Spanish data protection authority (AEPD), Introduction to the hash function as a personal data pseudonymisation technique (2019)
Article 32 GDPR. Security of processing
1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:
ISO 27701
Guidelines & Case Law
(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
ISO 27701
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27001, section 6.1.2.
Here is the relevant paragraphs to article 32(1)(b) GDPR:
5.4.1.2 Information security risk assessment
6.1.2 c) 1) is refined as follows:
The organization shall apply the information security risk assessment process to identify risks associated with the loss of confidentiality, integrity and availability, within the scope of the PIMS.
The organization shall apply privacy risk assessment process to identify risks related to the processing of PII, within the scope of the PIMS.
The organization shall ensure throughout the risk assessment processes that the relationship between information security and PII protection is appropriately managed.
NOTE The organization can either apply an integrated information security and privacy risk assessment process or two separate ones for information security and the risks related to the processing of PII.
6.1.2 d) 1) is refined as follows:
The organization shall assess the potential consequences for both the organization and PII principals that would result if the risks identified in ISO/IEC 27001:2013, 6.1.2 c) as refined above, were to materialize.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 15.1.2.
Here is the relevant paragraph to article 32(1)(b) GDPR:
6.12.1.2 Addressing security within supplier agreements
Implementation guidance
The organization should specify in agreements with suppliers whether PII is processed and the minimum technical and organizational measures that the supplier needs to meet in order for the organization to meet its information security and PII protection obligations (see 7.2.6 and 8.2.1).
Supplier agreements should clearly allocate responsibilities between the organization, its partners, its suppliers and its applicable third parties (customers, suppliers, etc.) taking into account the type of PII processed.
The agreements between the organization and its suppliers should provide a mechanism for ensuring the organization supports and manages compliance with all applicable legislation and/or regulation. The agreements should call for independently audited compliance, acceptable to the customer.
NOTE For such audit purposes, compliance with relevant and applicable security and privacy standards such as ISO/IEC 27001 or this document can be considered.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 18.1.1.
Here is the relevant paragraph to article 32(1)(b) GDPR:
6.15.1.1 Identification of applicable legislation and contractual requirements
Other information
The organization should identify any potential legal sanctions (which can result from some obligations being missed) related to the processing of PII, including substantial fines directly from the local supervisory authority. In some jurisdictions, International Standards such as this document can be used to form the basis for a contract between the organization and the customer, outlining their respective security, privacy and PII protection responsibilities. The terms of the contract can provide a basis for contractual sanctions in the event of a breach of those responsibilities.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27001, section 6.1.3.
Here is the relevant paragraphs to article 32(1)(b) GDPR:
5.4.1.3 Information security risk treatment
6.1.3 c) is refined as follows:
The controls determined in ISO/IEC 27001:2013 6.1.3 b) shall be compared with the controls in Annex A and/or Annex B and ISO/IEC 27001:2013, Annex A to verify that no necessary controls have been omitted.
When assessing the applicability of control objectives and controls from ISO/IEC 27001:2013 Annex A for the treatment of risks, the control objectives and controls shall be considered in the context of both risks to information security as well as risks related to the processing of PII, including risks to PII principals.
6.1.3 d) is refined as follows:
Produce a Statement of Applicability that contains:
— the necessary controls [see ISO/IEC 27001:2013, 6.1.3 b) and c)];
— justification for their inclusion;
— whether the necessary controls are implemented or not; and
— the justification for excluding any of the controls in Annex A and/or Annex B and ISO/IEC 27001:2013,
Annex A according to the organization’s determination of its role (see 5.2.1).
Not all the control objectives and controls listed in the annexes need to be included in a PIMS implementation. Justification for exclusion can include where the controls are not deemed necessary by the risk assessment, and where they are not required by (or are subject to exceptions under) the legislation and/or regulation including those applicable to the PII principal.
(c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
ISO 27701
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 12.3.1.
Here is the relevant paragraphs to article 32(1)(c) GDPR:
6.9.3.1 Information backup
Implementation guidance
The organization should have a policy which addresses the requirements for backup, recovery and restoration of PII (which can be part of an overall information backup policy) and any further requirements (e.g. contractual and/or legal requirements) for the erasure of PII contained in information held for backup requirements.
PII-specific responsibilities in this respect can depend on the customer. The organization should ensure that the customer has been informed of the limits of the service regarding backup.
Where the organization explicitly provides backup and restore services to customers, the organization should provide them with clear information about their capabilities with respect to backup and restoration of PII.
Some jurisdictions impose specific requirements regarding the frequency of backups of PII, the frequency of reviews and tests of backup, or regarding the recovery procedures for PII. Organizations operating in these jurisdictions should demonstrate compliance with these requirements.
