text:
Guidance/
ORDER A BOOKLET EXPLAINING GDPR
ORDER A BOOKLET EXPLAINING GDPR (For Northern Ireland)
Listen to our GDPR podcast
GDPR – What is it? Who has to comply? What does this mean for my business? Accountancy Ireland talks to Peter Bolger of LK Shields, Gavin Doherty from 247 Meetings and Niall Tierney from Tierney IP to get your questions answered in this special GDPR podcast.
Latest GDPR articles
New online course - GDPR for accountants - a practical guide to ongoing compliance
It is just over one year since GDPR went live, and the new regulations and those responsible for enforcing them are flexing muscles in landmark, high profile cases. The launch may be behind us but GDPR is now an everyday reality. The main way to ensure compliance is to stay informed. We have developed a special, online interactive course in collaboration with legal experts from ByrneWallace to help you with this. We provide all the information and resources in one place that you, as an accountant, need to ensure your firm or organisation remain compliant. Interactive and engaging, GDPR for accountants - a practical guide to ongoing compliance, provides an understanding of and templates for policies and practices that should be implemented. The course is entirely online allowing flexibility with where, when and how you work. All content is on-demand, meaning you can access when it suits you. We have created pre-recorded video content and easy to understand written content to get you up to speed on this all important area crucial for any business from the sole trader to the state organisation and multinational corporation. We are offering a special offer as we launch this course: For the month of September, we have an introductory discount which means you will have access for six months for just €50. Not only will you avail of a great deal saving you €25 off the normal fee, you will be awarded three CPD hours too. For more information and to book, click here. Use the discount code gdprdisc at the checkout to avail of this special offer only available for the month of September.
Meeting General Data Protection Regulation (GDPR) compliance requirements has become a top priority for the majority of Irish businesses over recent months. Accountancy practices are no different, and as the 25 May enforcement deadline approaches, the Institute has being helping both you and your clients to prepare for GDPR in a number of ways. For example, we have provided guidance via articles in recent issues of Accountancy Ireland, while during February & March we have run a series of half day courses in a number of towns and cities across Ireland. In addition, earlier this month our publications department has made available a handy GDPR booklet, specifically for our practice members to distribute to their clients and contacts. Further details on our currently available guidance can be found at https://www.charteredaccountants.ie/knowledge-centre/guidance/gdpr Recognising that GDPR implementation presents both specific challenges and opportunities for accountants in practice, the Practice Consulting team is also busy both offering advice and preparing detailed practical guidance in this area for our members across the island of Ireland, explaining what the changes resulting from GDPR will mean for both your practice and your clients. This guidance will include: GDPR Template Outline Procedures to be tailored and used by an accountancy firm; A paragraph for a client engagement letter addressing GDPR and a template privacy statement; GDPR 8 Step Guide; and Explanation of GDPR terms. We intend to make these practice aids available to you in the next few weeks and ahead of the GDPR effective date of 25 May. The procedures will be free of charge to our members. In the meantime, practices should continue with their preparations. Given the specialised legal nature of GDPR and depending on firm's individual circumstances, members firms may need to obtain independent legal advice on compliance. Practice Consulting has also developed a half day consultation offering. Following the publication of our procedures, one of our consultants can visit your firm and offer practical advice and guidance on how to tailor your procedures, make progress on your GDPR journey, and meet key compliance milestones. If you have any question in relation to GDPR, please feel free to contact either Conal or Jeremy in Practice Consulting by email at practicemembers@charteredaccountants.ie or by telephone at 01 637 7300.
Practice Matters - GDPR –The Truth and the Myths
Jeremy Twomey writes.. Billed as the most important change in data privacy regulation in over 20 years, and with its enforcement deadline of 25 May 2018 fast approaching, ensuring General Data Protection Regulation (GDPR) compliance has become a top priority for the majority of Irish businesses. Over the last year, the Institute has been helping its members to prepare for GDPR in a number of ways. For example, we have provided guidance via articles in recent issues of Accountancy Ireland, while in the last few weeks we have run a series of half day roadshows and courses in a number of towns and cities across Ireland. In addition, the Practice Consulting team has been busy preparing detailed practical guidance in this area, explaining what the changes resulting from GDPR will mean for accountants and their clients. This guidance will be available under the Knowledge Centre section of the Institute website, and is designed to answer the GDPR-related questions that members have contacted us on over recent months. While preparing this guidance, it became evident that a number of "myths" have developed over the last couple of years surrounding the implementation of GDPR. In this article, I am going to address a few of these and try to help you ensure that you do not fall foul of these, as you prepare to achieve GDPR compliance at your firm. Myth 1 - GDPR Compliance is a once off project to be achieved by 25 May With so much hype surrounding the regulation, one should remember it is not a once off event or test for compliance. Unlike planning for the Y2K deadline in 1999, GDPR preparation doesn't end on 25 May; it requires ongoing effort. It's an evolutionary process for organisations; 25 May is the date that GDPR will be enforced but no business stands still. You will be expected to continue to identify and address emerging privacy and security risks in the weeks, months and years beyond May of this year. GDPR will require ongoing governance of data, as organisations migrate to new systems or apply their customer data to new markets and trends. Initial compliance is the first heavy lift, but ongoing governance is the long-term reality! All entities falling under GDPR should endeavour to be fully compliant by the implementation day, although this may not be possible in all instances. In such circumstances it is important that you address the essential elements of compliance at your firm as soon as possible, and can demonstrate your ongoing efforts in this regard in a comprehensive documented plan of work. Myth 2 - GDPR is only for large firms, a small accountancy practice or company is not expected to have the time or resources to achieve compliance You will have to comply with GDPR, regardless of your size, if you process personal data. Small accountancy practices do not escape the demands of compliance. GDPR needs to be prioritised by all firms, regardless of size. The vast majority of businesses across Ireland are small businesses and it is important to remember these firms often process a lot of personal data, and their data protection reputation and liability risks are just as real as for larger entities. Myth 3 - With Brexit, entities located in the UK, including Northern Ireland, will not have to comply with GDPR GDPR will apply to all EEA countries and any individual or organisations trading with them. As it comes into force on 25 May 2018 (before the UK is due to leave the EU), UK individuals & organisations must ensure compliance with the new regime by then. The British government has confirmed that the UK's decision to leave the EU following Brexit will not affect the commencement of GDPR. Post Brexit, it is envisaged that if a UK organisation or individual processes personal data, then they will have to do this in accordance with GDPR. To ensure that the UK will be GDPR-compliant post Brexit, the new Data Protection Bill (currently going through Parliament in London) incorporates all of the GDPR. Myth 4 - GDPR is a completely new approach to Data Protection It is vital to remember that GDPR builds upon the existing legislation in this area. It is an update, not a wholesale revision, to meet the changes in technology and data use over the last twenty years or so. As a result of these changes, consumers' privacy and data were not by now as well protected as they could be. GDPR rectifies this by increasing the responsibility on organisations to use personal data appropriately and to hold it securely. Although GDPR is not a completely new approach, it is more stringent in its application and the fines for non-compliance have been considerably increased. This means that doing nothing is not an option, although GDPR does allow organisations to take a risk based approach, based on your size and circumstances. Many organisations struggle to assess where they should start in preparing for GDPR. It is helpful to remember that we have had data protection legislation in both the UK and the Republic of Ireland for a number of decades and therefore, firms who have taken data protection compliance seriously are already in good shape for beginning to meet GDPR's increased compliance standards. Myth 5 - GDPR is just more bureaucracy and work for small firms, with no potential benefits When legislation of this nature is announced, one can take either a positive or negative view of the task at hand. If you take a negative view, you will see GDPR as more bureaucracy and cost to your firm. If you take a positive view, on the other hand, you will view GDPR as a necessary strengthening of the rights of individuals, and indeed a potential opportunity. As accountants position themselves as strategic advisers to clients, GDPR is also an opportunity for firms to demonstrate to clients that they can securely hold and process information in accordance with data requirements, and that protection of client data is a priority for the practice. As a result, clients are likely to see their accountants as trusted professionals with whom they can partner to drive their business forward. Therefore, being a leader in this area may enhance your practice and its reputation. In addition, as trusted business advisors to your clients, you must have sufficient knowledge of this new legislation to be able to provide sound advice. SMEs need to be ready when the new law comes into force, but they may struggle to know where to start. Chartered Accountants in practice can help these small businesses bridge the gap to GDPR compliance and, in the process, win new business. Myth 6 - Outsourcing GDPR compliance will be a quick fix for me and my firm There is no quick fix to GDPR compliance. No one piece of software or outsourced service provider is going to provide everything you need to comply with GDPR. For accountancy practices, GDPR will impact on how you manage and store data across your entire firm (e.g. client, prospective client, contact, supplier and staff data). You cannot outsource your responsibility for this information, and compliance with GDPR will require considerable time and preparation from all levels within your practice. With the implementation date of 25 May approaching quickly, it is important to start sooner rather than later on this. Myth 7 - GDPR only applies to Digital Processing Under GDPR, data processing covers both automated personal data and manual filing systems. Manual/paper records are included if they are part of a 'relevant filing system'. This means papers stored systematically, for example, in a filing cabinet are probably included, but ad hoc paper files may not be. Members should ensure that they apply the same levels of diligence to paper records as they do digital records and that any decisions made regarding the lawful basis for processing, adhering to data protection principles and upholding data subjects' rights include paper records held. Myth 8 - Under GDPR, accountants will only be seen as Data Processors and hence avoid much of the responsibility that falls on Data Controllers in this new regulation The UK Information Commissioner's Office (ICO) has previously advised that it considers that an accountancy firm providing accountancy services acts as a data controller. The firm's status as a data controller in relation to clients arises because the firm has flexibility over the manner in which it provides services to its clients and will not be simply acting on their instructions. In addition to this, the firm has its own professional responsibilities regarding record-keeping and confidentiality. Therefore, because an accountant "determines what information to obtain and process in order to do the work", firms act as "controllers in common" with clients. Under GDPR, member firms will also be data controllers with regard to their firm data (e.g. employee information). If there is any doubt regarding your status as a processor or controller in relation to your firm's activities, you should take legal advice. Going forward, firms will need to ensure that client terms and conditions reflect this reality, potentially extending engagement terms as appropriate. No doubt, for many accounting practitioners, much work remains to be done to fully meet GDPR compliance requirements. Between now and the end of May, firms new to the process will need to examine their existing data processing, review their data protection policies, procedures & controls, and identify any gaps that need to be addressed. Following on from this, firms will need to implement any changes required in a structured documented manner to meet the needs of GDPR and continue to show full compliance long after the implementation date. The Institute will continue to assist members on your GDPR compliance journey, with ongoing updates to our available guidance in this area and, should you have a specific query in this area, please feel free to contact the Practice Consulting Team.
