Posts

Establishment of Technical and Organizational Measures – The NRW Data Protection Supervisory Authority Recommends the Defense-In-Depth Approach

Securing data processing

According to the requirements of the General Data Protection Regulation, every form of data processing must be protected by technical and organizational measures. Implementing this requirement is not easy in practice, but requires comprehensive planning. This is particularly true when introducing a new processing operation. The basic requirement for safeguarding every processing operation is set out in Article 32 of the General Data Protection Regulation. This states that the selection of specific security measures must be based on the expected risk and its probability of occurrence, but also on the circumstances of the data processing and the implementation costs.

What my Defense-In-Depth approach

The Defense-In-Depth approach is the multi-layered design of a security system to defend against attacks. The decisive factor here is that no single, isolated security measure is taken. Rather, multiple measures must be combined in such a way that if one measure fails or is overcome, the other measures compensate for the gap and continue to ensure the security of data processing.

This system was developed for military purposes, with a different objective in detail, and then applied to the concept of information security.

However, this risk-based approach can also be applied when planning comprehensive protection of data processing operations.

Data protection supervisory authority recommends defense-in-depth approach

In its annual report presented on August 31, 2021, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia now points out the fundamental importance of the defense-in-depth approach for securing data processing. Thus, using a number of practical examples, it explained that errors leading to a breach of personal data protection can occur at any time. According to the state commissioner, this could happen even without the intention of those responsible. For this reason, the defense-in-depth approach has become established in practice. (https://www.ldi.nrw.de/mainmenu_Aktuelles/Inhalt/26_-Bericht/26_-Bericht-LDI-NRW.pdf P. 156)

 

If you have any questions regarding the technical and organizational safeguarding of your processing operations, please do not hesitate to contact your team at aigner business solutions GmbH. Simply use our contact form for this purpose. You can also reach us by phone at our headquarters in Hutthurm on +49 (0) 8505 91927 – 0 or at our branch office in Munich on +49 (0) 89 413 2943 – 0.

Jedes zehnte Cookie-Banner verstößt gegen geltendes Recht

Every tenth cookie banner violates applicable law

This is the result of a review of nearly 1000 websites by consumer centers and consumer associations. As reported by their federal association on 17.09.2021, several consumer centers and associations have checked the websites to see whether they use cookie banners in compliance with the law.

Read more

Personenbezogene Daten als Währung des 21. Jahrhunderts - Daten - Personenbezogene Daten - Währung - Datenschutz - DSGVO - Datenübermittlung - Datenverarbeitung

Personal data as the currency of the 21st century

“Knowledge is power” and knowledge about potential prospects and customers is of enormous value. Data trading has therefore been a flourishing industry for years. Read more

Über die Versuchung Häkchen für Datenschutz-Einwilligungen voranzukreuzen

About the temptation to tick the box for data protection consent

Data subjects must tick the boxes for data protection consents themselves – this is what the GDPR wants, and this is how the ECJ and BGH decided: If those responsible want to process data on the basis of consent in accordance with Art. 6 Para. 1 lit. a GDPR, the checkboxes must be ticked be set by those affected themselves. Actually, it has been clear for a long time that the pre-filling of the checkboxes does not constitute consent by the person concerned, which meets the requirements of Art. 4 No. 11 GDPR.

Read more

Auswahl und Betrieb von Software – im Einklang mit der DSGVO

Selection and operation of software – in accordance with the GDPR

In modern companies it is almost inconceivable to handle business processes without the support of software. So it’s hardly surprising that new software is constantly coming onto the market. In addition, existing systems must be continuously adapted to the increasingly complex business processes.

Read more

Internationale Datentransfers - Anwendungsbereich der neuen Standardvertragsklauseln

International Data Transfers – Scope of the New Standard Contractual Clauses

The data processing operations, which are becoming more and more complex as a result of globalization, are a challenge for many companies, not least in terms of data protection law. The fact that data processing does not take place centrally, but often takes place internationally scattered in a transmission chain, requires a close look at the possibilities for legitimation. It is therefore necessary to take a closer look at the new standard contractual clauses and what options they offer. In the following article, the topic of the so-called onward transfer of personal data between processors outside the EU is to be examined. In contrast to transmission, further transmission means the transfer of data from one processor to another processor.

