrity and confidentiality.
00:24:23.920 --> 00:24:28.079
So if you're not keeping that data secure, you're automatically in breach of GDPR.
00:24:28.559 --> 00:24:37.200
So yeah, if you allow someone to hack into your system and you don't notice that they've stolen 200,000 people's credit cards, yeah, yeah, that's a problem.
00:24:38.400 --> 00:24:45.279
So are they does PECK deal with just companies or are they individuals as well?
00:24:45.680 --> 00:24:47.839
PECKA and GDPR kind of work together.
00:24:47.920 --> 00:25:01.599
So PECA deals with companies and people, um, but it's more companies in the delivery of it simply because it's aimed at people originally who you know you used to send those spam emails and spam telephone calls, it was aimed at things like that.
00:25:01.759 --> 00:25:04.400
So you can only ring this number of times in a certain amount of time.
00:25:04.480 --> 00:25:07.039
If they don't pick up in three rings, you have to put down that kind of thing.
00:25:07.200 --> 00:25:09.599
But they also cover things like cookies on websites.
00:25:10.319 --> 00:25:13.759
So why does why do Timu still hound me like there's no tomorrow?
00:25:13.920 --> 00:25:15.599
Because I once downloaded their app.
00:25:15.920 --> 00:25:17.359
And where are Timo based?
00:25:20.400 --> 00:25:20.720
Right.
00:25:21.039 --> 00:25:25.519
China has some very strong data protection rules, but they only apply to foreigners operating in China.
00:25:27.839 --> 00:25:32.400
Well, so our government can't do anything about it if we decide to download a Chinese data app.
00:25:38.640 --> 00:25:40.720
Why is this important in procurement?
00:25:41.440 --> 00:25:43.119
Why is it procurement in procurement?
00:25:43.279 --> 00:25:49.200
Well, the first thing is, as we've already established, any kind of activity you do, there might well be personal data attached to it.
00:25:49.359 --> 00:25:53.119
Procurement, especially so, depending on what kind of activity you're doing.
00:25:53.279 --> 00:25:56.079
So it starts literally at the contract stage.
00:25:56.240 --> 00:25:59.680
So it starts at, okay, in the contract, what are we doing?
00:25:59.759 --> 00:26:01.119
What's the purpose of the contract?
00:26:01.279 --> 00:26:01.519
Right?
00:26:01.680 --> 00:26:09.119
So the purpose of the contract is um, I know these people we're going to employ them to vet some of our new people who are coming in when we recruit them, right?
00:26:09.359 --> 00:26:13.440
They're going to get a whole load of data, which we're going to be the data controller for.
00:26:13.599 --> 00:26:15.920
Therefore, they're going to have to be the data processor.
00:26:16.079 --> 00:26:17.599
Are they going to be the data processor?
00:26:17.680 --> 00:26:18.480
Have we established that?
00:26:18.640 --> 00:26:21.759
Because you can also have a data controller to data controller agreement.
00:26:22.000 --> 00:26:23.359
So which one is it going to be?
00:26:23.440 --> 00:26:25.039
It's data controller to data controller.
00:26:25.200 --> 00:26:30.400
So when we give them the data, they also then become owners of that and can make decisions on that data.
00:26:30.480 --> 00:26:36.640
If that's the case, we need a data sharing agreement in place to make sure that they don't add them to marketing lists unless they ask for consent.
00:26:36.799 --> 00:26:40.960
They store it for a reasonable amount of time, they don't ship it outside the UK, whatever.
00:26:41.119 --> 00:26:41.440
Okay.
00:26:42.079 --> 00:26:45.440
If it's they're going to be our processors, then we carry that duty of care.
00:26:45.519 --> 00:26:46.880
It's ultimately our responsibility.
00:26:46.960 --> 00:26:55.599
So we have to do our due diligence, make sure we've got our data processing agreement in place to make sure they're not doing anything dodgy, obstentially in our name, with people's data.
00:26:58.240 --> 00:27:05.920
At what point do you think in the in the sort of procurement or sourcing activity should data protection stuff be considered?
00:27:07.680 --> 00:27:09.200
It's just a trick question.
00:27:09.359 --> 00:27:15.759
Um, from the get-go, basically, everything is going to require some sort of data consideration.