Governance, Risk and Legal
The GDPR clock is ticking...
With the GDPR deadline fast approaching, organisations should step up their efforts to ensure compliance writes Peter Bolger. It is now eight weeks until the General Data Protection Regulation comes into force and it will have to be implemented by all businesses within the EU. Many companies have already taken steps to comply with the principles of this regulation but those who have not yet done so should urgently consider implementing GDPR strategies. Chartered Accountants need to incorporate new changes in their businesses, be it in private practice or in-house, in order to be GDPR compliant. GDPR was passed by EU legislators in 2016. Following this, there was a two-year lead-in period so that awareness could be raised about the changes GDPR will make to privacy law. This period, ending on 25 May 2018, also allows businesses to take the time to ensure they are compliant. This involves reviewing and updating any policies or practices on processing personal data. It is of utmost importance that businesses are compliant, insofar as possible, by this date. The Data Protection Bill 2018 has recently been published and is as important as GDPR. The Bill incorporates Ireland's national implementing measures and also creates a new regulatory framework for enforcing data protection laws in Ireland. The Bill establishes the enforcement and administrative powers that are necessary to give effect to the intention of GDPR. Data protection officers In certain instances, it will be mandatory to appoint a data protection officer (DPO). This person will be responsible for advising the company on compliance with GDPR and will also act as a point of contact for data protection authorities and data subjects. Businesses must check whether or not they will need a DPO. Under GDPR, a DPO is required where the organisation is a public body; carries out large scale regular and systematic monitoring of individuals; or carries out large scale processing of special categories or data relating to criminal convictions and offences. The Article 29 Working Party has issued guidelines on DPOs. The guidelines note that managers and those who work in IT cannot assume this role. Fines It is extremely important to note that fines under GDPR are substantial. While the maximum penalty under the current regime is €100,000, fines under GDPR are much greater. Depending upon the nature of the breach, either the lower or higher threshold of fines will be imposed. The lower threshold of fines is up to 2% of an undertaking's global turnover in the previous year or €10 million, whichever is higher. The higher threshold is up to 4% of an undertaking's global turnover in the previous year or €20 million, whichever is higher. The Data Protection Bill provides that a decision of the Data Protection Commissioner to impose a fine can be appealed to the Circuit Court or the High Court. It should also be noted that under the Bill, most public bodies are exempt from administrative fines. Data Protection Impact Assessments Data Protection Impact Assessments (DPIAs) will be mandatory under GDPR where high-risk processing is contemplated. High-risk processing may involve profiling, large scale processing of special categories of personal data or large scale processing of public areas. DPIAs are only mandatory where the processing of data is "likely to result in high risk to the rights and freedoms of natural persons". The Article 29 Working Party has issued guidelines on DPIAs and states that the rights and freedoms in question may also involve freedom of speech, thought, movement, prohibition of discrimination and rights to liberty, conscience and religion. These rights could also trigger an obligation to carry out a DPIA. New data subject rights Data subjects have increased rights under GDPR. Organisations must learn how to comply with these new rights and it is likely that privacy policies will have to be reviewed and updated. GDPR introduces the right to data portability, the right to erasure and the right to object to profiling. Certain rights have been modified, such as the data subject access right (SAR). This gives an individual the right to receive a copy of his or her personal data, which the controller holds. The already tight timeframe of 40 calendar days has been reduced to within one month of receiving a valid access request. It is therefore essential that organisations have an efficient and correct procedure in place to comply with any SARs received. Consent GDPR increases the obligations on data processors and controllers to obtain an individual's consent prior to processing any personal data. Consent forms will therefore also need to be reviewed and updated. Data subjects must be informed of their right to withdraw their consent to processing at any time. For consent to be valid under GDPR, it must be "freely given, specific, informed and unambiguous". Consent to process data must be entirely separate from other consents related to the firm's business. The Article 29 Working Party in its guidelines on consent pointed out that in the case of employment, where the employer is the data controller, an employee (i.e. the data subject) is rarely in a position to give free consent. This issue was also raised by the Irish Data Protection Commissioner. Organisations must have the resources in place, should a data subject wish to retract consent. It must be as easy to withdraw consent as it is to give it. Therefore, many companies are now assessing whether to rely on consent or another GDPR-compliant basis for their processing. Under the Data Protection Bill, Ireland has lowered the age of digital consent to 13. Accountability Accountability is one of the main principles of GDPR. Organisations must assess whether they have a sufficient data protection programme in place. They must also provide evidence of how it complies with GDPR. This could be done by showing that it has implemented data protection policies through regular checks and testing. A significant amount of Irish companies are now carrying out GDPR compliance programmes to ensure that they are in a position to demonstrate this compliance. Data breaches GDPR will change the notification requirements in the event of a personal data breach. Organisations must put data breach policies in place and internal registers of breaches must be available for inspection. Data controllers will therefore need to document incidents of data breaches and remedial action taken. The Data Protection Commissioner will need to be notified where a breach is likely to result in a risk to the rights and freedoms of individuals. In cases of high risks for the data subjects, data subjects generally must also be notified. In its guidelines on determining whether processing is "likely to results in a high risk", the Article 29 Working Party stated that this risk exists where the breach may lead to physical, material or non-material damage to the data subject. The Data Protection Bill permits not-for-profit bodies to lodge complaints with the Data Protection Commissioner on behalf of data subjects in the event of a data breach. They are also permitted to bring a civil claim. Conclusion The sooner preparation for GDPR begins, the more risks will be minimised and – importantly – the likelihood of fines being imposed. Becoming GDPR-compliant is a large undertaking for all organisations. Once the time is taken to put the proper policies and procedures in place, compliance will not be so difficult to achieve. Peter Bolger is the Head of Intellectual Property, Technology and Privacy at LK Shields.
Five steps to prepare for GDPR
The single, largest piece of advice from data privacy group 3M in finalising preparations for the General Data Protection Regulation (GDPR) is to review everything - now. GDPR will fundamentally change the way businesses collect, store and use customers' personal information when it comes into force on the 25 May 2018. According to 3M, many businesses are underestimating the work involved to ensure compliance. Businesses that do not comply or are in found of a breach can face a fine of up to €20 million in penalties or 4% of annual worldwide turnover. 3M has identified five key, practical measures to take in preparing for the new regulations in just a few weeks' time: Take ownership and take action: your internal GDPR team must take responsibility for reviewing existing data, developing new procedures for collecting, storing and using data, and for ownership of the policies. They will be accountable in the event of a breach, so task this team to conduct final checks on all data, all material and all your company policies and privacy statements; Conduct an appraisal: task your GDPR team to review all personal data held by your organisation, including how you received it. Validate it and catalogue it as required, then perform a gap analysis to identify potential, associated risks. Then evaluate all data privacy notices and policy procedure documents in terms of GDPR compliancy; Develop new policies and procedures: after you have mapped the data, it's time to implement internal policies and measures which take into account Privacy by Design and by Default. The new or improved policies and procedures are designed to mitigate the security and privacy risks identified with existing data that may be unauthorised, or to defend the company in the event of an involuntary security breach; Training: implement training and review checklists for data protection among your organisation. Implement internal breach notification procedures and incident response plans. Ensure your communications teams, and anyone else with direct contact to current and prospective customers, are aware of the company's new policy; and Security: assess the design of any open space working areas, particularly those of data sensitive departments such as Finance, Legal, HR, Pricing and so on. The mobile workforce is also at high risk of visual hackers accessing private, sensitive or confidential information for unauthorised use. Implement new security measures such as privacy filters to safeguard the display of information and mitigate exposure to visual hacking. Source: 3M.
