Several articles of the Regulation require to apply the
“appropriate technical and organisational measures”
in order to ensure the security of data.
While GDPR article 32 lists some possible measures ensuring cyber security (e.g., pseudonymization or encryption), it is unclear to me what “appropriate” means.
I am specifically thinking of all those cases in which a processor would have to conduct processing:
- on data which are a special category (under Article 9) and intrinsically “non-pseudonymizable”, allowing the re-identification of patients (as for genetic data); and
- on third-party premises which are possibly untrusted (e.g., clouds such as AWS or Google Cloud, which would act as external processor).
I looked in the regulation to understand more about what security measure would be needed in this context. However, GDPR articles are quite fuzzy on suggesting security measures, and apart from requiring additional documentation (i.e., an appropriate DPIA, according to the Guidelines dictated by the Article 29 Data Protection WP), there is no further, punctual suggestion on how to ensure security in specific situations.
I don’t get how someone would say that a security measure is “appropriate” and thus compliant to the Regulation.
How would a data processor select a security measure in these conditions? What makes a safeguard/security measure “appropriate”?