IT Systems and Data Protection

GDPR: The public sector scarecrow

SPONSORED INTERVIEW

PSE’s Josh Mines chats to Martin de Martini, CIO of Y Soft, about what the General Data Protection Regulation (GDPR) will mean for the public sector and how it manages its physical information.

GDPR, the regulation on everyone’s lips, is finally here, and it’s no surprise that the public sector is now scrabbling to get its house in order.

The regulation, which is finally coming into force in May, will place new legal obligations on ‘controllers’ and ‘processors’ of information at all data-holding organisations across the country to process their data in a secure and responsible way.

Whilst digital-only data can be more easily logged, tracked and recorded, this raises some interesting problems for paper-heavy public sector organisations.

But as Martin de Martini, chief information officer of Y Soft, puts it, GDPR should not be seen solely as a difficult challenge for the public sector.

“When I think about GDPR the first word that pops up in my mind is scarecrow,” he told me.

“A lot of companies would say they are afraid of GDPR and what it’s going to bring up, but it should also be seen as an opportunity.

“What GDPR says is you need to clean your desk, and sort out the vast array of your processes, data flows and documents, and how you deal with your data.

“Obviously, if it’s purely digital then it’s simpler and easier than when you do paperwork and digital work. Even though a lot of countries are talking about creating paperless offices and paperless governments, I don’t believe that this is going to happen anytime soon.”

The problem with paper

In the UK public sector, this is certainly true. Years of paper collection of data have led to a mountain of physical documents that most public servants will be familiar with.

“If you print a lot, copy a lot and scan a lot then you have a lot of data on paper that you need to manage somehow,” de Martini explained. “You need to find a solution so that you are able to manage the flow, printing, copying and scanning of the document.”

This is especially important given the basic principles behind GDPR. “One of the obligations within GDPR is to have transparency and visibility of the data flow within an organisation,” the Y Soft chief continued.

“When talking about paper documents, an enterprise workflow solution is really the product that would offer this transparency and visibility, so you would know who is printing, copying and scanning information, and you can track documents as well.”

What exactly will GDPR change?

Of course, GDPR isn’t the first data regulation to have been implemented in the UK, but it is certainly a landmark moment in how sensitive information is stored.

So what is going to change for the public sector after May? “What’s new is that this regulation gives people rights on the subject of what information is being managed and collected about them, and they have the right to ask to delete it, so government organisations need to have a solution that reflects those needs,” de Martini told me.

“The fact that people have this right to ask organisations what is being collected and processed means that organisations need to make sure that only the right people know where certain data is.

“For other rights, like right to alter the data if it’s incorrect or incomplete, and right to be forgotten if the government organisation has to sort data for other legal purposes, then they need to store it and it gets a little tricky.”

Enterprise workflow solutions could therefore be a useful tool for the public sector. If paper documents can be scanned, recorded and managed at every level of an organisation, in one place, then they can also be easily tracked and found if and when the owner of a piece of data asks for it.

“When we are at the boundary of physical paperwork and digital work then this is exactly the place where workflow solutions come into play,” de Martini commented. “Once you are printing, copying and scanning then you have a lot of unstructured data that can be on paper that is related to personal information, and you need to manage it somehow.

“So you need an enterprise workflow solution that would manage that and put some order into this flow of documents so you can control who has access to data.

“With that you have an additional level of data as you have emails, usernames, document titles and maybe metadata from scans, and you need to properly store it. For that you need a solution that only gives data to the people who should know, which also helps organisations come in line with key GDPR rights and obligations.”

Boosting productivity

As well as helping organisations make good on obligations set out by GDPR, effective workflow management is also capable of creating efficiencies for organisations. As de Martini told me, it’s about automating the often painstaking process of getting rid of physical data.

“The biggest benefit can be in automating the transfer of paper documents into digital work,” he said. “I can imagine a few workflows that you fill in electronically which you have to print, scan and digitalise through the scanning workflow.

“Through our products you can convert paper documents to documents that are designed for long-term archiving. So you have a physical copy you can put into the archive, and you can automatically resend by defined workflow the digital copy in the archive format to a digital archive.”

Though the regulations that are on the horizon may appear daunting to the public sector, it’s also exciting that it could reinvigorate new efforts to digitalise data and move to a paperless system.

As de Martini says, this isn’t going to happen overnight – but now that organisations have a legal obligation to better manage their information, there simply has to be a shift in attitude if councils and other organisations are going to keep up with the new GDPR regulations.

(Top image © anankkml)

FOR MORE INFORMATION
You can find a guide to GDPR compliance at:
E: [email protected]
T: +44 (0)7802 442 036
W: www.ysoft.com/gdpr