GDPR and employee data
As you prepare for the implementation of GDPR, there are a number of practical measures to consider when it comes to processing employee data. Most accountancy firms collect and process personal data relating to their employees on an ongoing basis as part of their everyday personnel administration. Personal data processed by your firm could be anything from salary details for administering payroll to sick notes presented by employees regarding absence. As a result, most accountancy firms will be affected by the EU General Data Protection Regulation (GDPR), which will regulate the processing of personal data when it becomes directly applicable from 25 May 2018. With four months to go before GDPR applies to your firm, this article focuses on what GDPR is and some practical measures you should consider in terms of processing employee data. What is GDPR? Over the past two years, we have noticed many organisations struggle to assess where they should start in terms of preparing for GDPR. It is helpful to remember that we have had data protection legislation in Ireland since 1988 and therefore, firms who have taken data protection compliance seriously are already in good shape for meeting GDPR's increased compliance standards. GDPR builds upon, and enhances, many of the existing data protection requirements and principles under current Irish data protection legislation. Rather than fear it, GDPR should be viewed as an opportunity to re-visit your firm's level of data protection compliance. From 25 May 2018, GDPR will replace the 1995 Data Protection Directive, which is the EU legislation on which the main Irish data protection legislation, the Data Protection Acts 1988 and 2003 (as amended) (DPA), is based. There will also be Irish implementing national legislation to give further effect to, and provide for exemptions from, GDPR. In Ireland, the Department of Justice and Equality published the General Scheme of the Data Protection Bill 2017 in May 2017 (General Scheme). The General Scheme essentially sets out the heads that are proposed to be included in the Irish implementing legislation when it is enacted. As a general comment, the General Scheme is very much in draft form and is lacking in detail. Therefore, publication of the draft Bill is anxiously awaited. At the time of writing, it is not yet known when a draft Bill will be published but it may be released before publication of this article. "Consent" in employment contracts As with the current DPA, in order to process an employee's personal data your firm needs a legal basis to do so. Many of the legal bases that employers currently rely upon to process employee personal data will continue to exist under GDPR. The most relevant legal bases to employers, both under the DPA and GDPR, are as follows: The employee has given their consent to the processing; Processing is necessary for the performance of a contract to which the employee is a party to; Processing is necessary in order to take steps at the request of the employee prior to entering into a contract; Compliance with a legal obligation; Processing is necessary to comply with the employee's vital interests; and For the purposes of the legitimate interests of the firm. In practice, we find that many employers tend to rely upon the first legal basis mentioned above for data processing, namely consent, which is usually procured in the employment contract. For consent to be valid, it must, among other things, be "freely given". This raises concerns in an employment context as it is questionable whether an employee's consent is freely given on the basis of the imbalance of power between employer and employee. The Irish Office of the Data Protection Commissioner (ODPC) has also raised this concern in the context of the existing DPA. The Article 29 Working Party, which is the representative group of EU data protection authorities, recently commented in non-binding guidance that an employee is rarely in a position to give free consent. Significantly for employers, consent can also be retracted by employees at any time and it must be as easy to withdraw consent as it is to give it. Operationally, firms will need to have the resources in place to facilitate an employee retracting their consent. Another point to bear in mind when relying upon consent is that certain data subject rights can only be exercised where consent is the legal basis – for example, the right to data portability and the so-called "right to be forgotten". Based on the concerns with relying upon consent, now is the time to consider whether alternative legal bases could be relied upon by your firm for certain processing of personal data. For example, processing an employee's details as part of payroll could instead be based upon the legal basis of performance of a contract with the employee. There may, however, be situations where consent is the only appropriate legal basis to rely upon. Such a situation may arise, for example, in the context of processing an employee's medical information where such processing is not required by employment law. Where it is necessary to rely upon consent as a legal basis, consent should be procured through a declaration or other document separate to the employment contract, which is not intrinsically linked to the employee's acceptance of their employment with the firm. Data subject rights GDPR introduces new data subject rights and also modifies some of the existing rights under the DPA. A modified right, which many firms may be familiar with, is the data subject access right (SAR). This essentially gives an individual the right to receive a copy of his or her personal data which a data controller (e.g. an employer) holds. In practice, we find that SARs are being made more frequently by employees, particularly as an alternative to discovery in litigation or as a fishing exercise prior to making an employment claim against the employer. SARs as they currently exist can be onerous for an employer to comply with and GDPR will not make them any easier from an employer's perspective. The current tight time-frame to respond to a SAR of "as soon as may be" but not longer than 40 calendar days will shorten under GDPR to a response being required "without undue delay" and in any event within one month of receiving a valid access request. Currently under the DPA, employers are entitled to charge an administrative access fee of €6.35 for processing a SAR, which will be abolished by GDPR unless the employer can demonstrate that the cost will be excessive. The shorter time-frame for responding to a SAR means that firms will need to ensure that they have the policies and procedures in place to comply with a SAR received and that they have sufficient staff and resources. However, if a request is complex or a number of requests are made, then the time-frame can be extended by a further two months where necessary. The data subject must be informed of the extension, and the reasons for it, within one month of the employer having received the SAR. Accountability Accountability is a core principle of GDPR. It requires that firms not only comply with GDPR by implementing appropriate technical and organisational measures and appropriate data protection policies, they must also be able to demonstrate their compliance. The current Data Protection Commissioner, Helen Dixon, has noted that this is not just a pen-pushing exercise. You therefore need to be able to meaningfully demonstrate compliance. As such, this will involve more than simply having data protection policies and processing registers in place that comply with GDPR. Your firm will also need to be able to show that it has implemented such policies through staff training and regular checks and testing, for example. Information to be provided to employees As with the DPA, under GDPR certain information must be supplied to employees before their personal data is collected and processed by your firm. Otherwise, such processing is unlikely to be considered fair and is likely to be contrary to the data protection principle that personal data must have been obtained and processed fairly and lawfully. The information will typically be provided in the form of a notice to job candidates and a further privacy policy will be supplied to successful job applicants as part of their on-boarding induction to the firm. While this information requirement continues under GDPR, the content of such notices and policies will need to include additional information. Under GDPR, the following information will need to be provided: The firm's name and contact details and the name and contact details of your data protection officer (where one has been appointed); The purpose(s) of the processing as well as the legal bases for processing; Where the legal basis for processing is based on the firm's legitimate interests, those legitimate interests should be identified; The recipients or categories of recipients of personal data; That the firm intends to transfer personal data to a third country and the legal basis for the transfer; The retention period for personal data and the criteria used to determine this; How employees (or job candidates) can exercise their right of access, rectification, erasure, restriction to processing, objection to processing and data portability, if such rights apply to the employee (or job candidate); How employees (or job candidates) can retract their consent to processing, where the processing by the firm is based on consent; The right to submit a complaint to the relevant Data Protection Supervisory Authority; Whether the employee (or job candidate) is required to provide their personal data pursuant to statute or a contract, and the consequences of failing to provide such data; and The existence of automated decision-making, including profiling, and the logic and consequences of the processing for the employee (or job candidate). It is important to review existing notices and policies given to employees and job candidates in order to check that they include the above information. Data Protection Officer An important change being introduced by GDPR is the requirement for certain data controllers and processors to appoint a data protection officer (DPO). The DPO will be responsible for overseeing the organisation's compliance with data protection. The DPO is not, however, a new concept. While this will be the first time in Ireland that this role has been codified, many organisations may already have an individual responsible for data protection compliance and DPOs are in fact required in Germany. What is new under GDPR is the fact that a DPO must, under statute, be appointed for the following controller and processor organisations: Public authorities or bodies (except for courts acting in a judicial capacity); Data controllers and processors whose core activities consist of processing, "which require regular and systematic monitoring of data subjects on a large scale"; and Data controllers and processors engaged in large-scale processing of sensitive personal data or personal data relating to criminal convictions and offences. The Article 29 Working Party, in guidance, recommends that controllers and processors document their internal analysis conducted to decide whether a DPO is required. An important point that the Article 29 Working Party have also highlighted is that, while organisations are free to voluntarily appoint a DPO and the Article 29 Working Party encourages this, if an organisation does so, a voluntarily-appointed DPO is under the same obligations as a mandatorily-appointed DPO. With the above in mind, firms that already have an individual whose day-to-day work is largely the same as a DPO may want to consider the increased responsibility of the role; the fact that the DPO reports to the highest management level; that the DPO function must be adequately resourced; and further, that a DPO is expected to have expert knowledge of data protection law. Significantly, it is a form of protected employment as the DPO cannot be dismissed or penalised for fulfilling their tasks within the firm. This role needs to be carefully considered before making an appointment. Peter Bolger is the Head of Intellectual Property, Technology and Privacy at LK Shields.
