GDPR: how can I email data securely to comply with the new regulations?

As a freelance media professional, I am often asked by my various employers to send copies of my passport, completed visa forms and other sensitive data in the form of email attachments. I have recently questioned this and have not really got a satisfactory response. I have tried uploading these documents to my Google Drive account and giving them a link, though I don’t really know whether this method is any safer. However, I am at a loss to see how companies should acquire such sensitive data in light of the new GDPR rules coming into force in May. Robert

The European Union’s General Data Protection Regulation (GDPR), which comes into force on May 25, will govern the storage and processing of data rather than its collection. It also includes some very important consumer rights. The most important are the right to be informed, the right of access, the right to correct errors, the right to erase data, the right to restrict processing, and the right take it elsewhere (data portability). How useful these will be in practice remains to be seen.

“Personal data” includes names, addresses, phone numbers and IP addresses, as well as whatGDPR calls “factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”. That includes biometrics such as face, fingerprint and iris recognition, and genetic information. In other words, you may have personal data that identifies someone even if you don’t know their name.

GDPR applies to companies and organisations, particularly those with more than 250 employees. Home and household users are exempt. However, as a freelancer, you store and process data, even if the “processing” just means entering a name in an address book and looking it up. You should therefore do an audit of the devices and software you use to make sure that other people’s personal data is protected. This may require the use of data backups, passwords, encryption, malware protection, and a VPN when using public hotspots. The GDPR also obliges you to tell people if there are any security breaches.

You should also audit your data to make sure that you are only holding data that is necessary for your jobs, or that you are legally required to hold, eg for tax purposes.

The UK’s Information Commissioner’s Office (ICO) has a useful 12-step plan (PDF), though like most things GDPR-related, it’s aimed at companies. IBM’s Liz Henderson provides a good summary in two posts on LinkedIn, GDPR Plan – Do you have yours? and GDPR Initial Steps, What’s Next...?

Note: the GDPR is being modified and implemented in the UK by the data protection bill, which is still going through parliament. It should include some exceptions for journalism similar to the ones in the previous DPA, so check whether these apply to you.

Email problems

You are right to be concerned about sending things by email. Emails are more like plain text postcards because they can, in theory, be read at any of the many servers through which they pass, or by someone tapping a line. Of course, “read by” is unlikely to mean “read by a human being.” However, software can look for things like passwords and credit card numbers.

A more likely problem is sending emails to the wrong address, either because users have got their own email addresses wrong (this happens surprisingly often), or through human error. Pick the wrong address from a list of auto-complete suggestions and you could send personal data to the wrong recipient. This would be a data breach that might have to be reported.

It would obviously be good thing if all emails were encrypted by default so that only the intended recipient could read them. Three decades of history says this isn’t going to happen soon, if at all. Public key encryption is too hard for people who just want to send normal emails.

View image in fullscreen

Some large organisations do have encrypted email services, such as the NHS, but that doesn’t help the rest of us.

Some people do choose secure email services, such as ProtonMail in Switzerland and Tutanota in Germany. However, you also have to send external recipients a password – for example, in an SMS text message – to decrypt the email.

Tutanota users get an email that says “you have an encrypted email” and you click a link to read it, and reply to it, in a browser. You have to export the email if you want to keep a copy.

There are also plug-ins for Gmail and the Microsoft Outlook email program that provide secure email services. If one of your employers is using a secure system, they might let you join in.

If there’s no other alternative, you should encrypt and password-protect your images and documents before sending them as email attachments. Again, you must send the password separately, either via a different messaging service or in the post.

Online storage locations

It’s a good idea to upload attachments and then send people a link. However, bear in mind that you are uploading documents to the company that probably runs the biggest surveillance operation on the planet. Encrypt your documents before you upload them.

Encryption protects data if an online storage service is compromised – it has happened – or if your email is hacked.

Unfortunately, using Google Drive brings up an extra complication. If you are using Gmail, then you can assume that your data is being held in, or passing through, or accessible from the USA.

GDPR does not oblige users to store data on servers inside the EU. However, there are extra requirements if servers are outside the EU. First, you need to have a legitimate reason for transferring personal data outside the EU. Second, you must have the consent of the person whose data is being exported. Third, you must give that person the option to opt out.

In another post, the aforementioned Liz Henderson explains how to create a GDPR Privacy Notice, and you could adapt her sample to cover Gmail storage outside the EU.

You could switch to using an email service that operates wholly within the EU (see above), if only for any people who opt out, or you could upgrade to Google’s paid-for service.

Google claims that its G Suite and Google Cloud Platform (GCP) services are fully compliant with GDPR, because it offers to sign EU Model Contract Clauses and a Data Processing Amendment. The fine print notes that “the parties acknowledge and agree that Non-European Data Protection Legislation may also apply to the processing of Customer Personal Data” and that “Google will not process Customer Personal Data for Advertising purposes or serve Advertising in the Services”.

I don’t think GDPR will actually stop advertising-driven personal data processing. Just look forward to clicking “I agree” to lots of terms and conditions you won’t even bother to read.

IANAL!

Bear in mind that GDPR is a legal matter and I am not a lawyer. I am also not an expert on GDPR. Companies who can be fined up to €20 million or 4% of their annual turnover should take this stuff seriously and follow the ICO’s advice. Lots of consultancies are offering guides, training, software toolkits and other services, too.

Freelancers like us are not the target, but we should work to comply as best we can. In particular, don’t keep any personal data you don’t need, and store and use it securely. Indeed, you should do those things even if the GDPR didn’t exist.

Have you got a question? Email it to Ask.Jack@theguardian.com