1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.
2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual’s intervention to an indefinite number of natural persons.
ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.
Here is the relevant paragraph to article 25(2) GDPR:
7.4.2 Limit processing
Control
The organization should limit the processing of PII to that which is adequate, relevant and necessary for the identified purposes.
Implementation guidance
Limiting the processing of PII should be managed through information security and privacy policies (see 6.2) along with documented procedures for their adoption and compliance.
Processing of PII, including:
— the disclosure;
— the period of PII storage; and
— who is able to access their PII;
should be limited by default to the minimum necessary relative to the identified purposes.
EDPB, Guidelines 3/2019 on Processing of Personal Data through Video Devices (2020).
3. An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate compliance with the requirements set out in paragraphs 1 and 2 of this Article.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27001, section 4.1.
Here is the relevant paragraph to article 25(3) GDPR:
5.2.1 Understanding the organization and its context
The organization shall include among its interested parties (see ISO/IEC 27001:2013, 4.2), those parties having interests or responsibilities associated with the processing of PII, including the PII principals.
NOTE 1 Other interested parties can include customers (see 4.4 ISO 27701), supervisory authorities, other PII controllers, PII processors and their subcontractors.
NOTE 2 Requirements relevant to the processing of PII can be determined by legal and regulatory requirements, by contractual obligations and by self-imposed organizational objectives. The privacy principles set out in ISO/IEC 29100 provide guidance concerning the processing of PII.
NOTE 3 As an element to demonstrate compliance to the organization’s obligations, some interested parties can expect that the organization be in conformity with specific standards, such as the Management System specified in this document, and/or any relevant set of specifications. These parties can call for independently audited compliance to these standards.
The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.
(RU) Несмотря что данное обязательство накладывается на контролеров данных, эта статья также затрагивает процессоров (вендоров), которые зачастую разрабатывают программное обеспечение, предлагаемое контролерам данных.
Первые шаги проектирования приватности:
Примеры техник:
(78) The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken to ensure that the requirements of this Regulation are met. In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default. Such measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing, enabling the controller to create and improve security features. When developing, designing, selecting and using applications, services and products that are based on the processing of personal data or process personal data to fulfil their task, producers of the products, services and applications should be encouraged to take into account the right to data protection when developing and designing such products, services and applications and, with due regard to the state of the art, to make sure that controllers and processors are able to fulfil their data protection obligations. The principles of data protection by design and by default should also be taken into consideration in the context of public tenders.
WP29, Opinion 05/2014 on Anonymisation Techniques (2014).
WP29, Opinion on data processing at work (2017).
Spanish Data Protection Agency (AEPD), A Guide to Privacy by Design (2019).
EDPB, Guidelines 4/2019 on Article 25 – Data Protection by Design and by Default (2020):
Data protection by design must be implemented both at the time of determining the means of processing and at the time of processing itself. It is at the time of determining the means of processing that controllers shall implement measures and safeguards designed to effectively implement the data protection principles. To ensure effective data protection at the time of processing, the controller must regularly review the effectiveness of the chosen measures and safeguards. The EDPB encourages early consideration of data protection by design when planning a new processing operation.
EDPB, Guidelines on the use of location data and contact tracing tools in the context of the COVID-19 outbreak (2020).
EDPB, Guidelines 3/2019 on Processing of Personal Data through Video Devices (2020).
Spanish Data Protection Agency (AEPD), Guidelines for DataProtection by Default (2020).
Information Commissioner’s Office, Right of Access (2020).
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 14.2.1.
Here is the relevant paragraphs to article 25(1) GDPR:
6.11.2.1 Secure development policy
Implementation guidance
Policies for system development and design should include guidance for the organization’s processing of PII needs, based on obligations to PII principals and/or any applicable legislation and/or regulation and the types of processing performed by the organization. Clauses 7 and 8 provide control considerations for processing of PII, which can be useful in developing policies for privacy in systems design.
Policies that contribute to privacy by design and privacy by default should consider the following aspects:
a) guidance on PII protection and the implementation of the privacy principles (see ISO/IEC 29100) in
the software development lifecycle;
b) privacy and PII protection requirements in the design phase, which can be based on the output
from a privacy risk assessment and/or a privacy impact assessment (see 7.2.5);
c) PII protection checkpoints within project milestones;
d) required privacy and PII protection knowledge;
e) by default minimize processing of PII.