55% of organisations expect a GDPR audit in 2018
Just 37% of companies have been subject to a data protection audit in the past, while 55% of companies think they will be subject to an audit in the coming 18 months according to research published by Wizuda. With less than 6 months before GDPR comes into full effect, the survey also found that over one third of Irish organisations have not yet started work on their GDPR compliance project with 26% indicating that other projects took priority. Majority of SMEs believe an audit is coming The survey showed that 69% of Irish SMEs consider themselves to be data processors. GDPR imposes direct statutory obligations on data processors, meaning they will be subject to direct enforcement and potential fines by the Office of the Data Protection Commissioner (ODPC) as well as compensation claims by data subjects. All data processors must now make available all information necessary to demonstrate compliance and allow audits to be conducted by the data controller. With the recent 56% budget increase given to the ODPC along with the prescriptive obligations data controllers must now place on data processors under GDPR, only 19% of Irish SMEs believe that they won't be subject to a data protection audit in the next 18 months. Failing at the first email Wizuda's research also revealed that, despite awareness of data privacy demands, 57% of organisations still use email to send personal data. This, Wizuda warns, greatly exposes organisations to a potential data breach or data audit failure. Furthermore, two in five organisations are using old in-house scripts to transfer data, making it difficult to demonstrate compliance when requested in an audit. "While it is worrying that less than two thirds of Irish SMEs have actually started their own project, it is good to see that 80% of those surveyed see IT as a major stakeholder in their GDPR compliance programme," said Danielle Cussen, Managing Director of Wizuda. "Both the OPDC and data controllers will be looking to ensure that all data processors are GDPR compliant, so we would expect the number of Irish companies planning for a data protection audit continuing to increase in the run-up to May 2018." Mike Ross, Commercial Director of Wizuda, added: "Don't wait. If you know of a high-risk area, address it now. The right technical solutions can put permanent fixes into place and make the first steps of GDPR compliance much easier." Source: Wizuda.
33% of Irish companies have not started preparations for GDPR
Wizuda published its nationwide General Data Protection Regulation (GDPR) IT research and found that, although only 37% of companies have previously been subject to a data protection audit, 55% of companies think they will be subject to an audit in the coming 18 months. With less than 6 months before the GDPR comes into full effect, the survey also found that over a third of Irish organisations have not yet started work on their GDPR compliance project, with over a quarter (26%) indicating other projects were a priority. Wizuda commissioned Amárach Research to conduct a national research project across 175 organisations, investigating GDPR awareness, prioritisation and obligations. This study focused on SMEs and targeted IT decision makers ranging from IT Directors, Heads of IT, CIOs and CISOs. "Whilst it is worrying that less than two thirds of Irish SMEs have actually started their own project, it is good to see that 80% of those surveyed see IT as a major stakeholder in their GDPR compliance programme" said Danielle Cussen, Managing Director, Wizuda. "Both the OPDC and data controllers will be looking to ensure that all data processors are GDPR compliant, so we would expect the number of Irish companies planning for a data protection audit continuing to increase in the run up to May 2018." An audit is coming The survey showed that 69% of Irish SMEs consider themselves to be data processors. The GDPR imposes direct statutory obligations on data processors meaning they will be subject to direct enforcement and potential fines by the Office of the Data Protection Commissioner (ODPC), as well as compensation claims by data subjects. All data processors must now make all information necessary available to demonstrate compliance and allow audits to be conducted by the data controller. With the recent 56% budget increase given to the ODPC, along with the prescriptive obligations that data controllers must now place on data processors under GDPR, only 19% of Irish SMEs believe that they won't be subject to a data protection audit in the next 18 months.
Six steps accountants can take to prepare for GDPR
Come May 2018, all businesses within the EU will be required to implement the General Data Protection Regulation. Peter Bolger maps out what you can do to make sure your firm is compliant. Chartered Accountants Ireland has consistently been to the forefront in ensuring the profession it represents remains relevant to business needs in Ireland and abroad. From May 2018, Chartered Accountants in the EU will be required to incorporate new changes, set out in the General Data Protection Regulation (GDPR) and supplemented by the Data Protection Bill 2017 (which is still unpublished), in their businesses. While the GDPR becomes directly applicable on 25 May 2018, one should be aware that it is already a final form law, having been passed by the EU legislators in 2016. The intention of GDPR finally becoming directly applicable in the EU is that it will lead to greater harmonising of data protection rights and obligations throughout the area. This lead-in period facilitates awareness about changes GDPR introduces to privacy law and allows businesses to review and update their current policies and practices on processing of personal data so that these are compliant with GDPR, in so far as is possible, by next May. Contrary to much of the hype surrounding the regulation, one should remember it is not a once off event or test for compliance. The GDPR marks the beginning of an enhanced approach by lawmakers to individuals' privacy rights where those individuals are situated in the EU. From 25 May 2018 onwards, businesses will be required to demonstrate ongoing compliance with these rights. This article focuses on some practical measures accountants in Ireland can take over the next six months to prepare their businesses for changes in data protection law. Application of GDPR GDPR applies to organisations established in the EU that process personal data, either as a data controller or data processor. In practical terms, this applies to every organisation operating in the EU because of the wide meaning of "processing". Processing essentially means anything that is done to, or with, personal data (including simply collecting, storing or deleting that data). The meaning of "personal data" is broader under GDPR than it is in Ireland under the Data Protection Acts 1988 and 2003 (DPA). GDPR adds identifying types of data to the definition of "personal data": "an identifier, such as a name, identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person." The wider definition of personal data under GDPR reflects the significant impact of technological changes on individuals' everyday lives. In fact, this is a primary principle underpinning GDPR; to make data protection rules fit for purpose, taking account of the vast technological developments over the last two decades. These changes in technology also extend to how organisations collect and store personal data. How to the prepare for GDPR Begin data mapping Accountants, whether practising in accountancy firms or acting as Chief Financial Officers in organisations of other disciplines, may be best placed as the 'go-to' person to commence a dialogue on coordinating the organisation's data mapping. Data mapping is a practical prerequisite for any organisation to plan its GDPR compliance strategy. It involves identifying, understanding and mapping out the data flows into and out of the organisation. To be effective, the process requires information to be collated from all departments in an organisation. This is likely to necessitate the input of senior management and IT. As the data map evolves, you should be able to identify the flow of data, gaps in required contracts and consents for processing data under the GDPR, required impact assessments, risks in security measures and whether the organisation should appoint a Data Protection Officer (DPO). Review existing contracts and policies Accountancy firms should review their existing contracts with their customers and suppliers to identify whether the accountancy firm is the data controller or data processor of any personal data it processes under different contracts. The test of data controller or data processor will be determined by the factual matrix and not the terms the parties ascribe to the relationship in a contract. This involves identifying the different categories of data held by your business, the purpose for which you process it, the categories of data subjects, who you share the data with and on whose authority. If an incorrect entity is designated data controller or data processor, it is recommended that the contracts are amended prior to May 2018 to ensure they reflect the provisions under GDPR. In many cases, accountants will be the data processors of their customer's personal data but there may be circumstances where they will be joint data controllers. If this is the case, it is recommended further advice is sought. Get new consents that meet GDPR standards The principle of consent is fundamental to GDPR. GDPR increases data controllers' and data processors' obligations to obtain an individual's consent to process personal data as part of their business activities. GDPR provides, that where consent is relied on for a reason to process personal data, the consent must be "freely given, specific, informed and unambiguous". If your business currently relies on consent for processing personal data, double-check if the consent practices comply with the GDPR. Where possible, it is recommended that organisations rely on a different basis to consent, such as compliance with legal obligations or legitimate interests, for processing personal data. However, this exercise cannot be artificial. For example, if your business sends direct marketing material to clients, you will need fresh consent