Data pro­tec­tion as an overall concept at
Hubert Burda Media

Before the Data Pro­tec­tion Reg­u­la­tion.
Jürgen Kempter is the chief data pro­tec­tion officer at Hubert Burda Media Holding. His most im­port­ant task in the past two years has been to prepare the company for the re­quire­ments of the DSGVO. “Before the GDPR, we largely handled almost all data pro­tec­tion tasks cent­rally,” Jürgen Kempter recalls. “However, after the reg­u­la­tion was pub­lished in 2016, we quickly real­ised that it was ne­ces­sary to re­struc­ture data pro­tec­tion at Hubert Burda Media.”

New law, new re­quire­ments for the or­gan­isa­tion.
The Head of Group Data Pro­tec­tion and an over­arch­ing project team had two years after the entry into force of the GDPR to make ad­just­ments that had to be im­ple­men­ted in ad­di­tion to day-to-day busi­ness. “We have re­struc­tured our or­gan­isa­tion in such a way that many data pro­tec­tion tasks can be handled de­cent­rally in the in­di­vidu­al com­pan­ies. With a central data pro­tec­tion team, we advise col­leagues on their tasks, take over the control of data pro­tec­tion man­age­ment and provide support on new issues, com­mu­nic­a­tion with those af­fected and the au­thor­it­ies,” ex­plains Jürgen Kempter.

The main tasks in the in­di­vidu­al com­pan­ies include

• the company-related doc­u­ment­a­tion of the pro­cessing pro­ced­ures
• the doc­u­ment­a­tion of the order pro­cessing re­la­tion­ships
• the brand-spe­cif­ic pro­cessing of data subject rights

Proven soft­ware
Even before the GDPR came into force, the data pro­tec­tion team at Hubert Burda Media was using the data pro­tec­tion soft­ware otris privacy. The purpose was to struc­ture and doc­u­ment pro­cessing activ­it­ies. Since otris privacy already in­cluded func­tions such as multi-client cap­ab­il­ity and role and rights man­age­ment, and due to the con­sid­er­able time pres­sure until the DSGVO came into force on 25 May 2018, Hubert Burda Media decided to con­tin­ue working with this special soft­ware for the changed data pro­tec­tion or­gan­isa­tion. In ad­di­tion to the func­tions already men­tioned and nu­mer­ous ad­apt­a­tions to the DSGVO, otris privacy stood out in par­tic­u­lar due to central data storage and higher-level control in­stru­ments for pro­cessing re­quests. “It was par­tic­u­larly im­port­ant to us that in otris we had a partner who re­spon­ded to our re­quire­ments and worked with us to find solu­tions,” ex­plains Jürgen Kempter.

De­cent­ral­ised pro­cessing
“The pro­cesses in the in­di­vidu­al com­pan­ies where per­son­al data is pro­cessed are best known to those re­spons­ible on site. There­fore, it makes sense that the doc­u­ment­a­tion on pro­cessing activ­it­ies is main­tained de­cent­rally in the re­spect­ive com­pan­ies,” ex­plains Jürgen Kempter. The data pro­tec­tion co­ordin­at­ors of about 70 com­pan­ies in the Burda Group use the central data pro­tec­tion tool to doc­u­ment the data pro­tec­tion tasks in their area. The mon­it­or­ing, the al­loc­a­tion of rights and the struc­tur­al spe­cific­a­tions – all of this remains the re­spons­ib­il­ity of the data pro­tec­tion team at the head office.

Con­tract Pro­cessing
A fun­da­ment­al dir­ect­ive to the in­di­vidu­al com­pan­ies is the com­plete doc­u­ment­a­tion of the com­mis­sioned pro­cessing. Through the GDPR, the le­gis­lat­or has in­creased the re­quire­ments for this complex of tasks. otris privacy sim­pli­fies main­ten­ance, ad­min­is­tra­tion and mon­it­or­ing: “Or­gan­ising order pro­cessing in such a large group is a chal­lenge. Hun­dreds of data pro­cessing con­tracts have to be con­cluded with sup­ply­ing com­pan­ies. Some of the com­pan­ies are also pro­cessors them­selves for third parties. otris privacy helps us with the or­gan­isa­tion and doc­u­ment­a­tion,” ex­plains Jürgen Kempter. The uniform struc­ture across the group makes it easier for those re­spons­ible in the com­pan­ies to fully doc­u­ment and al­loc­ate all agree­ments on order pro­cessing.

Rights of data sub­jects
The third set of topics is the pro­cessing and doc­u­ment­a­tion of data subject re­quests. “It was im­port­ant to us that data sub­jects can send us a data dis­clos­ure and de­le­tion request in an un­com­plic­ated way and via defined chan­nels. With more than 500 media products, we have re­ceived around 20,000 re­quests since May 2018, which we have to answer within the dead­line of one month re­quired by law,” ex­plains Jürgen Kempter. To­geth­er with otris, Jürgen Kempter and his team de­veloped a system ac­cord­ing to which af­fected party en­quir­ies are pro­cessed on a brand-spe­cif­ic basis. “In our case, the way of linking the data subject in­form­a­tion to the brand is much more user-friendly than linking it to the company. After all, the reader of our pub­lic­a­tions – e.g. Bunte.de or Focus online – does not ne­ces­sar­ily know that Hubert Burda Media is the re­spons­ible pub­lish­er,” ex­plains Jürgen Kempter. With otris privacy, the data pro­tec­tion officer real­ised his goal of grant­ing users of all Burda online pub­lic­a­tions the simple ex­er­cise of all data subject rights.

In prac­tice, this works with the help of a web form that is made avail­able via a link on the website of the re­spect­ive pub­lic­a­tion. The user fills out this form to inquire, for example, what per­son­al data has been stored about him or her. The system for­wards the request to an em­ploy­ee re­spons­ible for pro­cessing (data re­search, in­form­a­tion, de­le­tion, etc.). The entire process is doc­u­mented auto­mat­ic­ally. In the case of pro­cesses that run the risk of not being pro­cessed within the pre­scribed dead­line, the in­teg­rated dead­line work­flow warns: If an em­ploy­ee does not react, the warning is for­war­ded ac­cord­ing to a pre­defined es­cal­a­tion process.

In the future: Adapted re­port­ing.
Ad­apt­ing the data pro­tec­tion or­gan­isa­tion to the GDPR was an enorm­ous chal­lenge for Jürgen Kempter and his team. The task was sim­pli­fied by the data pro­tec­tion soft­ware otris privacy. Even though the pro­cesses are now es­tab­lished and func­tion­ing – there is po­ten­tial for im­prove­ment in every system: In order to better al­loc­ate re­sources when pro­cessing data sub­jects’ rights, the re­port­ing in the soft­ware is to be adapted to this spe­cif­ic re­quire­ment. Request numbers and pro­cessing efforts in re­la­tion to the re­spect­ive brands – over­views of these key figures have so far been created via the data export with sub­sequent pre­par­a­tion. The plan is to in­teg­rate this in­di­vidu­al re­port­ing into otris privacy. Jürgen Kempter sum­mar­ises: “As a group, we have large amounts of data to process and many special re­quire­ments due to our very broad spec­trum of brands (from garden­ing magazines to doctors’ rating portals). In close co­oper­a­tion with otris, we have sim­pli­fied the op­er­a­tion­al work in data pro­tec­tion. Our data pro­tec­tion or­gan­isa­tion is on a stable found­a­tion.”