Coronavirus is sadly still in the news this week, with a big leap in infections to 25,000 (globally) and a spread to two additional cities in the region. The world and certainly the media seem to be on alert.

Mercifully, the mortality rate appears to be lower than MERS or SARS, and there are even some initial reports of some optimism that this may not be as bad as first feared. This is of course little comfort to those already impacted.

I personally remember the SARS outbreak whilst in Canada, and the fears over Ebola in West Africa more recently, whilst in the UK. I was in a call centre environment for both and a few immediate thoughts leap mind.

• Our first thought has to be the well being for other employees, ensuring the team is healthy and protected where-ever possible….. are all appropriate steps being taken?… am I aware of next steps?
• The second thought is ensuring continuity of service for customers, ensuring they have access to services and tools for themselves. This even includes continuity should the call centre (and outsourced vendors) have to temporarily suspend operations…. what is the Business Continuity Plan?… where is it?… am I comfortable and do I have an understanding of next steps?
• Lastly, on assessing risk.…do I know the latest facts and news?… does my company have expert advice?… what is the protocol?

Fortunately, the progress in digitalization and options for remote working the last few years, should all help with our readiness and plan, especially should the situation worsen here.

We all hope this is nothing, I certainly do, and yes this feels all a bit doom and gloom for a Wednesday night. (I did have quite a bit of eye-rolling today when discussing this earlier in the day!). However, this does not and should not prevent us from being prepared and reviewing plans tomorrow.

Being even a little more prepared is a strategy that can make a huge difference in generating better outcomes… for employees, customers and company

So…. it may be worth dusting off the plans or at least asking the ‘what if‘ question tomorrow.

[for more on readiness planning… see some previous thoughts here… for good facts on the outbreak, I recommend following @HelenBranswell and @Laurie_Garrett on twitter… I am at @chris_w_tweet

The other week I was lucky enough to spend a bit of time with Dentons, who had Giovanni Buttarelli (the European Data Protection Supervisor) as a speaker. Obviously GDPR was top of mind for the audience and in particular some of the legal nuances with implementation.

There were a couple of key themes discussed.

Impact of Brexit:  This is becoming an increasingly pressing issue politically in the UK. Although GDPR will be implemented in May 2018, we also need to consider what will happen if the UK leaves the EU. At that point it will become a third country (unless in Single Market) with associated restrictions for data.

“Personal data shall not be transferred to a country or territory outside the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data”. [link]

In order to establish adequacy, the view was that it would take considerable resource and time (more than a year). There is obviously hope for an agreed compromise, however preparations should take place.

Obtaining guidance and advice from the regulator:  Although national regulators like to help, they are limited on resource and with such a significant change will not realistically be able to provide tailored advice to each firm on request. While UK has been working hard, Germany and Austria are advanced and ready, so don’t expect too much direct guidance from the regulator. [It may be worth taking independent advice].

Priorities for enforcement: The change impacts a wide swath of industries and business and is a complex area. Firms who are non-compliant will most likely be viewed through the follow lenses.

1. Is the firm actively trying to comply and doing something to improve their compliance? (i. doing nothing is not good).
2. Has the Data Protection Officer been selected appropriately?  Do they have expertise and independence?
3. Is the firm transparent with privacy issues?
4. Is this explained to the customers/subjects in a simple form?

Lack of resource – risk of non-compliance

GDPR is a complex area, the legislation is complex and is requiring significant effort to implement.

The consensus across the room was that many firms have developed central programs that are already underway, with data discovery and some pre-work already in place.

However, what was also clear was that this is, only now, gradually rolling out to the wider organisation for implementation. With less than three months to implement, and fines in place for non-compliance (and especially if nothing is done), this could represent a material risk to many organisations. The changes are not insignificant.

Previously published at arum.co.uk