from each client to do this under GDPR. It is unlikely that direct marketing will be considered a legitimate business of an accountant's practice. It will be important that consents are kept entirely separate from other terms and conditions related to your organisation's offerings. It is equally important that you are able to demonstrate that the consent was freely given, clear, informed and required an affirmative action by an individual. It is likely that consent will require an audit trail to ensure that organisations' consent processes can be independently evaluated. Carry out Data Protection Impact Assessments GDPR makes privacy by design an express legal requirement. Accountancy firms typically have access to their client's personal data during financial audits. The nature of audits, which may include special categories of personal data, akin to sensitive personal data under the current DPA, means it is highly likely accountants will have to carry out Data Protection Impact Assessments (DPIA). A DPIA is a process for building and demonstrating ongoing compliance with GDPR principles and only mandatory when the processing of personal data is "likely to result in a high risk to the rights and freedoms of natural persons". Depending on the circumstances, a DPIA may concern an organisation's single processing operation, or a single DPIA may be used to assess multiple processing operations that are similar. This latter scenario may arise where the same technology is used to collect the same sort of data for similar purposes. The Article 29 Working Party, the advisory body on GDPR, represented by the data protection regulator of each Member State, has issued guidance stating the rights and freedoms in question are not limited to privacy and may involve freedoms of speech, thought, movement, prohibition of discrimination and rights to liberty, conscience and religion. One or more of these rights may trigger an obligation to carry out a DPIA for a processing activity. It is important to be aware that even in circumstances where your organisation is a data controller, and GDPR obligation to carry out a DPIA has not been met, the organisation is still required to continuously assess the risks created by its processing activities and be alive to situations where the obligation to conduct a DPIA is ignited. Assess your organisation's personal data security measures Data security has a prominent role in GDPR. Organisations in Ireland will be required to report personal data breaches to the Data Protection Commissioner. However, this obligation does not arise in all circumstances where there will be a breach. The notification obligation is triggered where the breach is likely to result in a risk to the rights and freedoms of individuals. As discussed above, the rights in issue are wider than data protection and privacy rights. GDPR also places obligations on data controllers to directly communicate breaches to affected individuals unless doing so would involve a disproportionate effort. The Article 29 Working Party has stated in its guidance that this risk exists where the breach may lead to physical, material or non-material damage to the individual whose data has been breached. This could be financial loss, identity theft, fraud and reputational damage. To mitigate against breach notification, GDPR also encourages data controllers to conduct a risk analysis of the security measures they implement to assure adequate personal data security. At a minimum, the GDPR requires these measures to include: The pseudonymisation and encryption of personal data; Ensuring the resilience of systems and services processing data Restoration of access to personal data in the event of a breach; and Frequent testing of the effectiveness of the security measures. In addition to being best practice, putting in place the security measures listed above is likely to remove the standard obligation to inform affected individuals. An organisation's failure to comply with its data security obligations may result in a fine of up to €10,000,000 or 2% of its total worldwide annual turnover. It is much more cost effective for data controllers to review and upgrade their security measures, implement relevant industry best practices and develop and maintain data breach plans. Decide whether to appoint a Data Protection Officer Under the GDPR, an organisation is only required to appoint a DPO where: It is a public body; It carries out large scale regular and systematic monitoring of individuals as part of its core activities; or It carries out 'large scale' processing of special categories of or data relating to criminal convictions and offences. 'Large scale' is said to include large-scale processing operations which aim to process a considerable amount of personal data at regional, national or supranational level and which could affect many data subjects, and which are likely to result in a high risk. Most accountancy firms will not be required to appoint a DPO but may choose to do so. The appointment of the person to the role of a DPO should be undertaken with great care. GDPR does not list specific qualifications or credentials that a DPO should possess, but it does state that a DPO should be a person of high integrity, professionalism and have "expert knowledge of data protection law and practice" to be able to carry out his or her duties. The Article 29 Working Party has issued the following guidance for organisations on appointing a DPO: In determining if a DPO is required, keep a copy of their analysis in their records as this assessment falls within the scope of its wider accountability obligations; Preferably, the DPO should be located within the EU; There can only be one DPO, but he or she can be supported by a team; and Senior managers including HR, marketing and IT individuals are barred from serving as the DPO. GDPR preparation will be a large undertaking for most businesses, but if they take the time to implement some practical data privacy measures before May 2018, ongoing compliance processes won't be so daunting. Peter Bolger is the Head of Intellectual Property, Technology and Privacy at LK Shields.
GDPR is on the way, but there's no need to panic
Colm McDonnell, Partner and Head of Risk Advisory at Deloitte Ireland, shares his thoughts on the new General Data Protection Regulation (GDPR) and Network and Information Security Directive. GDPR has been described as a "game-changer" by Ireland's Data Protection Commissioner. Why is it so important, in your view? With the introduction of GDPR next May, existing data protection laws will experience substantial changes in terms of scope and effect. The existing legislation, based on EU Directive 95/46/EC, was transposed by individual member states in local ways, which led to an ad hoc approach being taken across the European Union (EU). The new legislation means that the application of the legislation will be consistent across all member states and should make it easier for companies to conduct business EU-wide with a level of certainty as to their obligations. In addition, companies must be aware of how and why they use personal data as GDPR increases the right of individuals in relation to the privacy of information and how their information is processed by companies. With the implementation date of 25 May 2018 fast approaching, is Ireland prepared for this new legal framework? GDPR has been on the radar for a number of years and in that time, the Government and Data Protection Commissioner have engaged with stakeholders to ensure that Ireland meets the challenge of GDPR head-on. As Ireland is a knowledge-based economy, it's imperative that the country is ready for 25 May 2018. Deloitte has been working with clients to ensure that they are fully aware of their obligations under the new framework and crucially, that they also have a strategy and process in place to manage the implementation of changes such as the introduction of Data Protection Officers. In the broader cyber environment, what will the Network and Information Security Directive (NIS Directive) do for cyber resilience in Europe? The NIS Directive is forecast for transposition by the Irish Government by May 2018. At this date, companies in industry sectors that are defined as belonging to a sector of national critical infrastructure will be defined. These organisations will be known as providers of operators of essential services (OES) and most of these organisations will already be in heavily regulated industry sectors such as telecoms, energy and transport for example. Such organisations will be subject to the oversight and reporting regime imposed by the NIS Directive. The NIS Directive is focusing on new requirements for network and information security for operators of essential services and digital service providers (DSPs) to provide for network security and business continuity in critical sectors. Essentially, the NIS Directive is ensuring a consistent EU-wide approach to business continuity in critical national infrastructure. As such, cyber resilience across all member states will be strengthened with this new Directive. What roles can finance professionals, such as Chartered Accountants, play in such projects? And should they lead the charge? The implementation of such projects involves knowledge of EU legislation, an understanding of requirements per organisation, seamless integration into daily business operations as well as realising the new opportunities that GDPR and the NIS Directive will bring to business in Ireland. Professional staff, such as Chartered Accountants, are uniquely positioned – as a result of their industry knowledge, professional experience and client focus – to help steer organisations through times of change. As such, a Chartered Accountant is ideally placed to lead the implementation of GDPR and NIS Directive projects for their organisations. If GDPR is still on a firm's to-do list at this stage, what advice would you give them? Given the time-frame for implementation, I would advise that such firms not panic. Rather than approaching this as a stand-alone project, I would suggest engaging the services of service providers who have the knowledge, expertise and skills to help such a firm meet the challenges of GDPR on time and to meet its regulatory obligations. Colm McDonnell is a Partner and Head of Risk Advisory at Deloitte Ireland.