00:27:15.920 --> 00:27:22.640
Every single thing that is bought, every single item that goes through procurement should be considered with a data protection lens attached to it.
00:27:22.799 --> 00:27:27.519
Um, it should also, any supplier we bring on should be vetted for their data protection.
00:27:27.599 --> 00:27:30.319
So it's not just we need to consider it in the contract stage.
00:27:30.480 --> 00:27:38.480
Once we've got past the contract stage and we're actually willing to actually take them on as a supplier or whatever, we need to then consider okay, have we done our due diligence?
00:27:38.640 --> 00:27:42.480
If they're signing this contract, how do we know that they're going to live up to it?
00:27:42.640 --> 00:27:44.960
Do they have a privacy policy on their website?
00:27:45.119 --> 00:27:46.400
What does that cover?
00:27:46.640 --> 00:27:50.640
Um, do they know what we're talking about when we talk about retention periods?
00:27:50.799 --> 00:27:51.680
Can they prove it?
00:27:51.839 --> 00:27:53.359
Do they have any documentation for this?
00:27:53.519 --> 00:27:55.119
Are they registered with the ICO?
00:27:55.200 --> 00:27:57.359
There's all sorts of due diligence that we need to do as well.
00:27:57.519 --> 00:27:58.559
So all of that takes time.
00:27:58.640 --> 00:28:03.039
So honestly and truly, from as soon as you decide you want to take them on as a supplier.
00:28:03.920 --> 00:28:05.279
Well, there's a difference there.
00:28:05.519 --> 00:28:13.759
When procurement decides to take them on as a supplier versus when a sleazy, scummy salesperson or yeah, as long as they're getting kickbacks.
00:28:14.319 --> 00:28:16.559
Yeah, oh, oh, we don't know about that.
00:28:16.880 --> 00:28:17.759
Oh yeah.
00:28:20.240 --> 00:28:26.160
If we were gonna get a million pounds in a briefcase, would you would you let uh would you let a breach slip?
00:28:27.119 --> 00:28:33.119
No, because uh what it would cost the company is is up to four percent of global turnover.
00:28:33.279 --> 00:28:35.839
Global global turnover would be five billion.
00:28:36.079 --> 00:28:39.039
You're you're talking about 285 million pounds fine.
00:28:39.200 --> 00:28:39.839
So no.
00:28:40.640 --> 00:28:46.079
If it was for SAR Limited, surely, surely that's getting tempted, isn't it?
00:28:46.400 --> 00:28:47.119
Not really.
00:28:47.200 --> 00:28:49.839
I I I actually believe the law's there for a reason.
00:28:49.920 --> 00:28:57.680
I believe it should be supported, and I think circumventing it to make a quick buck is a very fast way to end up in a world of hurt.
00:29:01.359 --> 00:29:03.839
No, I'd be in charge in prison.
00:29:06.799 --> 00:29:09.359
Okay, so let's let's talk about suppliers suppliers then.
00:29:09.440 --> 00:29:15.519
So our suppliers, suppliers, suppliers, so you end up getting like an extended chain of supply.
00:29:15.920 --> 00:29:20.000
How far down do we need to be all over from a data protection perspective?
00:29:20.240 --> 00:29:24.960
Is it is it good enough to just put a robust contract in place with your direct supplier?
00:29:25.359 --> 00:29:29.200
It depends how you've done it, it depends how everything's been set up, right?
00:29:29.519 --> 00:29:34.400
So in some cases, um, we've had um experience where we've taken on supply.
00:29:34.480 --> 00:29:45.839
In actual fact, we've had to flow down contractual requirements from an original customer through us to that supplier, and then expect them to do the same to their suppliers.
00:29:46.000 --> 00:29:49.519
So it depends on what kind of thing you're doing.
00:29:49.759 --> 00:30:01.359
Um, I would certainly have something in your agreement that says something along the lines of um data processor is responsible for anything done by suppliers they bring on.
00:30:01.440 --> 00:30:13.599
And you can either state that they have to have your agreement before they can bring a supplier on, or that the um data protection clause and the data protection requirements in the contract are filtered down to any other supplier that they have.