There can be occasions where PII needs to be restored, perhaps due to a system malfunction, attack or disaster. When PII is restored (typically from backup media), processes need to be in place to ensure that the PII is restored into a state where the integrity of PII can be assured, and/or where PII inaccuracy and/or incompleteness is identified and processes put in place to resolve them (which can involve the PII principal).
The organization should have a procedure for, and a log of, PII restoration efforts. At a minimum, the log of the PII restoration efforts should contain:
— the name of the person responsible for the restoration;
— a description of the restored PII.
Some jurisdictions prescribe the content of the logs of PII restoration efforts. Organizations should be able to document compliance with any applicable jurisdiction-specific requirements for restoration log content. The conclusions of such deliberations should be included in documented information.
The use of subcontractors to store replicated or backup copies of PII processed is covered by the controls in this document applying to subcontracted PII processing (see 6.5.3.3, 6.12.1.2). Where physical media transfers take place related to backups and restoration, this is also covered by controls in this document (6.10.2.1).
(d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
ISO 27701
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 18.2.1.
Here is the relevant paragraphs to article 32(1)(d) GDPR:
6.15.2.1 Independent review of information security
Implementation guidance
Where an organization is acting as a PII processor, and where individual customer audits are impractical or can increase risks to security, the organization should make available to customers, prior to entering into, and for the duration of, a contract, independent evidence that information security is implemented and operated in accordance with the organization’s policies and procedures. A relevant independent audit, as selected by the organization, should normally be an acceptable method for fulfilling the customer’s interest in reviewing the organization’s processing operations, if it covers the needs of anticipated users and if results are provided in a sufficient transparent manner.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 18.2.3.
Here is the relevant paragraphs to article 32(1)(d) GDPR:
6.15.2.3 Technical compliance review
Implementation guidance
As part of technical reviews of compliance with security policies and standards, the organization should include methods of reviewing those tools and components related to processing PII. This can include:
— ongoing monitoring to verify that only permitted processing is taking place; and/or
— specific penetration or vulnerability tests (for example, de-identified datasets can be subject to a motivated intruder test to validate that de-identification methods are compliant with organizational requirements).
2. In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.
ISO 27701
Recitals
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27001, section 4.3.
Here is the relevant paragraphs to article 32(2) GDPR:
5.2.3 Determining the scope of the information security management system
When determining the scope of the PIMS, the organization shall include the processing of PII.
NOTE The determination of the scope of the PIMS can require revising the scope of the information security management system, because of the extended interpretation of “information security” according to 5.1.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27001, section 4.4.
Here is the relevant paragraphs to article 32(2) GDPR:
5.2.4 Information security management system
The organization shall establish, implement, maintain and continually improve a PIMS in accordance with the requirements of ISO/IEC 27001:2013 Clauses 4 to 10, extended by the requirements in Clause 5.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27001, section 6.1.2.
Here is the relevant paragraphs to article 32(2) GDPR:
5.4.1.2 Information security risk assessment
6.1.2 c) 1) is refined as follows:
The organization shall apply the information security risk assessment process to identify risks associated with the loss of confidentiality, integrity and availability, within the scope of the PIMS.
The organization shall apply privacy risk assessment process to identify risks related to the processing of PII, within the scope of the PIMS.
The organization shall ensure throughout the risk assessment processes that the relationship between information security and PII protection is appropriately managed.
NOTE The organization can either apply an integrated information security and privacy risk assessment process or two separate ones for information security and the risks related to the processing of PII.
6.1.2 d) 1) is refined as follows:
The organization shall assess the potential consequences for both the organization and PII principals that would result if the risks identified in ISO/IEC 27001:2013, 6.1.2 c) as refined above, were to materialize.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27001, section 6.1.3.
Here is the relevant paragraphs to article 32(2) GDPR:
5.4.1.3 Information security risk treatment
6.1.3 c) is refined as follows:
The controls determined in ISO/IEC 27001:2013 6.1.3 b) shall be compared with the controls in Annex A and/or Annex B and ISO/IEC 27001:2013, Annex A to verify that no necessary controls have been omitted.
When assessing the applicability of control objectives and controls from ISO/IEC 27001:2013 Annex A for the treatment of risks, the control objectives and controls shall be considered in the context of both risks to information security as well as risks related to the processing of PII, including risks to PII principals.
6.1.3 d) is refined as follows:
Produce a Statement of Applicability that contains:
— the necessary controls [see ISO/IEC 27001:2013, 6.1.3 b) and c)];
— justification for their inclusion;
— whether the necessary controls are implemented or not; and
— the justification for excluding any of the controls in Annex A and/or Annex B and ISO/IEC 27001:2013,
Annex A according to the organization’s determination of its role (see 5.2.1).
Not all the control objectives and controls listed in the annexes need to be included in a PIMS implementation. Justification for exclusion can include where the controls are not deemed necessary by the risk assessment, and where they are not required by (or are subject to exceptions under) the legislation and/or regulation including those applicable to the PII principal.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 8.2.1.
