1

Several articles of the Regulation require to apply the

“appropriate technical and organisational measures”

or

“appropriate safeguards”

in order to ensure the security of data.

While GDPR article 32 lists some possible measures ensuring cyber security (e.g., pseudonymization or encryption), it is unclear to me what “appropriate” means.

I am specifically thinking of all those cases in which a processor would have to conduct processing:

  • on data which are a special category (under Article 9) and intrinsically “non-pseudonymizable”, allowing the re-identification of patients (as for genetic data); and
  • on third-party premises which are possibly untrusted (e.g., clouds such as AWS or Google Cloud, which would act as external processor).

I looked in the regulation to understand more about what security measure would be needed in this context. However, GDPR articles are quite fuzzy on suggesting security measures, and apart from requiring additional documentation (i.e., an appropriate DPIA, according to the Guidelines dictated by the Article 29 Data Protection WP), there is no further, punctual suggestion on how to ensure security in specific situations.

I don’t get how someone would say that a security measure is “appropriate” and thus compliant to the Regulation.

How would a data processor select a security measure in these conditions? What makes a safeguard/security measure “appropriate”?

  • 1
    I'm voting to close this question as off-topic because it belongs on security.stackexchange.com – BlueDogRanch Nov 18 '18 at 2:59
  • Yesterday I already wrote this question and it was bounced back and forth between security and law. I am really not sure about how and where to write it at this point :) – Eleanore Nov 18 '18 at 9:18
  • 3
    I think it fits law because ask about the wording used in the GDPR, and how to interpret that. – wimh Nov 18 '18 at 15:36
  • Yep. It's not about how to secure data, but how to comply with the regs. – bdb484 Nov 20 '18 at 21:15
0

GDPR articles are quite fuzzy on suggesting security measures because technology advances during time, and we do not want a new GDPR every 3 years.

Article 32 GDPR starts with:

  1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, (...)

So depending on the kind of data you process, you have to use different security measurements. You have to use a bit of common sense to determine what is appropriate. Installing security updates for the software you use, using a virus scanner and having a backup procedure are likely to be appropriate in almost all cases. But a million Euro hardware encryption solution, would not be appropriate even though if it had perfect security. You might look at examples of what data protection authorities or courts consider appropriate.

For example the Dutch employment agency UWV is forced to use 2-factor authentication because they store very sensitive data including health data. But this does not mean 2-factor authentication is also required for other organisations who just store an address book.

The most important is that you think about the data you process, where you store it, who needs access to that data, and how you can protect it in a efficient way.

Also think about edge cases, like the right to erasure in combination with backups. Most backup solutions don't allow modification of the backups for very good reasons. So if someone uses his/her right to erasure, you don't have to delete that information from backups. However you must also backup those requests. So in case you ever need to restore a backup, you are able to reprocess all requests for erasure which were received after the backup was created.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.