Olivier Rigaudy, Directeur Général Délégué du groupe Teleperformance
Which changes do you need to implement within your company in order to be compliant with the GDPR ? Could you please, among others, detail, depending on the activity of your company, the measures that you have taken and that you will take regarding privacy by design and privacy by default?
Teleperformance has created the Privacy Office that is led by the Chief Privacy Officer and that is composed by 3 Data Privacy Officers (each responsible for the following regions: Americas (North, Central, South), CEMEA + UK, Portugal and Spain, Asia Pacific).
We will ensure that the appropriate provisions set forth in the GDPR are integrated in our agreements whenever it includes a processing of personal data.
We need to ensure that each company subject to the GDPR maintains the appropriate register up-to-date with all the necessary information relating to the processing of personal data.
We already have in place an incident response process that enables us to handle fraud events or data breaches, but this incident response process will be adapted to ensure that, (i) if there is a breach of the data of our Clients’ customers, we report the breach to the Client without undue delay and (ii) if there is a breach of the data of our employees, for instance, we are able to report the breach to the Supervisory Authority and the data subjects without undue delay too.
Privacy by design and by default: Teleperformance has already established a Technology Privacy Committee that aims at discovering potential information privacy issues before Teleperformance implements new processes, technologies, systems, programs, and devices.
Which difficulties do you encounter to ensure compliance with the GDPR?
Teleperformance acts as both Data Controller and Data Processor, thus we need to ensure that we are compliant with the GDPR in both scenarios.
It was a long process to proceed with the data flow mapping because Teleperformance is located in 77 countries.
All the countries do not ensure the same level of protection (some of them provides for quite a low level), and thus, we will have to ensure that even the subsidiaries located in those countries are compliant by May 2018.
What do you think about the cultural change introduced by the GDPR (from a system of “obligation to declare” to the “principle of accountability”)?
This obliges us to put in place the appropriate process and training to ensure that the companies properly maintain and update the Register on which will be detailed the processing. Indeed, the burden of proof is reversed and this is now the company that needs to prove that it is compliant, while, before it was up to the Data Protection Authority to show the non-compliance of the company, and thus the company had some time to regularize the situation. This is more stringent for the companies but this will help increase the confidence of the employees in the processing of their personal data and this will reassure our Clients when we process the personal data of their customers.
How do you see the evolution of the life of the company with the GDPR?
The GDPR will provide assurance to our employees that their personal data will be adequately protected. Regarding our Clients, on the one hand, there will be more and more discussions regarding the negotiations of the agreements and the liability provisions but we believe that the GDPR will provide assurance to our Clients that personal data of their customers is adequately protected. In addition, thanks to the BCRs that we are implementing, this will give us flexibility to choose service locations depending on our Clients’ operational needs without worrying about international data transfer laws as all the companies of the Group will provide for the same level of protection.
We already conduct audits to ensure that the companies comply with the security and compliance policies that the Group implemented in 2015 in order to reduce security and fraud risks, thus the compliance with the GDPR will be integrated into the audit program. We already have a strong culture of security, thus, we are already used to aligning our processes and implementing new tools to protect personal data