Security of Processing Flashcards
Potential fines for data breaches
20,000,000 Euros or 4% of the total worldwide annual turnover, whichever is higher
What does Article 32 of GDPR say about security?
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk
What should controllers consider when determining security measures?
The most cutting-edge technology is not always the most secure; controllers should reflect upon the consensus of security professionals
Should not necessarily choose the most expensive option, but whichever option is chosen should show demonstrably good management decisions
What are some results that would be considered appropriate technical and organizational measures under GDPR?
Controls that bring about pseudonymization, encryption, confidentiality, integrity, resilience
What are some suggested actions that may ensure a level of security appropriate to the risk?
Pseudonymization and encryption of personal data
Ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
Ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
A process for regularly testing, assessing and evaluating the security of processing
Does the GDPR mandate requirements for security programs? What does it suggest?
GDPR does not mandate specific requirements for controllers and processors, but suggests security measures to have in place that consider:
- nature of the data
- context of the processing
- purpose of the processing
- scope of the processing
Also account for state of the art and cost of implementation
What are security controls and what are their attributes?
Processes used to ensure the security of an information system and the system must provide prompt notification if the system fails
Attributes (CIAR):
1) Confidentiality: individuals, entities, systems or applications access data on a need-to-know basis
2) Integrity: controls are in place to ensure data is accurate and complete
3) Availability: data is accessible when needed for a business activity
4) Resilience: data is able to withstand and recover from errors or threats
What should a holistic approach to security consider?
Management and worker buy in: organizations should foster a culture of risk awareness and respect for personal data throughout the entire employment lifecycle (from onboarding through termination)
A policy framework: a repository for an organization’s rules for confidentiality and security. It contains security objectives and scope; security principles, standards and compliance requirements; and roles and responsibilities.
Physical environment: may include sophisticated entry control systems, video surveillance, and lock-and-key and clean-desk policies
Information Technology: protection mechanisms such as encryption, antivirus and anti-spam technology, firewalls, identity and access management, incident detection, data loss prevention, two-factor authentication, IP log management, and regular security code peer review. GDPR specifically suggests implementation of pseudonymisation and encryption.
Incident detection and response: regular testing of technical and organizational measures assesses and evaluates their effectiveness and helps ensure the ability to restore availability and access to personal data in a timely manner if lost
Article 28 of GDPR
The controller shall only use processors providing sufficient guarantees to:
-implement appropriate technical and organizational measures in such a manner that processing will meet requirements of GDPR and ensure the protection of the data subject’s rights
Sufficient guarantees=a contract and also assurance mechanisms, such as vetting the supplier before and after creating a contract
What are some challenges with vendor management?
- The extent to which the controller can rely on the processor’s reliability
- Complex contract provisions
- Contracts between parties with unequal bargaining power
- Cloud computing
Processor contract due-diligence and pre-contractual considerations
To ensure processors provide appropriate security, controllers should exercise pre-contractual due diligence through:
- RFIs and RFQs
- site visits
- audit observations
Pre-contractual considerations:
- processor’s data protection knowledge
- recent high-profile breaches
- recent and current investigations
- accreditations
- subprocessors
- processor’s policy framework
What should a contract with a processor include?
- subject matter, duration, and nature of the processing
- nature and purpose of processing
- type of personal data
- categories of data subjects
- obligations and rights of the controller
Contract stipulations for a processor according to GDPR
The processor will:
- process the personal data only on documented instructions from the controller unless required by EU or member state law
- ensure that authorized individuals to process the personal data have committed themselves to confidentiality
- assist the controller in fulfilling its obligation to respond to requests for exercising data subjects’ rights
- assist the controller in ensuring compliance with obligations related to security
- implement appropriate technical and organizational measures as set out in Article 32
- make available to controller all information necessary to demonstrate compliance with processor rules
- delete or return all personal data at the end of the processing services or if instructed by the controller
- contribute to audits by the controller or another auditor chosen by the controller and immediately inform the controller if it believes any instruction infringes the GDPR or member state law
Contract stipulations for a processor according to GDPR
The processor will:
- process the personal data only on documented instructions from the controller unless required by EU or member state law
- ensure that authorized individuals to process the personal data have committed themselves to confidentiality
- assist the controller in fulfilling its obligation to respond to requests for exercising data subjects’ rights
- assist the controller in ensuring compliance with obligations related to security
- implement appropriate technical and organizational measures as set out in Article 32
- make available to controller all information necessary to demonstrate compliance with processor rules
- delete or return all personal data at the end of the processing services or if instructed by the controller
- contribute to audits by the controller or another auditor chosen by the controller and immediately inform the controller if it believes any instruction infringes the GDPR or member state law
Engaging subprocessors
The processor shall not engage sub-processors without prior written authorization of the controller
The same data obligations must be imposed on the sub-processor with a contract, but the original processor is liable if the subprocessor fails to fulfil its obligations
