公告&动态 第181页

今天，欧盟委员会提交了关于下一个“欧洲地平线”（Horizon Europe）研究与创新框架计划（FP9）[COM(2018)435]。欧洲标准化委员会（CEN）和欧洲电工标准化委员会（CENELEC）欢迎接纳这项雄心勃勃的提案，该提案对欧盟工业的全球竞争力起着至关重要的作用，并承认标准化（第2条）是传播和采用研究和创新活动的关键工具。

欧洲地平线是在拟议多年的欧盟多年度财政框架（MFF）背景下制定的，即欧盟未来7年的预算，成为必须履行的欧盟2020年后的优先事项。“欧洲地平线”计划旨在传播欧洲的卓越成果，建立以知识和创新为基础的社会，提升欧盟工业竞争力，并通过加强跨部门合作来加强欧盟战略政策优先事项的落实。它将于2021年1月1日生效，为期7年，取代目前的“地平线2020计划（2014-2020）”[COM（2011） 808]。

一、我们对欧洲研究和创新项目的贡献

欧洲标准化是实现“欧洲地平线”目标的关键工具，确保欧洲和全球市场有效地利用和吸纳创新。

标准化对欧盟研究和创新框架计划（FP）的贡献可追溯到90年代初期的FP4（“标准、测量和测试子计划（SMT）”）和FP5。在其后的框架计划中，标准化成为了支持所有相关研究领域的横向支持工具。

2008年，欧盟理事会发表了关于“标准化与创新”结论，正式承认“标准化可以为开发创新和竞争力作出重要贡献，能够有利于公司和产品进入市场，实现新产品、现有产品、服务和流程之间的互联，加强消费者对创新和研究成果的信心”。

FP6、FP7和最近公布的“地平线2020”计划的实践经验表明，研究和创新项目中成功整合的标准化活动，产生了具有市场影响力的结果，并且远播在欧洲乃至全球市场。在“地平线2020”中，CEN和CENELEC的成员参与了50多个研究项目。

二、欧洲标准化和欧洲地平线

在新的研究框架下，标准化将在三大支柱中发挥关键作用：

1.“开放科学”支柱：

在这个支柱的 “MarieSkłodowska-Curie（玛丽.居里计划）”（MSCA）中，CEN和CENELEC可以通过“标准化教育”为研究和创新提供高技术水平和灵活的人力资本基础，为研究人员提供支持，提高他们的创业、数字和创新技能。

2.“全球挑战与产业竞争力”支柱：

标准化是可持续经济增长和产业竞争力的关键驱动力之一。为了解决我们面临的全球挑战（全球变暖、安全社会、清洁能源等），CEN和CENELEC已经开始开始研究欧盟委员会在“欧洲地平线”上确定的所有5个优先事项：

l  健康

l  包容和安全社会

l  数字和行业

l  气候、能源和人口流动

l  食物和自然资源

3.“开放创新”支柱

通过这一支柱，欧盟委员会希望应对新一波基于“深科技”技术的全球突破性创新浪潮，如区块链、人工智能、机器人等技术将深深影响传统行业，如制造业、金融服务业、运输业和能源业。欧洲和国际标准化工作已经着手解决这些挑战，例如：支持欧盟行业优先，与环境目标、身份管理、系统互联、安全与（网络）安保的相互联通。

三、CEN和CENELEC对“欧洲地平线”的承诺

CEN和CENELEC将全力支持未来的“欧洲地平线”计划。CEN和CENELEC仍然决心加强标准化、创新、研究三者之间的联系，并准备与欧盟委员会、欧洲研究领域和欧洲创新联盟中的其他主要行动者合作，提出一个长期框架计划，将适当的研究成果与创新和标准化连接起来。

CEN和CENELEC也欢迎拟建立的“欧洲创新委员会”（EIC），该委员会将“在研究、商业化和公司规模扩大之间搭建起‘死亡之谷’的桥梁”，并期待与EIC一起探讨标准化能够如何有效地为这些目标作出贡献。

此外，与国际标准化组织（ISO）和国际电工委员会（IEC）的合作，促使欧洲和国际标准高度一致性。CEN和CENELEC将推动全球吸收欧洲的创新，从而支撑“欧洲地平线”雄心勃勃的目标：“使欧洲成为研究和创新领域的世界级领导者”（副主席，Jyrki KATAINEN同时担任欧盟委员会副主席，负责工作、增长、投资和竞争力等工作）。

CEN和CENELEC期待携手莫达斯（Moedas）委员和欧盟委员会共同努力，“保持欧盟在全球研究和创新的领先地位”，取得“地平线2020”计划的成功，并利用标准化带来的好处，“真正改善公民和整个社会的生活”。

58 per cent of businesses have no defined process for responding to Data Subject Access Requests

New research by BSI, the business improvement company,has revealed that over half of European organizations have no fixed method in place for responding to Data Subject Access Requests (DSARs). The research, carried out by the Cybersecurity and Information Resilience division of BSI in preparation for the GDPR, also highlighted that a third of European businesses rate themselves as highly likely to receive a DSAR.

A DSAR is the legal mechanism which allows European citizens to obtain a full account of all personal data an organization holds on them, an explanation as to why this information is being held, and copies of this data should they wish.

DSAR and the GDPR

The GDPR, coming into effect on Friday 25 May, has greatly increased the awareness levels of citizens to their rights as data subjects, and also organizations processing or collecting personal data for EU citizens will no longer have the inhibiting factor of a charging fee (currently UK organizations may charge a fee of up to £10 or £2 if it is a request to a credit reference agency for information about financial standing only) for responding to a DSAR.

