GDPR Compliance in the Industrial Sector

Challenges surrounding safety and security in the industrial sector are universal. Work carried out at factories or refineries demands the highest standards of safety. Alongside safety, regulatory compliance is becoming increasingly critical. Nsecure combines years of experience in access control and identity management with expertise in privacy legislation to help clients ensure GDPR-compliant access processes. Recently, Nsecure collaborated with a client in the industrial sector to conduct a Data Protection Impact Assessment (DPIA). The result? Access and identity processes fully aligned with privacy legislation.

What is a Data Protection Impact Assessment?

A DPIA provides insight into the risks to individuals whose personal data is processed within a specific process and the measures required to mitigate these risks. Processing in access control and identity management is often large-scale and complex, making a DPIA essential and legally required to meet GDPR standards.

Challenge: AEOS Upgrade and Integration with Dataclient Workflow Solution

This case study highlights a complex scenario with a major industrial player. The organization used an AEOS access control system for managing access and security processes. The system required an upgrade to a new AEOS version to integrate with the new workflow and identity management solution, Dataclient. This would allow controlled access for employees, visitors, and contractors. Consequently, migrating the existing database to the new system was necessary.

Access Processes on a Multi-User Site

The site also housed several companies that required access to the systems to independently register visitors, employees, and contractors. This ensured control over who is registered and what data is entered. All parties were designated as (joint) data controllers, sharing responsibility for their respective data. The primary responsibility lay with the client, who managed and secured the systems. Nsecure also acted as a processor due to hosting the systems.

Identifying Risks: Data Minimization, Data Quality, and Security

The upgrade and adoption of the Dataclient solution introduced several privacy risks:

1. Data Minimization: Were all data from the old AEOS environment still necessary?
2. Data Quality: Were all records up-to-date?
3. Security: How were the records protected during the migration?

Recommendation: Conducting a DPIA

To ensure a successful migration and compliance with privacy laws, a DPIA was conducted. Through a detailed analysis, Nsecure helped the client identify privacy risks and formulate appropriate mitigation measures.

Ideally, a DPIA should be conducted before starting a project involving data processing, allowing privacy considerations to be incorporated into the technical design. In this case, the assessment addressed both existing and new data processing.

Step 1: Mapping the Process

The first step of a DPIA is a systematic description of the process, which serves as the foundation for the assessment. This involves detailing not only the data processed and the systems used but also the roles of all involved parties:

• Who determines the purpose and means of processing?
• Who are the data subjects?
• Are third parties involved in processing data on behalf of the controller?

Personal data processed in access control systems range from basic information (e.g., name, email, phone number) to sensitive data like addresses, ICE contact details, ID numbers, residency status, and training records.

Step 2: Assessing GDPR Compliance

All personal data processing must meet GDPR requirements, including purpose limitation, lawfulness, and transparency. One of the six lawful bases under GDPR must apply for data processing to be permissible. The client planned to process data mainly under the bases of “legitimate interest” and “consent,” with limited use of “legal obligation.” Each basis presented unique challenges:

Legitimate Interest

Processing must be necessary for business operations, balancing organizational interests with the rights of data subjects. In this case, the security of properties and facilities in the industrial sector justified processing. However, the client needed to critically assess what data were truly required and limit processing to that scope.

Consent

Consent must be informed, specific, and revocable. The existing process did not meet these criteria:

• It was unclear what data were processed and for what purpose.
• Consent was often given verbally during a first visit, with no clear mechanism for withdrawal.
• In an employer-employee relationship, consent might not be freely given, complicating compliance.

Step 3: Risk Analysis & Mitigation Measures

The final step in the DPIA involves conducting a risk analysis and defining control measures. This step examines which risks are significant for both the individuals involved and the organization. The findings from step 2 serve as the foundation for this analysis. Several risks were identified for both the individuals and the organization. Based on these findings, measures were formulated in consultation with the client. For example, overly broad authorizations created a risk of misuse or improper use of data in Dataclient or AEOS by employees of the client or contractors.

Outcome of Recommendations and Measures: Assigning Rights and Permissions

To ensure that the AEOS access control system and the Dataclient environment comply with privacy requirements, measures have been implemented to mitigate risks. This includes developing and implementing a test plan, verifying imported data with relevant stakeholders, and using encryption for data transfers. A procedure has been established to better manage and monitor the assignment of rights and permissions. Additionally, logging has been configured to generate alerts when users request large volumes of personal data within the system.

Furthermore, certain data was found to be collected that was either not sufficiently necessary for the purposes of Dataclient and AEOS or was retained longer than required. To address this, an assessment was conducted to identify the data necessary for processing. Retention periods have been defined for all data, distinguishing between visitors, contractors, and employees. Where possible, retention policies have been automated within the systems.

Agreements with Contractors

Contractors were also obligated to inform data subjects about their inclusion in Dataclient or AEOS and other aspects of processing, such as retention periods and security measures. Agreements clarified responsibilities, and a GDPR-compliant privacy statement was issued to all data subjects.

A Continuous Process

DPIAs are not one-off exercises. Monitoring and adjustments are essential whenever data processing changes, such as adopting new technologies or shifting processing purposes.