00:30:13.920 --> 00:30:22.160
It can sometimes get a bit tricky because certain people will be like, yeah, but we use Microsoft 365, they're not going to agree to our rules.
00:30:22.559 --> 00:30:23.839
Fine, we get that.
00:30:24.000 --> 00:30:31.599
They have their own requirements, and you can actually go and look up their stuff online, they're fairly open with what they do for data protection and information security to a certain amount.
00:30:31.759 --> 00:30:35.759
Same with Amazon and the big boys, they already have stuff pre-printed.
00:30:35.920 --> 00:30:42.559
Um, also, you have to assume if Amazon's going to go down, the likes of us will be the least of anyone's problems as planes drop out of the sky.
00:30:42.640 --> 00:30:44.160
So it's hardly a big deal.
00:30:44.240 --> 00:30:51.759
Um, but yeah, it's generally it depends on what what the supplier is, what supplier is supplying, how sensitive the data is.
00:30:51.920 --> 00:30:55.759
So there's two different types of data there's personal data and special category personal data.
00:30:56.000 --> 00:31:01.039
Special category personal data actually comes with its own set of legal um bases to process.
00:31:01.119 --> 00:31:02.559
So it depends what it is.
00:31:02.720 --> 00:31:09.440
If it's highly sensitive stuff, you're gonna want to have something going down possibly to third level, depending on on what they're doing with the data.
00:31:09.599 --> 00:31:11.599
So it's a kind of case by case thing.
00:31:11.839 --> 00:31:15.200
So what special category is that like Luke Temp's haircut?
00:31:16.480 --> 00:31:18.000
That's not special category.
00:31:18.720 --> 00:31:20.720
No, I must not say rude things online.
00:31:20.799 --> 00:31:22.160
I must not say rude things online.
00:31:22.640 --> 00:31:23.440
I know it's difficult.
00:31:23.599 --> 00:31:24.799
It's difficult not to be.
00:31:24.880 --> 00:31:28.799
Uh I was thinking crimes against humanity, but that that's bad.
00:31:28.880 --> 00:31:29.920
But it's not that bad.
00:31:30.079 --> 00:31:36.160
Um, okay, so special category data is stuff that you probably definitely wouldn't want people knowing.
00:31:36.400 --> 00:31:38.559
Stuff that you can be trolled for.
00:31:38.720 --> 00:31:42.400
So things like sexual orientation, um, um, what else?
00:31:42.480 --> 00:31:49.599
Uh trade union memberships, uh, religious and political affiliations, um, medical data.
00:31:49.839 --> 00:31:55.599
You wouldn't want to, you know, go to the clap clinic on a Sunday morning and have it broadcast from the roof on Sunday afternoon, would you?
00:31:55.759 --> 00:31:57.119
So it's that kind of thing.
00:31:57.279 --> 00:32:02.640
It's it's stuff that will be sensitive and and very personal to you that you wouldn't want other people knowing.
00:32:02.799 --> 00:32:04.640
There's a whole list of it in the law.
00:32:08.799 --> 00:32:10.559
How are we protected?
00:32:10.720 --> 00:32:12.559
Because it's a complete different tangent, I think.
00:32:13.039 --> 00:32:17.279
From you know, you get like weird, not weirdos, like everyone does it, we've all got smartphones, right?
00:32:17.440 --> 00:32:19.039
People just taking photos in public.
00:32:19.279 --> 00:32:36.240
What if you're walking out of your, you know, your dirty little CD clinic at uh on a Monday morning, and then you just get you're in the background of someone's photo and they you know, like the Coldplay um concert, and uh, you know, that famous fellow who was having uh indeed, having having an affair, yes, the CEO lost his job.
00:32:36.319 --> 00:32:37.759
And wasn't it the HR manager?
00:32:38.000 --> 00:32:38.880
She was the HR manager.
00:32:39.039 --> 00:32:39.599
It was, yeah.
00:32:39.839 --> 00:32:49.519
Um generally speaking, legal legal precedent is that unless you are the subject of that photo, if it's in a public place, it's in a public place.
00:32:49.759 --> 00:32:56.319
However, I I would definitely be looking twice before I stepped out if it was me.
00:32:58.400 --> 00:33:00.559
But yeah, it's the same with CCTV cameras.