Here is the relevant paragraphs to article 32(2) GDPR:
6.5.2.1 Classification of information
Implementation guidance
The organization’s information classification system should explicitly consider PII as part of the scheme it implements. Considering PII within the overall classification system is integral to understanding what PII the organization processes (e.g. type, special categories), where such PII is stored and the systems through which it can flow.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 18.2.1.
Here is the relevant paragraphs to article 32(2) GDPR:
6.15.2.1 Independent review of information security
Implementation guidance
Where an organization is acting as a PII processor, and where individual customer audits are impractical or can increase risks to security, the organization should make available to customers, prior to entering into, and for the duration of, a contract, independent evidence that information security is implemented and operated in accordance with the organization’s policies and procedures. A relevant independent audit, as selected by the organization, should normally be an acceptable method for fulfilling the customer’s interest in reviewing the organization’s processing operations, if it covers the needs of anticipated users and if results are provided in a sufficient transparent manner.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 18.2.3.
Here is the relevant paragraphs to article 32(2) GDPR:
6.15.2.3 Technical compliance review
Implementation guidance
As part of technical reviews of compliance with security policies and standards, the organization should include methods of reviewing those tools and components related to processing PII. This can include:
— ongoing monitoring to verify that only permitted processing is taking place; and/or
— specific penetration or vulnerability tests (for example, de-identified datasets can be subject to a motivated intruder test to validate that de-identification methods are compliant with organizational requirements).
(83) In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing and implement measures to mitigate those risks, such as encryption. Those measures should ensure an appropriate level of security, including confidentiality, taking into account the state of the art and the costs of implementation in relation to the risks and the nature of the personal data to be protected. In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage.
3. Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article.
ISO 27701
Related
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27001, section 4.1.
Here is the relevant paragraph to article 32(3) GDPR:
5.2.1 Understanding the organization and its context
The organization shall include among its interested parties (see ISO/IEC 27001:2013, 4.2), those parties having interests or responsibilities associated with the processing of PII, including the PII principals.
NOTE 1 Other interested parties can include customers (see 4.4 ISO 27701), supervisory authorities, other PII controllers, PII processors and their subcontractors.
NOTE 2 Requirements relevant to the processing of PII can be determined by legal and regulatory requirements, by contractual obligations and by self-imposed organizational objectives. The privacy principles set out in ISO/IEC 29100 provide guidance concerning the processing of PII.
NOTE 3 As an element to demonstrate compliance to the organization’s obligations, some interested parties can expect that the organization be in conformity with specific standards, such as the Management System specified in this document, and/or any relevant set of specifications. These parties can call for independently audited compliance to these standards.
4. The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.
ISO 27701
ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.
Here is the relevant paragraph to article 32(4) GDPR:
7.2.1 Identify and document purpose
Control
The organization should identify and document the specific purposes for which the PII will be processed.
Implementation guidance
The organization should ensure that PII principals understand the purpose for which their PII is processed. It is the responsibility of the organization to clearly document and communicate this to PII principals. Without a clear statement of the purpose for processing, consent and choice cannot be adequately given.
Documentation of the purpose(s) for processing PII should be sufficiently clear and detailed to be usable in the required information to be provided to PII principals (see 7.3.2). This includes information necessary to obtain consent (see 7.2.3), as well as records of policies and procedures (see 7.2.8).
ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII processors.
Here is the relevant paragraph to article 32(4) GDPR:
8.2.2 Organization’s purposes
Control
The organization should ensure that PII processed on behalf of a customer are only processed for the purposes expressed in the documented instructions of the customer.
Implementation guidance
The contract between the organization and the customer should include, but not be limited to, the objective and time frame to be achieved by the service.
In order to achieve the customer’s purpose, there can be technical reasons why it is appropriate for the organization to determine the method for processing PII, consistent with the general instructions of the customer but without the customer’s express instruction. For example, in order to efficiently utilize network or processing capacity it can be necessary to allocate specific processing resources depending on certain characteristics of the PII principal.
The organization should allow the customer to verify their compliance with the purpose specification and limitation principles. This also ensures that no PII is processed by the organization or any of its subcontractors for other purposes than those expressed in the documented instructions of the customer.
General Data Protection Regulation (EU GDPR)
The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.
Recitals
Guidelines & Case Law
(67 kB) - WP 118 21.02.2006
Data Protection Commission (Ireland): Guidance for Controllers on Data Security - 2020
CNIL (France): CNIL Guide. Security of Personal Data - 2018
IT Security Association Germany (TeleTrusT) , Guideline "State of the Art". Technical and organisational measures - 2020
Leave a comment
(83) In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing and implement measures to mitigate those risks, such as encryption. Those measures should ensure an appropriate level of security, including confidentiality, taking into account the state of the art and the costs of implementation in relation to the risks and the nature of the personal data to be protected. In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage.
