gdpr
Processing of genetic data: which are the required “technical and organisational measures”?
<p>Several articles of the Regulation require to apply the </p>

<p><em>“appropriate technical and organisational measures”</em></p>

<p>or</p>

<p><em>“appropriate safeguards”</em></p>

<p>in order to ensure the security of data. </p>

<p>While GDPR article 32 lists some possible measures ensuring cyber security (e.g., pseudonymization or encryption), it is unclear to me what “appropriate” means. </p>

<p>I am specifically thinking of all those cases in which a processor would have to conduct processing:</p>

<ul>
<li>on data which are a <strong>special category</strong> (under Article 9) and intrinsically “non-pseudonymizable”, allowing the re-identification of patients (as for <strong>genetic data</strong>); and</li>
<li>on <strong>third-party premises</strong> which are possibly untrusted (e.g., clouds such as AWS or Google Cloud, which would act as external processor). </li>
</ul>

<p>I looked in the regulation to understand more about what security measure would be needed in this context. However, GDPR articles are quite fuzzy on suggesting security measures, and apart from requiring additional documentation (i.e., an appropriate DPIA, according to the Guidelines dictated by the Article 29 Data Protection WP), there is no further, punctual suggestion on how to ensure security in specific situations.</p>

<p>I don’t get how someone would say that a security measure is “appropriate” and thus compliant to the Regulation. </p>

<p>How would a data processor select a security measure in these conditions? What makes a safeguard/security measure “appropriate”?</p>

<p>GDPR articles are quite fuzzy on suggesting security measures because technology advances during time, and we do not want a new GDPR every 3 years.</p>

<p><a href="https://gdpr-info.eu/art-32-gdpr/" rel="nofollow noreferrer">Article 32 GDPR</a> starts with:</p>

<blockquote>
  <ol>
  <li>Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, (...)</li>
  </ol>
</blockquote>

<p>So depending on the kind of data you process, you have to use different security measurements. You have to use a bit of common sense to determine what is appropriate. Installing security updates for the software you use, using a virus scanner and having a backup procedure are likely to be appropriate in almost all cases. But a million Euro hardware encryption solution, would not be appropriate even though if it had perfect security. You might look at examples of what data protection authorities or courts consider appropriate.</p>

<p>For example the Dutch employment agency UWV is <a href="http://www.tellerreport.com/tech/--privacy-watchdog-threatens-with-penalty-for-poor-security-uwv-.rJjsyaBnm.html" rel="nofollow noreferrer">forced</a> to use 2-factor authentication because they store very sensitive data including health data. But this does not mean 2-factor authentication is also required for other organisations who just store an address book.</p>

<p>The most important is that you think about the data you process, where you store it, who needs access to that data, and how you can protect it in a efficient way.</p>

<p>Also think about edge cases, like the right to erasure in combination with backups. Most backup solutions don't allow modification of the backups for very good reasons. So if someone uses his/her right to erasure, you don't have to delete that information from backups. However you must also backup those requests. So in case you ever need to restore a backup, you are able to reprocess all requests for erasure which were received after the backup was created.</p>