00:33:00.640 --> 00:33:02.799
The CCTV cameras all over the place.
00:33:02.960 --> 00:33:04.640
If it's a public space, it's a public space.
00:33:04.799 --> 00:33:07.599
You're sort of automatically consenting because you're there.
00:33:07.759 --> 00:33:09.920
Um, and some of it's the police anyway.
00:33:10.000 --> 00:33:14.079
So some of the cameras are the police anyway, and they have the right to film those areas.
00:33:14.160 --> 00:33:24.480
But generally speaking, if you're taking a picture of the street and just happen to catch somebody, you just happen to catch somebody, it's if you're focusing on that particular person taking pictures that it becomes a bit of a legal problem.
00:33:26.240 --> 00:33:27.119
Sorry, I'll flip it.
00:33:27.200 --> 00:33:29.920
I've got questions for you because it's some get amazing answers.
00:33:30.079 --> 00:33:37.680
Um SMEs don't have budgets for um snazzy, swazzy data protection people.
00:33:38.240 --> 00:33:43.359
How would an SME, or what can an SME do to ensure that they're up to date and engaged?
00:33:43.440 --> 00:33:46.799
Obviously, bear in mind they might just be like two directors in a shed.
00:33:47.039 --> 00:33:47.200
Yeah.
00:33:47.359 --> 00:33:48.960
Um there's lots of things you can do.
00:33:49.200 --> 00:33:52.720
The ICO website, generally speaking, isn't bad.
00:33:52.960 --> 00:34:01.359
Some of the more minutiae details of it do sometimes contradict each other, but generally speaking, for the basic stuff, I would always recommend go to the the ICO website first.
00:34:01.599 --> 00:34:11.920
They've got lots of how-tos, they talk you through things like international transfer agreements, they'll talk you through standard contractual clauses, they'll talk you through all the basic stuff that you need.
00:34:12.079 --> 00:34:13.840
They're actually really very good.
00:34:14.159 --> 00:34:22.239
Um, beyond that, um, I subscribe to a bunch of random sites that send me updates on on legal stuff.
00:34:22.480 --> 00:34:28.400
Um, I also did a course, which actually wasn't that expensive in the grand scheme of things, um, called a SIPE.
00:34:28.639 --> 00:34:35.039
I also did a SIPM, which not wholly expensive, but they also allow me access to the IAPP stuff.
00:34:35.199 --> 00:34:48.239
And they send out regular, like daily updates on what's happening with data protection across the world, actually, in everywhere from Canada to America to such as it is, to you know, China and all the rest of it.
00:34:48.320 --> 00:34:50.559
So that's really quite good, and it was very good.
00:34:50.719 --> 00:35:01.840
It gave a lot of information about how to manage um uh this sort of change when we did the Digital Use and Access Act, how that was being managed and how it's being perceived.
00:35:02.000 --> 00:35:07.280
So the um EU were like, maybe we should take away our adequacy rating from the UK after this law.
00:35:07.360 --> 00:35:10.159
Thankfully they didn't, because we'd have had to rewrite everything.
00:35:10.400 --> 00:35:13.199
But you know, it's good to be informed of these things.
00:35:13.360 --> 00:35:14.639
Um, Google is your friend.
00:35:14.880 --> 00:35:17.840
Google, there's lots of legal websites out there that will help you.
00:35:18.000 --> 00:35:22.000
Um, but ultimately you can go and have a look at the the GDPR.
00:35:22.159 --> 00:35:26.559
It's it's a piece of law, it's not hard to read, it's actually quite straightforward.
00:35:26.800 --> 00:35:32.800
And so long as you've got the words in front of you, you're able to check when someone gives you a piece of advice that it matches the words in the law.
00:35:32.880 --> 00:35:35.280
And and that's that's the best way of doing it.
00:35:35.920 --> 00:35:41.280
What's the biggest mistake you find SMEs do or don't do when it comes to data protection?
00:35:41.519 --> 00:35:44.559
Well, the first one is assuming they don't have any personal data.
00:35:46.559 --> 00:35:47.440
We've addressed this one already.
00:35:47.519 --> 00:35:48.719
It's like, no, it's nothing to do with us.
00:35:48.880 --> 00:35:49.280
Yes, it is.
