Who thinks about securing data when travelling?
Your clients are bound to access data when travelling. In the age of the smart phone, data privacy, and hacking you and your client are going to have to think about data privacy before anyone leaves home.
Taking personal data to high risk countries?
Some countries, such as the USA, give their border security team the right to access and download all the contents of any laptop or smart phone on a person wanting to enter the USA. The equivalent of digital strip searches are increasingly common and demands that you turn on and hand over your device as surprisingly widespread.
Having personal or corporate confidential information on such devices whilst travelling is not wise. There are no current limits to what can be done with that data once a device is accessed and its contents copied.
Others, such as China, prohibit access to apps and programs which many of us take for granted as part of our day-to-day business and personal lives. A few countries block Telegram or other encrypted end to end communication apps, some also block WhatsApp.
Your client will need to think about the IT side of data when travelling
- Agree alternative platforms if needed
- Remove access to some programmes
- Remove access to special category data
- Add VPNS, anti-malware, encryption
- Assess risk of data loss
- Set up remote tracking and wiping
- Check existing data policies
We still see people travelling around the world with access to all data on unencrypted devices.
Leave the main device at home?
Would taking a new phone getting a new local sim reduce the risk of data loss? That would be a phone with no historic data, loaded with only the apps needed for the trip. Some countries do not permit purchasing sims without a residential address but some sims can be purchased in advance or at the airport.
Would taking a new secured and encrypted laptop with no data on it reduce the risk of data loss? As long as there is internet access to the cloud via secure access this can be a good alternative where there is sufficient connectivity.
Read their data privacy statement
If your client’s policy states no personal data is shared overseas, (or does not mention that it is) then you or your client accessing or viewing data overseas is contradicting this.
If you all carry on as normal this can put them in breach of their policy and significantly increase the risks of a data breach.
While many would not worry about reading emails at an airport, (though personally I would only do so via a VPN) accessing data bases, mailing lists, etc with large numbers of customer information, or confidential business plans, are be an entirely different thing.
Be very careful about health related, financial or ID related data – all of which are highly prized by people who want to steal them.
Insurance for data when travelling
Are the devices insured for loss or damage? But what about the data. Many cyber insurance and data loss policies stop when your client leaves the country. Do they need to inform their insurers of what they are accessing when abroad?
This will vary from policy to policy and but should always contact their broker/insurer and notify them, not only that the device(s) are leaving the country but what will be accessed whilst away.
Family and personal data
There are security and confidentiality implications for their own personal data too. Removing any of their personal data that may be used for identity theft, corporate espionage, hacking or other inappropriate activity may make this sound a bit ‘James Bond’. But in a world of internet hacking and phishing, (and physical theft of devices) it is better to be safe than sorry. All those pictures of their kids can quickly find their way onto very dodgy sites, never mind their business confidential information.
Protect your client’s data
If you are applying for visas, and need to share your client’s or delegates passport details, or other ID related details, make sure you are sharing this information securely. It should never be just sent around in open emails.
You need to review your own insurance and data privacy policy if you are doing the travelling. And you need to make sure your client knows you are accessing personal data outside the UK and have the appropriate paperwork in place.
Whether you need to go over to a global contract, or add a cross border data privacy agreement to your pack, you need to make sure that personal data is being handled in a transparent way.
Protect your business
For more information on which document packs are needed when read this article here
