Abstract:

Information security and data protection are crucial domains for social services institutions. In this regard, the European Union (EU) Directive concerning measures for a high common level of security of network and information systems across the Union, and the General Data Protection Regulation (Kogenhop, 2020) are essential documents in defining standards information security and data protection. The regulatory initiative of the European Commission reflects the increased need for legislative guidance, as rapid technological developments and globalisation have created new challenges for the protection of personal data and information (Wilkinson, 2018). In recent years, new forms of information technology (e.g., sensors and mobile devices) have dramatically expanded the range of data that can be measured and analysed. This poses entirely new challenges for security and privacy (Weber, 2010; Newell & Marabelli, 2015; Sicari, Rizzardi, Grieco, & Coen-Porisini, 2015; Lee, Cho & Lim, 2018). The potential for customers to be affected by information and data leaks makes these challenges central to practitioners (Sicari et al., 2015; Sicari et al., 2016). At the same time, data accessibility is essential for social services institutions to be competitive in modern world. New regulations from European Union made data management more complex. At the same time, personnel working under new regulations related to information security and data protection have experienced a lot of challenges while applying them in practice. This aspect is not widely analysed in scientific literature from qualitative point of view.

The aim is to reveal the experiences of social workers in ensuring personal data and information security requirements in social services institutions.

The choice of the qualitative research methodology was determined by the purpose of the research. For the qualitative research, the focus group method was chosen, reflecting with the study participants their work experience (Morgan, 2010). The focus group discussion was attended by the heads of social institutions and persons responsible for the protection of information security and personal data. At the stage of data analysis, the discussion records were transcribed. Qualitative content analysis was applied for analyzing the text.

The qualitative data analysis revealed that although every organization has prepared documents on personal data protection, social workers still lack the knowledge and competencies to meet the requirements of the General Data Protection Regulation. Findings reveal that institutions are often confronted with the accumulation of redundant information and have incomplete standards on essential information gathering. Although social workers are offered with a wide range of training, there is a lack of training related to the protection of personal data in specific domains. Social workers understand the importance of personal data protection and are committed to developing their competencies.

Keywords:

Personal Data, Information Security, Challenges, Social Work.