00:35:49.599 --> 00:35:51.039
Well, that's not even SMEs, is it?
00:35:51.199 --> 00:35:51.679
That's everybody.
00:35:51.920 --> 00:35:53.760
It seems to be every supplier seems to have that.
00:35:54.000 --> 00:35:56.880
Yeah, and it's like, no, no, no, no, it really is personal data.
00:35:57.039 --> 00:36:02.960
Um, not understanding that actually it's not just enough to know it's there.
00:36:03.199 --> 00:36:08.719
You do need to address it in your contract, you do need to think about how you're going to do um a risk assessment.
00:36:08.880 --> 00:36:20.480
So you need to do either a PIA or a DPIA that assess the risks of processing that data, even if it is just that you're giving, you know, personal details for a work colleague, it's still processing data.
00:36:20.639 --> 00:36:21.920
Therefore, you need to have that in place.
00:36:22.000 --> 00:36:23.119
And you need a roper.
00:36:23.360 --> 00:36:30.639
Legally, you need to have a record of processing activity document, which doesn't have to be very big, but does have to explain what you're doing with that data.
00:36:30.800 --> 00:36:32.320
Does it leave the UK?
00:36:34.400 --> 00:36:38.159
Do you need templates for online, or is that just like pluck it out?
00:36:39.119 --> 00:36:40.639
Yeah, you can no, you can get them online.
00:36:40.800 --> 00:36:47.039
Um, like I said, the ICO website's got got all sorts of stuff, but if you just put in templates, there's there's loads out there.
00:36:47.199 --> 00:36:48.639
Some of them are quite complicated.
00:36:48.800 --> 00:36:53.280
Um, I tend to sort of go for the simplistic versions unless I have to do really complicated.
00:36:53.519 --> 00:36:58.000
Um, so a template for me would be um who owns the data?
00:36:58.079 --> 00:36:59.360
So who's the data controller?
00:36:59.519 --> 00:37:01.360
Uh, this is for a ropa, for example.
00:37:01.519 --> 00:37:02.880
Who's who owns the data?
00:37:02.960 --> 00:37:04.000
Who's the data controller?
00:37:04.159 --> 00:37:05.039
What is the process?
00:37:05.119 --> 00:37:07.280
What why are we actually processing this data?
00:37:07.440 --> 00:37:08.559
What does the data involve?
00:37:08.719 --> 00:37:10.719
Name, email address, telephone number, okay.
00:37:10.880 --> 00:37:12.480
Um is it being sent outside the UK?
00:37:12.639 --> 00:37:17.280
If it is, that's a whole other level of requirements, international data transfers, that kind of thing.
00:37:17.360 --> 00:37:19.760
And then how are we securing that data?
00:37:20.000 --> 00:37:22.320
And that's that's the basic stuff for that.
00:37:22.480 --> 00:37:28.960
You when you start thinking about data subject rights, you then have to think about would you be able to access uh and deal with a DSAR?
00:37:29.119 --> 00:37:34.000
So if a data subject came to you and said, I want to know all the data you hold on me, would you be able to do that from your systems?
00:37:34.079 --> 00:37:35.599
How easy would you be able to do that?
00:37:35.760 --> 00:37:44.000
The law requires you have 30 days to do it, so it's usually a good idea to plan in advance how you would so that you don't have a complete disaster when it happens.
00:37:48.400 --> 00:37:50.960
There's a lot in there, it is a lot easier for an SME.
00:37:51.039 --> 00:37:54.320
I'm just thinking like it's yeah, it's a lot, and you can't do that.
00:37:54.639 --> 00:37:56.880
That's why I'll always have a job because it gets quite confusing.
00:37:56.960 --> 00:38:00.880
And and when you're talking about large amounts of data, it can get very confusing.
00:38:01.119 --> 00:38:10.719
If you are if you are a straightforward director and it's just your company, the first thing I would recommend is make sure you've got templates and and and standard contractual clauses in your contract.
00:38:10.800 --> 00:38:12.480
That's a good place to start.
00:38:12.800 --> 00:38:22.960
After that, what can a Capy Bar or a procurement person do in their everyday in their everyday life to support data protection fanatics?
00:38:23.280 --> 00:38:23.920
Uh okay.