All companies will need to comply with stricter rules concerning the data protection and privacy of data subjects (citizens) within the EU under the GDPR. Failure to comply could result in fines of up to €20 million or 4 per cent of an organization’s annual global turnover.

DSAR and impact on resources

While the submission of data requests from private citizens is not a new phenomenon, the process is about to get significantly easier with the GDPR. The way in which organizations can receive a DSAR has expanded outside of the traditional postal option, or email channels, and can be received verbally in person, through a live chat portal, verbally over the phone, or even via social media channels.

The research also asked respondents what cost they would be allocating post 25 May for handling DSARs in organizations and it revealed that one in five organizations estimated a cost of up to €28,000.

Under the GDPR, organizations will now be expected to complete DSARs within one month, rather than the existing 40 day timeframe. Sources of data within an organization can include CCTV data, phone call data, web chat log data, CRM records and order history. Where a DSAR relates to an employee, it can also include all emails, any meeting minutes where the employees name is mentioned or documents or correspondence relating to any work they have done.

Commenting on the research, Stephen O’Boyle, Head of Professional Services at BSI, said the implications of DSARs could be onerous: “The resources required to undertake a DSAR can be considerable, and shouldn’t be underestimated. Organizations will be expected to wade through huge volumes of data within the reduced one month window stipulated by the GDPR.”

There is also a concern that organizations may face disruptive DSARs from disgruntled customers or ex-employees, those with a personal gripe, or someone with enough knowledge to cripple an organization with an extensive DSAR. Addressing UK organizations directly, Stephen continued: “The motive behind DSARs is not always clear but the end result may include significant costs in responding in terms of resources, and the risk of a complaint to the Information Commissioner’s Office if your handling of a request falls short.  Preparation is key and organizations who have a structured plan in place and who consider additional supports to aid it, such as additional technology and staff awareness training, will reduce the risk of non-compliance in responding to a DSAR.”

The Cybersecurity and Information Resilience division of BSI provides a range of solutions to help organizations become GDPR compliant including consulting, training, research, technical solutions and outsourced Data Protection Officer (DPO) services. For more information visit

The GDPR and Business Compliance: Access the General Data Protection Regulation Standards Package

The General Data Protection Regulation (GDPR), which goes into effect on May 25 across the European Union, means major changes in data privacy regulation. For businesses, the high cost of non-compliance with the GDPR is a fine of up to 4 percent of annual global turnover—or €20 Million. Three standards, available as the ISO/IEC 27001 / ISO/IEC 27018 / BS 10012 – General Data Protection Regulation Package, and adherence to their voluntary consensus guidelines can help to comply with the legislative requirements of the new regulation.

While the GDPR will apply to organizations located within the EU, it will also impact organizations located outside of the EU if they offer goods or services to, or monitor the behavior of EU data subjects. The regulationreplaces the Data Protection Directive 95/46/EC, and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens' data privacy, and to reformulate the way organizations across the region approach data privacy.

The standards ISO/IEC 27001, ISO/IEC 27018, and BS 10012—can help organizations adequately adhere to the GDPR. The standards provide all of the necessary guidance required to employ the European GDPR, as they include security techniques for management, personally identifiable information, and data protection.

The standard ISO/IEC 27001:2013, Information Technology-Security Techniques-Information security management systems-Requirements, specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system within the context of the organization. It also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization.

ISO/IEC 27018:2014, Information technology-Security techniques-Code of practice for practice for protection of personally identifiable information (PII) in public clouds acting as PII processors, establishes commonly accepted control objectives, controls, and guidelines for implementing measures to protect Personally Identifiable Information (PII) in accordance with the privacy principles in ISO/IEC 29100 for the public cloud computing environment.

BS 10012:2017, Data protection. Specification for a personal information management system, was written in recognition of the publication of the GDPR, and utilization of the standard will support organizations in their implementation of an appropriate “Information Governance” strategy

The GDPR and Business Compliance: Access the General Data Protection Regulation Standards Package

The General Data Protection Regulation (GDPR), which goes into effect on May 25 across the European Union, means major changes in data privacy regulation. For businesses, the high cost of non-compliance with the GDPR is a fine of up to 4 percent of annual global turnover—or €20 Million. Three standards, available as the ISO/IEC 27001 / ISO/IEC 27018 / BS 10012 – General Data Protection Regulation Package, and adherence to their voluntary consensus guidelines can help to comply with the legislative requirements of the new regulation.

While the GDPR will apply to organizations located within the EU, it will also impact organizations located outside of the EU if they offer goods or services to, or monitor the behavior of EU data subjects. The regulationreplaces the Data Protection Directive 95/46/EC, and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens' data privacy, and to reformulate the way organizations across the region approach data privacy.

The standards ISO/IEC 27001, ISO/IEC 27018, and BS 10012—can help organizations adequately adhere to the GDPR. The standards provide all of the necessary guidance required to employ the European GDPR, as they include security techniques for management, personally identifiable information, and data protection.

The standard ISO/IEC 27001:2013, Information Technology-Security Techniques-Information security management systems-Requirements, specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system within the context of the organization. It also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization.

ISO/IEC 27018:2014, Information technology-Security techniques-Code of practice for practice for protection of personally identifiable information (PII) in public clouds acting as PII processors, establishes commonly accepted control objectives, controls, and guidelines for implementing measures to protect Personally Identifiable Information (PII) in accordance with the privacy principles in ISO/IEC 29100 for the public cloud computing environment.

BS 10012:2017, Data protection. Specification for a personal information management system, was written in recognition of the publication of the GDPR, and utilization of the standard will support organizations in their implementation of an appropriate “Information Governance” strategy