GDPR defines the responsibility of Companies to ensure that Personal Data in their possession is maintained Secure ensuring Confidentiality and Privacy towards the Data Subjects to whom it pertains.
Prior to the Articles themselves, there are notes and over (49) one may read that companies must have in place (where applicable) mechanisms like CERT and any other SECURITY assuring tools/ processes.
(83) again is all about ensuring Security. (94) reads that if the Controller (company) find it cannot ensure Security it must stop processing activities and report to the Supervisory Authority for guidance and support.
Then we have Article 3 (f) establishing that it is the company responsibility to "... ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (‘integrity and confidentiality’)..."
Bottom line... T&C Companies must ensure that Personal Data is processed by them (and that includes communications) are Secure while ensuring Confidentiality and Pricavy towards the Data Subjects.
The wording "...commercially reasonable efforts..." is wrong, because it is not something that may be a legal requirement or not depending on "cost"; it is a Legal Obligation.
Then "... the Internet is not an inherently secure environment and so we cannot guarantee the security of your Personal Information..."; this is just "poor legal advice" for GDPR does expect companies to make the Internet safe, it expects companies to maintain their IT Landscape safe... an analogy can be made about going through a group of sharks in the ocean while just swimming or on board of a big boat... the ocean is dangerous due to the sharks, yet if you are in a big boat, you won't even notice them.
Then the "cherry on top"; "... e assume no liability for any disclosure of data due to errors in transmission, unauthorized third-party access or other acts of third parties, or acts or omissions beyond our reasonable control..."; now i really do not know which lawyer has written this, but it basically reads something like: "the law obliges me to ensure you are safe... however I am not able to".
Now, I have seen similar "statements", but I must confess it was like 2 or 3 years ago... most companies have corrected them over time and since they become aware that penalties were for real.
Just a final disclaimer
It is a fact that while in transit (over the Internet) a message being delivered through a T&C Company Services will travel through 3rd party infrastructure contexts, rendering it at risk ... however, if it is properly encrypted (as it should) the transition time will not be sufficient for a successful breach attempt. So, yes they are capable of ensuring all they have stated they can not.