The final countdown to GDPR
With less than 10 months to implementation, General Data Protection Regulation should be high on the agenda of every business and board. After many years of negotiation, the General Data Protection Regulation (GDPR) was adopted into European law in May 2016. This new cybersecurity and data protection legislation will affect customers in Europe and also, those around the world who do business with Europe-based companies. It is important to point out that most of the articles in the regulation already appear in the legislation of individual countries. The aim of GDPR, however, is to harmonise data privacy laws across Europe and create a level playing field. EU companies now have until 25 May 2018 to implement and conform to the new regulations, or face large fines. So if you have not considered GDPR thus far, now is the time to act. A parallel directive affecting the processing of data by law enforcement authorities was agreed at the same time as GDPR, so the EU authorities are clearly taking a serious stance on this topic. However, recent surveys of Irish firms concluded that many are significantly unprepared for the new EU data protection law, with over half of organisations surveyed unlikely to detect a sophisticated attack. In this article, we will provide you with strategies and ideas to implement in your own company as you work towards achieving compliance. Major knock-on effects GDPR brings significant changes to how firms must handle and process personal data. Your organisation's existing processes – which may include collection, retention and deletion, general inputting and so on – must be revised so that they comply fully with the new data protection rules, which are stricter than ever before. When legislation of this nature is announced, one can take a benevolent or malevolent view of the task at hand. If you take a malevolent view, you will see it as more bureaucracy, more cost and so on. If you take a benevolent view, on the other hand, you will view GDPR as a fantastic opportunity to tidy up your data, reconnect with your customers and build better and more solid relationships. Let's take the benevolent view and state that, first and foremost, GDPR is for all EU data subjects and their protection. Customer data belongs to customers and GDPR makes this clear. You might provide data to a company, but this does not mean that they now own it. They merely borrow it and under GDPR, they will need to protect and explain more clearly why they have it. Your organisation's internal governance processes should now be reviewed and, more than likely, altered ahead of the GDPR implementation date. For example, if you process data, new data governance obligations will apply and records of how you prepare and keep records of processing activities will come into force. You will also be required to demonstrate how decisions to use data for further processing are reached. Transparency will be more important than ever before. Personal data must therefore be processed in a transparent manner (i.e. collected for explicit and legitimate purposes), limited to what is necessary in relation to the purposes for which they are processed, and must be accurate and kept up-to-date. New rights for data subjects A data subject is the living person to whom personal data relates. Under GDPR, data subjects will have far more control over their personal data and, quite significantly, the right to be forgotten. This means full erasure of their personal data. Data subjects will also have the right to data portability (i.e. the ability to obtain and reuse their personal data for their own purposes across different services) and, if they require more information on their data, organisations must make it easy to request such data and provide a comprehensive response within one month from the date of request. All of this will inevitably lead to a major increase in the administrative burden for organisations, and that burden will be particularly onerous for those companies who store data on paper. New responsibilities First and foremost, consider your new responsibilities from the perspective of protecting people's digital data. Data protection is not linked to a specific technology, and GDPR is principle-led for the protection of EU data subjects in general. A new concept of joint liability for both data controllers (the entity that determines the purposes, conditions and means of the processing of personal data) and data processors (the entity that processes personal data on behalf of the controller) will come into force under GDPR. The data processors will be jointly liable to data subjects for damages unless they can prove, for example, that a data breach was not their fault. Punishment for breaches will not be extreme and will be related only to how sensitive the data is that you hold, and what steps you have (or have not) taken to protect it. The implication here is that previous contractual obligations may need to be revised and new contracts will require appropriate stipulations. Data controllers will have far more responsibility to provide accurate information on how data is processed. They will, for example, be obliged to detail the retention period for the data and provide information about the legal basis for data processing. So, it isn't only data controllers who will need to maintain records of their processing activities; data processors will as well. 'Data protection by design' is a new phrase in the data protection lexicon. It means that, in each element of designing or compiling a new data-based solution, organisations must demonstrate that the rights of the data subject were considered through encryption or pseudonymisation, for example. Where a security breach occurs, new notification procedures must be enacted. For instance, data processors must report breaches to the data controller. Data controllers must also report security breaches to the country's supervisory authority without undue delay and no more than 72 hours after becoming aware of it. Furthermore, privacy impact assessments will be required when firms wish to undertake certain types of personal data processing. Transfer of personal data Transfer of personal data provisions remain largely the same as was outlined in the previous Directive. However, data transfers under the mechanisms of 'safe harbour' are no longer permissible. The EU/US Privacy Shield agreement was adopted by the European Commission in July 2016 and contains far more stringent rules than the previous 'safe harbour' agreement. It will, for example, offer more channels for the data subject to seek redress. Next steps To get your preparations under way, we suggest that you: • Identify the areas of your business that may be impacted by GDPR; • Seek help to design, develop and implement solutions in line with data privacy requirements. You should also take operational, IT and information security perspectives into consideration; • Design systems to detect, address and prevent security breaches through integrated hardware and software solutions. This should include the discovery and classification of sensitive data, vulnerability assessment, activity monitoring, quarantining, the protection of sensitive data and so on; • Ensure that you are compliant in how you process personal data through your internal governance processes and how you keep track of reporting data breaches; and • Design governance structures to build confidence in the way your data is explored and managed, particularly for unstructured data. A force for good The GDPR preparation period is a great time to review your data – not just for the purpose of GDPR, but for business development reasons also. Ask yourself: do you really know your customers? Can you help improve their relationship with you, so that you better meet their needs while protecting the information they have given you? Consent and general usage of personal data must be assessed no matter what. That said, you can turn this requirement into a force for good and build much greater trust with your customers and employees in the process. Look outside Your organisation may need to employ outside expertise to build internal capabilities, next generation threat intelligence systems, and enterprise monitoring and security operation centres. Ask yourself if your company has a robust plan for the management of security incidents. If you are not confident, now is the time to assess that risk and implement the appropriate security measures that will allow you to deal with incidents within your own firm. Conclusion Europe's new regulatory environment for cybersecurity and data protection is less than a year away. This will offer both opportunities and challenges, ranging from improved governance to securing application and infrastructure. In a globalised and more interconnected business world, being able to navigate the regulatory environment of the future will be a critical success factor for practically all businesses. Your ability to deploy the appropriate security and data protection controls and procedures in a way that can be rapidly demonstrated is now a matter of good governance. The clock is ticking, so there's no time to lose. Billy O'Connor is Managing Director at The Discovery Partnership and a registered IBM Business Partner.
Will you be GDPR compliant?
The EU General Data Protection Regulation (GDPR) is the most significant piece of data protection legislation to be passed in the history of the European Union, according to the team at Ronan Daly Jermyn. "What's really catching the headlines is the new top-end fine, to give an example, the higher-tier provision will result in a maximum fine of up to 4% of a company's preceding year's global, worldwide turnover or €20 million, whichever is greater. Compare that to the existing law where the maximum penalty applicable to most companies is €100,000," said Bryan McCarthy, Head of Ronan Daly Jermyn's Cyber and Data Protection Group. GDPR will come into force on 25 May 2018 and will result in a significant overhaul of the existing European Data Protection regime. It will repeal and replace the current Data Protection Directive (94/46/EC), which forms the basis for the current Irish legislative framework, being the Data Protection Acts, 1988 and 2003. The changes contemplated by GDPR will place significantly more obligations on organisations and give more rights in favour of individuals. Ronan Daly Jermyn has compiled a list of the 10 key changes to the current Data Protection framework all organisations need to be aware of. To read more, click here.
The Data Protection Commissioner (DPC) has also issued some very useful pieces of guidance for readers based in the Republic of Ireland ( https://www.dataprotection.ie/docs/GDPR/1623.htm and http://gdprandyou.ie/ ) , as has the Information Commissioner's Office (ICO) for those based in the UK and Northern Ireland (https://ico.org.uk/). Members are, therefore, advised to regularly check the CAI, DPC and/or ICO websites for the latest information and guidance in this area.


text:
Anco Bulk is een voormalig Nederlands vechtsporter. In 1991 werd hij Europees Kampioen jiujitsu in het duo system in de Spaanse stad Salamanca, samen met Tony van Venrooy. Hij volgde de opleiding tot sportleraar aan de Academie voor Lichamelijke Opvoeding in Den Haag en is momenteel werkzaam als sportleraar jiujitsu.

Nederlands vechtsporter

redpajama_set_name: RedPajamaWikipedia


text:
Samsung set to open Television manufacturing plant in South Africa
Samsung Electronics South Africa announced its plan to open a television manufacturing plant in The Dube Trade Port, Durban by end of this year.
Samsung continues to hold the largest market share of global Smart TV shipments, occupying 26 percent of the market. Its total investment of 20 million USD until 2018, the plan demonstrates the company's effort to satisfy customers in South Africa.
"This project is the result of close collaboration between Samsung and the South African authorities – at National and Provincial level. Samsung remains the leading consumer electronics brand in South Africa and we are determined to add value to the South African community in which we operate," says Matthew Thackrah, Deputy Managing Director of Samsung Electronics South Africa on bandwidthblog, a South African publication.
Samsung has a strong brand presence across various African states with its consumer electronics such as fridges, smartphones, microwaves, washing machines adored by many users.
The Korean electronics giant Samsung has also had plans to open a television, laptop and printers' assembly plant in Kenya, another $3 million plant in Zimbabwe, another in Mozambique and yet another in Ethiopia among others speculated in other African countries.
Image: recombu.com

redpajama_set_name: RedPajamaCommonCrawl


Egbert (802-39 AD) Known as the first King of All England, recognised as king of Wessex in 802. In 829, he was proclaimed "Bretwalda" or sole ruler of Britain.
Æthelwulf (839-58 AD) Æthelwulf was the son of Egbert and a sub-king of Kent. He assumed the throne of Wessex upon his father's death in 839. Æthelwulf is remembered, however dimly, as a highly religious man. He was an only child, but had fathered five sons, by his first wife, Osburga. He recognized that there could be difficulties with contention over the succession, so he devised a scheme which would guarantee (insofar as it was possible to do so) that each child would have his turn on the throne without having to worry about rival claims from his siblings.
Æthelbald (858-60 AD) Æthelbald plotted against his father whilst he was on a pilgrimage to Rome. The specific details of the plot are unknown, but upon his return, Æthelwulf found his direct authority limited to the sub-kingdom of Kent, while Æthelbald controlled Wessex. Æthelwulf died in 858, and full control passed to Æthelbald. However, he did not live long to enjoy it. He died in 860, passing the throne to his brother, Æthelbert, just as Æthelwulf had planned.
Æthelbert (860-66 AD) Very little is known about Æthelbert, who took his rightful place in the line of succession to the throne of Wessex at around 30 years of age.
Æthelred I (866-71 AD) Anglo-Saxon king of Wessex, and son of King Æthelwulf, who ruled England during a time of great pressure from the invading Danes. He was an affable man, a devoutly religious man and the older brother of Alfred the Great. Together, they defeated the Danish kings Bagseg and Halfdan at the battle of Ashdown in 870.
Alfred, the Great (871-900 AD) Youngest son of King Æthelwulf, Alfred became King of Wessex during a time of constant Viking attack. Alfred created a series of fortifications to surround his kingdom and provide needed security from invasion. However, the reign of Alfred was known for more than military success. He was a codifier of law, a promoter of education and a supporter of the arts. After his death, he was buried in his capital city of Winchester, and is the only English monarch in history to carry the title, "the Great."
Edward I, the Elder (900-24 AD) Son of Alfred the Great, Edward immediately succeeded his father to the throne.