00:38:24.079 --> 00:38:29.840
First of all, tell us when you need our assistance, you know, when things crop up and you're like, oh, okay, this has got personal data in it.
00:38:30.000 --> 00:38:31.760
I should probably just run this past somebody.
00:38:31.920 --> 00:38:36.239
Um, make sure there are things in the contract that cover it and cover it sufficiently.
00:38:36.480 --> 00:38:43.599
So just because you have your purpose for doing this particular business contract is that you're going to have them process this other data.
00:38:43.760 --> 00:38:50.880
Don't forget you might also need a data controller, so data controller clause within your contract that covers the processing of employee data as well.
00:38:51.039 --> 00:38:55.360
So it's it's thinking about both sides of the of the data transfer and how that's going to work.
00:38:55.519 --> 00:39:01.519
Um, and yeah, come and come and speak to to someone who knows what they're talking about before it becomes a whole big thing, please.
00:39:01.760 --> 00:39:07.119
And the next big thing is, and this is for everybody, if you see a problem, report the problem.
00:39:07.440 --> 00:39:10.960
If you think there's been a data breach, for God's sake, tell somebody who can help you.
00:39:11.119 --> 00:39:13.679
Because if you leave it, it will only get worse.
00:39:15.679 --> 00:39:17.920
I had um two big topics to talk on.
00:39:18.000 --> 00:39:20.880
I know we're going towards the end of our of our uh session.
00:39:21.760 --> 00:39:24.719
AI is obviously a massive uh thing at the moment.
00:39:24.880 --> 00:39:25.360
Yeah.
00:39:25.679 --> 00:39:27.280
Sarah is uh malfunctioning.
00:39:27.440 --> 00:39:29.599
Um I'm twitching, I'm twitching, not AI.
00:39:29.679 --> 00:39:30.559
Oh god, AI.
00:39:30.639 --> 00:39:31.840
Yes, AI is a big thing.
00:39:31.920 --> 00:39:32.559
Yes, go on.
00:39:32.880 --> 00:39:37.280
What are the what are the kind of main considerations around AI and data protection?
00:39:37.920 --> 00:39:42.960
Okay, so not going into the whole we're all doomed Terminator style.
00:39:43.280 --> 00:39:50.559
Um one of the big problems is it comes under automated processing and and automated decision making in a lot of cases.
00:39:50.719 --> 00:39:52.960
And that is covered by the law.
00:39:53.119 --> 00:39:56.079
Data subjects have the right to opt out of that.
00:39:56.320 --> 00:39:59.679
So you have to think about that when producing your systems where you're going to.
00:40:00.159 --> 00:40:02.239
Use this for actual decision making.
00:40:02.559 --> 00:40:10.239
Example, you ring up one of these computer systems that give you credit cards and it makes a decision online in three seconds or whatever it does.
00:40:10.480 --> 00:40:14.000
You have to have a process so that person can go to a human being if they don't think it's right.
00:40:14.079 --> 00:40:15.679
So you've got to have a human in the loop.
00:40:16.159 --> 00:40:17.760
The other side of it is ethics.
00:40:17.920 --> 00:40:19.760
What are you actually using this data for?
00:40:19.920 --> 00:40:22.400
How long will this personal data be stored?
00:40:23.199 --> 00:40:27.760
Will it be used to train the system in a way that the user wouldn't necessarily think?
00:40:28.639 --> 00:40:38.960
The Data Use and Access Act actually does cover some of this and gives more rights to people doing things like medical research and stuff, being able to hold this data and do more with it beyond the purpose.
00:40:39.119 --> 00:40:44.159
But for most people, you have to think about how you're going to use that and what it's going to be used for.
00:40:44.480 --> 00:40:46.480
So kind of depends.
00:40:46.719 --> 00:40:53.280
Generally speaking, I would put personal data into AI with extreme caution at this point.
00:40:53.599 --> 00:41:02.480
I don't think as a country, even we have the proper setup yet to be able to properly think through how we use AI in a lot of cases.
00:41:02.719 --> 00:41:05.679
We don't have a like the EU have a the AI Act.
00:41:05.760 --> 00:41:15.599
We don't sort of have anything that sits in that space that talks about doing it from a risk assessment point of view, looking at it in terms of okay, well, we've risk assessed it, we think it's minimal risk.