Read more

10. Tätigkeitsbericht des BayLDA für 2020 veröffentlicht

10. BayLDA activity report for 2020 published

The Bavarian State Office for Data Protection Supervision (BayLDA) presented its tenth activity report for 2020 in July 2021. The activity report is drawn up on the basis of Art. 59 GDPR and provides information on the priorities and working conditions of the BayLDA as well as the data protection assessment of various case constellations.

Read more

Noyb legt Beschwerden bei Datenschutz-Aufsichtsbehörden gegen Cookie-Banner ein

Noyb files complaints with data protection supervisory authorities against cookie banners

Noyb announced that it had filed official complaints with the relevant data protection supervisory authorities against 422 companies because of their cookie banners. Noyb stands for “None of your business” and is an association that is committed to enforcing data protection. One of the founding members of the association is the well-known data protection activist Max Schrems. This became known, among other things, through the proceedings he initiated, which led to the groundbreaking decisions of the ECJ that overturned both Safe Harbor and the EU-US Privacy Shield.

Read more

Rekordbußgeld Amazon

Record fine for Amazon of 746 million euros

The Luxembourg National Data Protection Commission (CNPD) imposed a record fine of 746 million euros on Amazon Europe Core S.à r.l. based in Luxembourg. This emerges from the quarterly report of AMAZON.COM, Inc. dated June 30, 2021.

Read more

Datenschutzbußgeld wegen unzureichender Einbindung - Die Aufsichtsbehörden kontrollieren die Stellung des Datenschutzbeauftragten

Data protection fine for insufficient involvement – Supervisory authorities monitor the position of the data protection officer

Position of the data protection officer

Articles 38 and 39 of the General Data Protection Regulation provide legal guidelines for the cooperation between the controller and the data protection officer. In practice, there are some differences between the appointment of an internal and an external data protection officer. However, the following points in particular are mandatory in all cases:

  • Early involvement

The data protection officer must be involved at an early stage in all issues relating to the protection of personal data. This is an obligation on the part of the controller, who must ensure that the data protection officer is notified of his or her own accord. In this context, early means at a point in time at which the data protection officer’s assessments can still be properly taken into account in the planning of a processing operation.

  • Freedom from instructions

The data protection officer performs his or her duties in accordance with the General Data Protection Regulation without being bound by instructions. The data controller is therefore prohibited from influencing the content of the data protection officer’s advice and audit results.

  • Right to report

The data protection officer reports directly to the highest management level. It is therefore not permissible for the reports of the data protection officer to have to be reviewed and, if necessary, approved by subordinate units.

  • Advising data subjects

The tasks of the data protection officer also include advising data subjects on data processing and their rights under the General Data Protection Regulation. The controller is in turn obliged to actually enable this advisory activity. For example, he must provide the necessary resources and, as stipulated in Art. 37 (7) GDPR, publish the contact details of the data protection officer.

Pursuant to Art. 83 (4) (a) GDPR, a fine of up to 10 million euros or 2% of the annual turnover may be imposed for violations of the requirements of Art. 38 and 39 GDPR by the controller.

Data protection fine of 15,000 euros

The fact that these regulations are not toothless tigers, but are to be taken quite seriously and implemented in practice, is shown by the fine imposed by the data protection supervisory authority in Luxembourg. In the course of an inspection of a company, the authority found deficiencies in the implementation of Art. 38 and Art. 39 of the GDPR and imposed a fine of 15,000 euros.

Specifically, the supervisory authority found fault in particular with the fact that the data protection officer did not report to the highest management level in contravention of Art. 38 (3) of the GDPR, was not sufficiently qualified and was not appropriately involved in all issues relating to the protection of personal data.

Data protection fine: Amount

Especially when compared to the recent fine against Amazon (we reported), 15,000 euros does not seem particularly spectacular. However, when classifying the amount of the fine, it is important to note that the supervisory authority generally refers to the assessment criteria of Article 83 (2) of the GDPR in its statement regarding the amount of the fine. Therefore, it cannot be readily assessed here which factors may have been used to mitigate the penalty.

 Significance of the supervisory authority’s decision on the data protection fine

It should be noted that the data protection supervisory authorities examine all requirements for companies arising from the General Data Protection Regulation and, if necessary, also impose penalties. In addition, the mere appointment of the data protection officer is not sufficient. Rather, the data protection officer must also be enabled in practice to fulfill his or her auditing and advisory function comprehensively and free of instructions.

 

We will be happy to support you with any questions you may have about data protection. Simply call us at our headquarters in Hutthurm at +49 (0) 8505 91927 – 0 or at our branch in Munich at +49 (0) 89 413 2943 – 0 or use our contact form.