Data protection is in order at the Concertgebouw
After a “privacy quick scan”, the Royal Concertgebouw – home of Amsterdam’s world-famous Royal Concertgebouw Orchestra – was clear about what still needed to be done to comply with the EU’s General Data Protection Regulation (GDPR).
What was the problem?
Since 25 May 2018, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has enforced the provisions of the EU’s General Data Protection Regulation (GDPR). The Concertgebouw had already taken measures to comply with this new privacy legislation. For example, it had made changes to the security of its IT systems and the organisation of its IT processes so as to ensure protection of the personal data of employees, concertgoers, donors, and suppliers. However, the management wondered whether that was enough. Had they overlooked anything? That’s a question that a lot of organisations ask themselves when privacy and governance don’t originally form part of their primary process.
So what was the solution?
PwC’s privacy quick scan provided an answer to the Concertgebouw’s questions in the form of three steps, taking three weeks. PwC’s privacy experts assessed the business operations, legal issues, and IT processes in relation to one another. As the first step, the PwC experts talked to staff of the organisation to determine which processes contained personal data. Step two was a workshop at which the experts and all the parties concerned determined what personal data risks were involved and which risks definitely needed to be managed. In step three, PwC presented a report setting out a practical roadmap, with recommendations and priorities so as to comply fully with the GDPR.
And what’s the result?
The world-famous Concertgebouw – with its thousands of visitors and its prominent board members and donors – naturally assigns high priority to the security of personal data and protection of its image and brand. The roadmap sets out specific steps with regard, for example, to final adjustments in access to IT systems, definition of responsibilities, raising awareness among employees, and conclusion of processor agreements with third parties. The Concertgebouw has been able to implement these steps itself in order to be compliant with the GDPR in good time.
Contact
Ron Martinek
Partner, Microsoft Alliance Lead Netherlands, PwC Netherlands
Tel: +31 (0)62 243 92 72