00:41:15.679 --> 00:41:17.440
Okay, what are the ethics behind it?
00:41:17.599 --> 00:41:18.960
How are we processing this data?
00:41:19.039 --> 00:41:20.719
What could be the outcome for the data subject?
00:41:20.880 --> 00:41:22.320
You need to think those things through.
00:41:22.480 --> 00:41:24.960
So certainly I'm sure people are using it.
00:41:25.039 --> 00:41:30.480
I'm pretty certain Amazon has has my personal data in every single one of their many AI systems.
00:41:30.559 --> 00:41:33.039
And there's probably not an awful lot I can do about it.
00:41:33.280 --> 00:41:38.559
But for the average bod, I would say think carefully and plan longer than you think you need to.
00:41:40.639 --> 00:41:41.440
That makes sense.
00:41:41.599 --> 00:41:52.880
It is definitely a murky, a murky world out there in terms of AI that I don't really understand, which kind of sort of links but doesn't really link to my last kind of question area.
00:41:53.119 --> 00:41:59.360
Um you touched on one earlier about uh British Airways and how they got fined by the ICO.
00:41:59.679 --> 00:42:06.239
What are some of the other we kind of like to talk about the we call them procurement duckups when companies have have messed up?
00:42:06.320 --> 00:42:09.360
So there have been any kind of data protection duckups.
00:42:09.760 --> 00:42:11.119
Oh yeah, okay.
00:42:11.199 --> 00:42:12.320
Uh give me one second.
00:42:12.400 --> 00:42:13.199
I can Google them.
00:42:13.280 --> 00:42:15.760
They're actually on the ICO website.
00:42:16.320 --> 00:42:18.800
Um uh fine.
00:42:19.280 --> 00:42:22.639
What are the what are the biggest or most interesting ones?
00:42:22.880 --> 00:42:26.079
Okay, so the interesting thing, here we go, example.
00:42:26.159 --> 00:42:31.360
So capita were fined 14 million for a data breach affecting six million people.
00:42:32.480 --> 00:42:33.119
Yeah.
00:42:33.360 --> 00:42:36.239
Um uh 23andMe, do you remember them?
00:42:36.320 --> 00:42:38.480
They were the the genetic code people.
00:42:38.559 --> 00:42:42.960
They were fined 2.31 million for failing to protect UK users' genetic data.
00:42:43.119 --> 00:42:46.000
Genetic data comes under special category.
00:42:46.719 --> 00:42:51.920
Um then we've got a whole load of others who generally aren't as big.
00:42:52.000 --> 00:42:54.800
Now, I will say we don't give enormous fines.
00:42:54.960 --> 00:43:00.239
The British Airways one, which was by the way, 2020, I think, um, was about 20 million.
00:43:00.480 --> 00:43:02.239
That's quite high for the ICO.
00:43:02.320 --> 00:43:07.920
They don't normally do that, but they failed to protect the personal data of over 400,000 customers.
00:43:08.320 --> 00:43:09.440
That's a big breach.
00:43:09.519 --> 00:43:10.559
That's a really big breach.
00:43:10.639 --> 00:43:18.719
Um, Marriott Hotels, 18.4 million for a breach affecting millions of guests globally, which I think included credit cards, which is a really big no-no.
00:43:19.039 --> 00:43:20.079
Really big no-no.
00:43:20.480 --> 00:43:27.840
Um, TikTok were fined 12.7 million 2023 for breaches of children's data protection rules.
00:43:28.400 --> 00:43:29.519
Ooh, very bad about that.
00:43:29.840 --> 00:43:32.960
Children and other children is more heavily scrutinized.
00:43:33.679 --> 00:43:37.440
It's not special category per se, but it has its own special set of rules.
00:43:37.599 --> 00:43:44.079
So anyone who's dealing with children's data, I I say this from the heart do not think you can do this yourself.
00:43:44.320 --> 00:43:48.559
Get yourself proper data protection advice.
00:43:48.800 --> 00:43:51.519
Okay, if you're dealing with kids, all bets are off.
00:43:51.599 --> 00:43:53.519
You need to go and speak to a professional.