Æthelstan (924-40 AD) The grandson of Alfred the Great, Æthelstan succeeded his father, Edward the Elder, to the throne of Wessex. He was the first English sovereign ever to be crowned on the King's Stone at Kingston-upon-Thames in 925. Incorrectly claimed by some to be the first King of All England, Æthelstan was a great warrior, nonetheless, whose fame stemmed from his conquests in Cornwall and Wales, and his defeat of a combined force of Scots, Welsh and Vikings at the battle of Brunanburh in 938.
Edmund I (940-46 AD) Son of Edward the Elder, succeeded his half-brother, Æthelstan.
Eadred (946-55 AD) King of Wessex and acknowledged as overlord of Mercia, the Danelaw and Northumbria.
Eadwig (Edwy) (955-59 AD) On the death of Eadred, who had no children, Eadwig was chosen to be king since he was the oldest of the children in the natural line of the House of Wessex. He became king at 16. An incident, which occurred on the day of Eadwig's consecration as king, purportedly, illustrates the character of the young king. According to the report of the reliable William of Malmesbury, all the dignitaries and officials of the kingdom were meeting to discuss state business, when the absence of the new king was noticed. Dunstan was dispatched, along with another bishop, to find the missing youth. He was found with his mind on matters other than those of state, in the company of the daughter of a noble woman of the kingdom. Malmesbury writes, Dunstan, " regardless of the royal indignation, dragged the lascivious boy from the chamber and...compelling him to repudiate the strumpet made him his enemy forever." Eadwig went on to marry Ælgifu, the girl with whom he was keeping company at the time of Dunstan's intrusion. For her part, " the strumpet" was eventually referred to as among "the most illustrious of women", and Eadwig, in his short reign, was generous in making grants to the church and other religious institutions. He died, possibly of the Wessex family ailment, when he was only 20.
Edgar (959-75 AD) Edgar was made King of Mercia and Northumbria in 957 and succeed to the throne of Wessex at his brother, Eadwig's, death in 959. With this, Edgar was King of Mercia, Northumbria and Wessex (the three most powerful kingdoms in England at that time), simultaneously and could be considered the first ruler of a United England.
Edward II, the Martyr (975-78 AD) Elder son of King Edgar, he succeeded to the throne as a boy of 12, and in so doing, aroused rival claims on behalf of his even younger half-brother, Æthelred II, the Unready. He was murdered by members of Æthelred's household at Corfe Castle in 978.
Æthelred II, the Unready (978-1016 AD) He succeeded to the throne after the murder of his half-brother, Edward II, the Martyr, at the age of ten. His reign was plagued by poor advice from his personal favorites and suspicions of his complicity in Edward's murder. His was a rather long and ineffective reign.
Edmund II, Ironside (1016 AD) Edmund was King of England for only a few months.
Edith of Wessex, (c. 1029 – December 19, 1075), married King Edward the Confessor of England in 1045. The marriage produced no children. Later ecclesiastical writers claimed that this was because Edward took a vow of celibacy, but modern historians have postulated alternative hypotheses, one being that Edward refused to consummate the marriage because of his antipathy to Edith's family, the Godwines.
Edith was the daughter of Godwin, Earl of Wessex, one of the most powerful men in England at the time of King Edward's rule. Her mother Gytha Thorkelsdóttir was daughter to Torkel Styrbjörnsson, granddaughter to Styrbjörn Starke and Tyra and great-granddaughter to both Olof (II) Björnsson and his sister Gyrid by Harold I of Denmark.
When Godwine and his family were expelled from the country in 1051, Edith was put aside by Edward and sent to a nunnery. When the Godwines effected their return through force in 1052, Edith was reinstated.
Upon Edward's death, on 4 January 1066, he was succeeded by Edith's brother, Harold Godwinson. At the Battle of Stamford Bridge (25 September, 1066) and the Battle of Hastings (14 October, 1066), Edith lost her remaining four brothers (Tostig, Harold, Gyrth and Leofwine). She was therefore the only senior member of the Godwine family to survive the Norman conquest of England, the sons of Harold having fled to Ireland.
Other than this, is their anymore info on this obscure and ignored Queen of England? Is there left that can tell us about her personality or her looks? How she felt about the events that she lived through? What she thought of when William the Conqueror and the Normans took over England?
That's an interesting posit, Ithil. Does Carola Hicks give any reasons for the Tapestry's very blatantly Norman political bias?
As for finding out more about this Queen, there are a few references around. Her father and brothers were strong, determined and somewhat ferocious (with Harold, reportedly, being devastatingly handsome) and there's reason, then, to suppose that she may have been like them in some way or t'other. She was well-educated, seems to have been more intelligent than they, and she was very rich. From memory, it was she who commissioned the monks to compile the work which tells us most about Edward, her husband, and it's possible that Edith might have preferred to foster the belief that the marriage wasn't consummated, rather than that she was barren. She would have been important to William, however, due to her money and influence and his anxiety to be seen as a 'honourable' usurper.
P.Stafford: Queen Emma and Queen Edith: Queenship and Women's Power in Eleventh Century England. OUP, 1997.
The scholarly journal, Past and Present, will, most likely, have some articles, too.
The references should be available in college or university libraries and often can be accessed via inter-library loans, if such a system exists in the US between college and local libraries. If not, Past and Present is on the web and you can search articles online and access them for a small fee.
Actually, I've just checked and Lapidge's work is also on the web. Stafford's book will probably available from second hand bookstores on the Web.
Thank you Polly for the info!
The granddaughter of Alfred the Great has returned to England - or at least fragments of a body have returned, more than 1000 years after the Wessex princess was packed off by her brother as a diplomatic gift to a Saxon king. Tests in Bristol are expected to prove that Eadgyth was indeed the woman found wrapped in silk and sealed in a lead coffin inside a sarcophagus at the Gothic Magdeburg Cathedral in Germany.
There is no contemporary portrait of Eadgyth and few insights into her life. She was born in Wessex in 910 into one of the most powerful families in England, the daughter of Edward the Elder and a half-sister to Athelstan, well on his way to being recognised as the first king of all England. In 929 he sent her and her sister, Adiva, off to King Otto and invited him to take his pick, sealing an alliance between two of the rising stars of the Saxon world: Otto chose Eadgyth. They had at least two children before she died in 946.
The historian in the article stated that Eadgyth's blood runs in the veins of every royal family in Europe. I wonder which family is directly descended from her?
Wiki has an excellent detailed line of descent of German rulers and Kings from Charlemagne.
Otto, through his wife Eadgyth (shown as "Edith of Wessex") is an ancestor of many although the direct line in this chart appears to run out with the marriage of Frederick II, Margrave of Meissen (1310-1349) to Matilda (1313-1346), daughter of the Wittelsbach King of Germany and Holy Roman Emperor Louis IV.
However, if every linked blood relationship was shown the tree would most likely be impenetrable.
Thank you for the response and the link.
Edith was highly intelligent, well educated and considered quite a beauty in her day. She married young to a man in his 40s (old by the standards of the day) - who decided for reasons known only unto himself, not to bear offspring.
If Edith was indeed considered barren, Edward could quite easily have put her aside to remarry - but he did not. When Godwin and family were outlawed and Edith confined to a nunnery, Edward could have annulled / divorced her - he did not. Was he truly celibate - we ill never know.
What we do know is despite his "sainthood" Edward was a cruel and vindictive man who may well have withdrawn conjugal rights intentionally.
The logical answer to this is that it was commissioned by the Normans and stitched by the Norman ladies after the conquest.
It was always going to be biased towards the Normas from the moment it was conceived.
I just finish reading Helen Hollick's comprehensive novel, "I am the Chosen King," about King Harold, the defeated king to William the Conqueror at the Battle of Hastings. She posits that Harold was not killed by the supposed arrow in the eye, but was brutally hacked to death on the battlefield. I was intrigued by this, always believing that the arrow to the eye was his mode of death, and started reading about the Bayeux Tapestry. Apparently, that underwent restoration and there are discrepancies in the area where Harold dies. Apparently, William tried to cover up Harold's true mode of death since that could have sullied his claiming the throne if it were known he hacked a crowned and anointed King of England to pieces. Apparently, the Bayeux Tapestry was his form of propaganda commissioned by his half-brother. I'm linking to a website where I read a good article about Harold's death on the battlefield which has piqued my interest more. You have to download the article with Adobe Acrobat.
That is not only possible, it is very probable.
Accounts contemporary to the Battle (those written shortly after it) confirm that Harold Godwinson was killed by several knights, including William of Normandy himself, and his body was dismembered. One such account is the "Song of the Battle of Hastings" (Carmen de Hastingae Proelio) written by the Bishop of Amiens.
First accounts of Harald being shot in the eye appeared several decades after his death (in Montecassino's "History of the Normans").
As for the Bayeux Tapestry, it might have been both an attempt at propaganda, or just a misinterpretation.
Some historians suggest that King Harald is not the man with an arrow in his eye, but the mutilated body lying next to him.