(74) The responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller's behalf should be established. In particular, the controller should be obliged to implement appropriate and effective measures and be able to demonstrate the compliance of processing activities with this Regulation, including the effectiveness of the measures. Those measures should take into account the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons.
(75) The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage; where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures; where personal aspects are evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing involves a large amount of personal data and affects a large number of data subjects.
(76) The likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference to the nature, scope, context and purposes of the processing. Risk should be evaluated on the basis of an objective assessment, by which it is established whether data processing operations involve a risk or a high risk.
(77) Guidance on the implementation of appropriate measures and on the demonstration of compliance by the controller or the processor, especially as regards the identification of the risk related to the processing, their assessment in terms of origin, nature, likelihood and severity, and the identification of best practices to mitigate the risk, could be provided in particular by means of approved codes of conduct, approved certifications, guidelines provided by the Board or indications provided by a data protection officer. The Board may also issue guidelines on processing operations that are considered to be unlikely to result in a high risk to the rights and freedoms of natural persons and indicate what measures may be sufficient in such cases to address such risk.
Document
Working Party 29 Opinion 2/2006 on privacy issues related to the provision of email screening services(67 kB) - WP 118 21.02.2006
Data Protection Commission (Ireland): Guidance for Controllers on Data Security - 2020
CNIL (France): CNIL Guide. Security of Personal Data - 2018
IT Security Association Germany (TeleTrusT) , Guideline "State of the Art". Technical and organisational measures - 2020
Case Law
CJEU, Worten – Equipamentos para o Lar SA/Autoridade para as condições de trabalho, C-342-12 (2013).
Url-link to highlighted text was copied to the clipboard!
Preparing download...
ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.
Here is the relevant paragraph to article 32(1)(a) GDPR:
7.4.5 PII de-identification and deletion at the end of processing
Control
The organization should either delete PII or render it in a form which does not permit identification or re-identification of PII principals, as soon as the original PII is no longer necessary for the identified purpose(s).
Implementation guidance
The organization should have mechanisms to erase the PII when no further processing is anticipated. Alternatively, some de-identification techniques can be used as long as the resulting de-identified data cannot reasonably permit re-identification of PII principals.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 8.3.1.
Here is the relevant paragraphs to article 32(1)(a) GDPR:
6.5.3.1 Management of removable media
Implementation guidance
The organization should document any use of removable media and/or devices for the storage of PII. Wherever feasible, the organization should use removable physical media and/or devices that permit encryption when storing PII. Unencrypted media should only be used where unavoidable, and in instances where unencrypted media and/or devices are used, the organization should implement procedures and compensating controls (e.g. tamper-evident packaging) to mitigate risks to the PII.
Other information
Removable media which is taken outside the physical confines of the organization is prone to loss, damage and inappropriate access. Encrypting removable media adds a level of protection for PII which reduces security and privacy risks should the removable media be compromised.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 8.3.3.
Here is the relevant paragraphs to article 32(1)(a) GDPR:
6.5.3.3 Physical media transfer
Implementation guidance
If physical media is used for information transfer, a system should be put in place to record incoming and outgoing physical media containing PII, including the type of physical media, the authorized sender/ recipients, the date and time, and the number of physical media. Where possible, additional measures such as encryption should be implemented to ensure that the data can only be accessed at the point of destination and not in transit.
The organization should subject physical media containing PII before leaving its premises to an authorization procedure and ensure the PII is not accessible to anyone other than authorized personnel.
NOTE One possible measure to ensure PII on physical media leaving the organization’s premises is not generally accessible is to encrypt the PII concerned and restrict decryption capabilities to authorized personnel.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 10.1.1.
Here is the relevant paragraphs to article 32(1)(a) GDPR:
6.7.1.1 Policy on the use of cryptographic controls
Implementation guidance
Some jurisdictions can require the use of cryptography to protect particular kinds of PII, such as health data, resident registration numbers, passport numbers and driver’s licence numbers.
The organization should provide information to the customer regarding the circumstances in which it uses cryptography to protect the PII it processes. The organization should also provide information to the customer about any capabilities it provides that can assist the customer in applying their own cryptographic protection.
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 14.1.2.
Here is the relevant paragraphs to article 32(1)(a) GDPR:
6.11.1.2 Securing application services on public networks
Implementation guidance
The organization should ensure that PII that is transmitted over untrusted data transmission networks is encrypted for transmission.
Untrusted networks can include the public internet and other facilities outside of the operational control of the organization.
NOTE In some cases (e.g. the exchange of e-mail) the inherent characteristics of untrusted data transmission network systems can require that some header or traffic data be exposed for effective transmission.