00:43:53.760 --> 00:44:04.880
Um ClearView AI were fined in 2022, 7.5 million for scraping images off the internet to create a facial recognition database.
00:44:06.159 --> 00:44:08.639
Yeah, that was using AI for the Dodge.
00:44:09.039 --> 00:44:20.239
Um, Advanced Computer Software Group Limited, 3.7 million um in 2025 for security failings that led to a ransomware attack that affected the NHS service and patient data.
00:44:20.960 --> 00:44:24.559
There are a lot of duckups, as you like to call them.
00:44:24.719 --> 00:44:28.079
They're the most recent ones and that they're the highest most recent ones.
00:44:28.159 --> 00:44:34.559
If you want to go to the ICL website, you can actually look at their, they they actually have a page and you can go through and look at all the ones they've done.
00:44:34.719 --> 00:44:39.360
They're not great on GDPR ones, they're more pecker ones that they like to go after.
00:44:39.599 --> 00:44:40.559
Don't know why.
00:44:40.719 --> 00:44:47.519
Um, like I said, GDPR ones not as much prosecuted, but they as it's from this list, they will if it's big enough.
00:44:47.760 --> 00:44:53.920
Um, if you go into the EU, there are some that have been fined 150 million, 190 million.
00:44:54.159 --> 00:45:03.760
Yeah, the likes of Amazon, Facebook, those kind have been fined, huge fines in places like Liechtenstein, which I'm not really sure why, but there we go.
00:45:03.920 --> 00:45:06.320
So, yeah, so there are there are big fines out there.
00:45:06.480 --> 00:45:09.119
The UK doesn't find quite as much, but they do exist.
00:45:10.320 --> 00:45:14.480
Um well I look, I want to get you on for a duck a peck a duck up.
00:45:14.719 --> 00:45:16.079
A pecking duck up or something.
00:45:16.159 --> 00:45:16.400
I don't know.
00:45:16.480 --> 00:45:17.679
I'm sure we can figure out a good name for that.
00:45:18.239 --> 00:45:20.079
A peeking, a peeking duck, a duck up.
00:45:21.440 --> 00:45:22.960
Sweet and sour chicken balls as well.
00:45:23.039 --> 00:45:24.960
Let's get some of them in while we're having this yeah.
00:45:25.679 --> 00:45:30.559
Um look, I I'm really sorry, I I do have to to uh depart, unfortunately.
00:45:30.719 --> 00:45:34.000
I'm actually out of time, but I just want to say thank you so much for your time, sir.
00:45:34.239 --> 00:45:37.280
It's been an absolute whirlwind as it always is when we speak.
00:45:37.440 --> 00:45:40.159
And uh I hope the listeners have learnt a thing or 10.
00:45:40.320 --> 00:45:42.880
And uh I hope Luke 10's woken up a little bit.
00:45:44.559 --> 00:45:46.559
He's he's sort of awake, he's almost there.
00:45:46.639 --> 00:45:51.760
But yeah, if you want to ever do this again, if you know listeners ask questions, we can always do it again and answer questions.
00:45:52.320 --> 00:45:54.000
Yeah, we've got quiz, we've got question functions.
00:45:54.159 --> 00:45:56.480
I'm sure people will fire in some ridiculous questions.
00:45:56.559 --> 00:46:00.960
And uh if you want us to put a link to your to your books in our in our thing or you can.
00:46:02.320 --> 00:46:06.400
Um I'm sure we've got lots of uh I don't think it's got an awful lot to do with procurement.
00:46:08.400 --> 00:46:09.440
You never know, right?
00:46:09.840 --> 00:46:13.519
Giving people dragons, they kind of go hand in hand, despite the fact we're capabaras.
00:46:13.599 --> 00:46:18.400
I'm sure dragons are eating us, but nobody eats capabaras.
00:46:18.639 --> 00:46:19.599
Honestly, look 'em up.
00:46:19.760 --> 00:46:20.480
Everybody loves them.
00:46:20.559 --> 00:46:22.480
They sit in the sunbags with crocodiles.
00:46:22.800 --> 00:46:23.360
Seriously.
00:46:24.159 --> 00:46:25.440
Sorry, I digress.
00:46:25.679 --> 00:46:27.360
It's been wonderful to talk to you guys.