In any case, such propaganda would not have been unusual. Although of course no one could match a later "King of spin" - Henry VII.
The article also claims that the man lying at the foot of the soldier is most likely Harold, not the figure pulling out the arrow. As the Duke of Spin, William preferred the idea of an arrow killing Harold since there was no human intervention in his death, but a divine one seeking retribution for Harold's oath breaking (which he did under duress as William's "guest"). Therefore, William would have had no part in Harold's death; I had also read that he took part in that as well.
Well, killing a Monarch was always a bit tricky business. On one hand, assassinations and murders in battle were obviously common methods of power transition. But on the other, no Monarch (including prospective ones) wanted to give people the idea Monarchs are humans like everyone else and it was OK to kill them (Roman Emperors were a bit careless in that respect).
Naturally, whenever possible new claimants tried to cement their claims by claiming divine intervention of some sort. A symbolic death through an arrow in the eye is certainly preferable to brutal hacking of a crowned and anointed monarch.
Thank you for posting the link to the article. It is late here and I will have to continue reading it tomorrow. It seems that this is another situation where the victor gets to write the historical account to the victor's credit. The Romans did it with Cleopatra and the Americans did it with the American Indians. It is a way of legitimising and strengthening the victor's authority.
I've been studying meaning within images for quite some time.
The domain of investigation chosen was medieval heraldry with a visual language of its own. This research produced an MSc thesis in 2008 and since then I have been developing the theory I presented then. This is mainly an extension of canting arms.
Maybe you understand it better if you begin reading the first post at the bottom of the page (C(e) roi ~ Crois), then the second (Edouard ~ Et due harde) and finally the last at the top (Seint ~ Cinc).
This is very interesting. I plan to read it again more carefully.


text:
Søren Kaspersen (1896 i Jakobshavn – 21. marts 1964 i Egedesminde) var salmedigter og politiker, folkeskolelærer og senere efterskolelærer. Han var medlem af Nordgrønlands Landsråd i perioderne 1933-1937 og 1945-1950 samt medlem af Grønlandskommissionen 1948.

Hans mindesten med relief er udført af Lauritz Jessen og opsat i 1978. Den ligger uden for præstegården til Egedes Kirke i Aasiaat.

Politikere fra Grønland
Lærere fra Grønland
Digtere fra Grønland


Non-Hodgkin lymphoma (NHL) is not a single disease entity, but rather a group of diseases, most of which are B cell in origin, though rare types of NHL are of T or natural killer cell origin. Several immunotherapeutic agents are available for the treatment of B-cell NHL, including the first monoclonal antibody and the first radioimmunotherapy to receive FDA approval.
Rituximab (Rituxan; Genentech, Biogen), an anti-CD20 monoclonal antibody, was approved in 1997 for the treatment of B-cell non-Hodgkin lymphoma (NHL), the first monoclonal antibody to receive approval for the treatment of cancer.
In 2002, ibritumomab tiuxetan (Zevalin, Spectrum) received FDA approval for the treatment of B-cell NHL that has progressed or relapsed after systemic chemotherapy or treatment with rituximab. Ibritumomab tiuxetan is an anti-CD20 monoclonal antibody linked to a radionuclide, the first treatment of its kind.
Follicular lymphoma is a type of B-cell NHL; in 2016, the anti-CD20 monoclonal antibody obinutuzumab (Gazyva, Genentech) was approved in combination with the chemotherapy drug bendamustine for the treatment of recurrent or refractory follicular lymphoma that has been treated with rituximab.
Chronic lymphocytic leukemia (CLL) and small lymphocytic lymphoma (SLL) are lymphocyte malignancies that are morphologically identical, and there is generally overlap between the two; a patient may receive a diagnosis of CLL/SLL. The difference between the two entities is based on location, as CLL is a disease of circulating lymphocytes, while in SLL, these lymphocytes are primarily located in the lymph nodes and/or spleen. As the treatment for these diseases is largely the same, and SLL is a type of NHL, they are covered in this section.
Alemtuzumab (Campath, Genzyme), an anti-CD52 monoclonal antibody, received approval in 2001 for the treatment of CLL/SLL. Ofatumumab (Arzerra, Novartis) is an anti-CD20 monoclonal antibody approved for the treatment of CLL/SLL in combination with chlorambucil in patients who have not and cannot be treated with certain types of systemic chemotherapy. It also may be used as monotherapy to extend treatment in patients who have achieved a complete or partial response after having disease progression after two or more other types of treatment, or it may be used alone for the treatment of patients who have not responded to any other therapy. As SLL is a type of NHL, rituximab and obinutuzumab are also approved immunotherapies.
Combination therapy and treatment algorithms for B-cell NHL depends on the type of NHL, as different types respond to different chemotherapy and immunotherapy regimens. In this section, follicular lymphoma and CLL/SLL treatment algorithms are covered.
Lenalidomide (Revlimid, Celgene) and rituximab.
For CLL/SLL, rituximab may be used in combination with either single-agent or combination chemotherapy regimens, including fludarabine, cyclophosphamide, and bendamustine. Any combination of these agents may also be used in patients with relapsed CLL/SLL. Other treatment options for relapsed or refractory CLL/SLL include idelalisib with rituximab and lenalidomide or alemtuzumab with or without rituximab.
In addition, rituximab maintenance following induction therapy with rituximab with or without chemotherapy is an option for patients with follicular lymphoma, and ofatumumab maintenance is an option for second-line extended dosing in patients with a complete or partial response after treatment for relapsed or refractory CLL/SLL.
A clinical trial is underway investigating the treatment of B-cell NHL with nivolumab in combination with epacadostat (INCB024360, InCyte), an IDO inhibitor. A second trial is being conducted to assess the combination of nivolumab and an investigational anti-CD37 monoclonal antibody called urelumab. Pembrolizumab is also being investigated for the treatment of relapsed or refractory NHL.


We depend on sturdy technical force and continually create sophisticated technologies to meet the demand of Decorative Metal Panels Exterior , decorative metal panels exterior , Decorative Metal Plate , Iran and Iraq. The mission of our company is to provide the highest quality products with best price. We are looking forward to doing business with you!
"Our firm has been concentrating on brand strategy. Customers' satisfaction is our best advertising. We also offer OEM provider for Decorative Metal Panels Exterior , decorative metal panels exterior , Decorative Metal Plate , We now have established long-term stable and good business relationships with many manufacturers and wholesalers around the world. Currently we've been looking forward to even greater cooperation with overseas customers based on mutual benefits. You should feel free to contact us for more details.


text:
Fraze-Brooks | Thomas | Thornburg | Dunkirk | Contact Us | Send Flowers
Fraze-Brooks Memorial Chapel
Thomas Memorial Chapel
Thornburg Memorial Chapel
Dunkirk Memorial Chapel
Banquet and Catering Services
Elmer Junior Osborne
March 20, 1929 ~ June 16, 2019 (age 90)
Elmer Junior Osborne, 90, of Selma, IN passed away Sunday morning, June 16, 2019 at Signature Healthcare of Muncie, IN with family by his side. He was born March 20, 1929 in Blackford County, IN the son of Elmer and Lelia (Blankenbaker) Osborne.
Junior retired from Warner Gear after many years as a parts inspector and tow motor operator. He was a member of Christ United Methodist Church of Selma, IN. He enjoyed spending his leisure time camping with family and friends.
He leaves to cherish his memory a step-daughter, Joretta Hertle (husband, Robert) of Muncie, IN; a son, Ted M. Osborne (wife, Minda) of the Philippines; a daughter-in-law, Judy Brooks; three sisters-in-law, Mertle Osborne, Cynthia Osborne, Rosie Duckworth (husband, Dan) and Louise Luttrel; two brothers-in-law, Ron Jarrett and Paul Gaines (wife, Ruth); seven grandchildren; seven great grandchildren; and 50 Nieces and Nephews. He was preceded in death by his parents; his wife of 50 years, Frances; a step-son, Ronald A Brooks; four brothers; and five sisters.
A service to celebrate Junior's life will be 11:00 a.m. Saturday, June 22, 2019 at Wilson Shook Funeral Home, Thornburg Memorial Chapel of Parker City, IN. Burial will follow at Gardens of Memory Cemetery of Muncie, IN. Family and friends may gather to share and remember one hour prior to services, at the funeral home. Memorial contributions may be made to the American Diabetes Association. Envelopes will be provided at the funeral home. Online condolences may be expressed at www.wilsonshookfuneralhomes.com.
© 2019 Wilson-Shook Funeral and Cremation Center. All Rights Reserved. Funeral Home website by CFS


Off Limits: Standard FLW Outdoors off limits apply plus 200 yards upstream and downstream of the Earle Mae Basin entrance (on both sides of the river).
Fishing License: Georgia and Florida fishing license do reciprocate on the main body of water only. Any tributaries must have a license specific to that state. A Georgia license can be purchased by calling 888.748.6887. A Florida fishing license may be purchased by phone at 888.347.4356. Licenses may also be purchased at Walmart.