Privacy & Information Security Law Blog

On November 13, 2019, the European Data Protection Board (“EDPB”) published its draft guidelines 4/2019 (the “Guidelines”) on the obligation of Data Protection by Design and by Default (“DPbDD”) set out under Article 25 of the EU General Data Protection Regulation (“GDPR”).

Background and Scope

Article 25 of the GDPR requires all data controllers, irrespective of their size, to implement:

• appropriate technical and organizational measures and necessary safeguards, which are designed to implement the basic data protection principles of Article 5 of the GDPR and to protect individuals’ data protection rights laid down in Articles 12-22 of the GDPR, as well as individuals’ freedoms set out in Recital 4 of the GDPR and the EU Charter of Fundamental Rights (“Data protection by design”); and
• appropriate technical and organizational measures for ensuring that, by default, only personal data, which is necessary for each specific purpose of the data processing, is processed (“Data protection by default”).

Both DPbDD requirements serve the same objective, i.e., the effective implementation of the GDPR data protection principles and individuals’ data protection rights and freedoms regarding the processing of their personal data.

The Guidelines aim to provide guidance on what DPbDD means in practice and on how to apply DPbDD in the context of the data protection principles set out in Article 5(1) of the GDPR. In this respect, the Guidelines list key design and default elements to effectively implement those principles and also provide practical cases for illustration. The Guidelines further address the possibility of establishing a certification mechanism to demonstrate compliance with Article 25 of the GDPR, and how EU data protection authorities may enforce that provision. Finally, although the Guidelines are directly addressed to data controllers, they explicitly recognize data processors and technology providers as key enablers for PDbDD, and further provide 11 recommendations on how data controllers, data processors and technology providers can cooperate to achieve DPbDD as well as leverage it as a competitive advantage. We have summarized and assessed the key aspects of the Guidelines below.

Data protection by design

• The technical or organizational measures to be implemented by data controllers refer to any methods or means that they may use when processing personal data, ranging from the use of advanced technical solutions to the basic training of personnel, e.g., on how to handle personal data. These measures must be appropriate, i.e., they must be fit to implement the GDPR data protection principles effectively by reducing the risks of infringing individuals’ rights and freedoms. In addition, safeguards act as a second tier to ensure the effectiveness of these principles throughout the life-cycle of the personal data being processed and secure individuals’ rights and freedoms in the data processing activity. Examples of necessary safeguards include: enabling individuals to intervene in the data processing; providing automatic and repeated information about what personal data is being stored; having a retention reminder in a data repository or implementing a malware detection system on a computer network or storage system, in addition to training employees about phishing; and basic “cyber hygiene.” An example of a technical measure or safeguard is pseudonymization of personal data (such as hashing or encryption).
• Data controllers are not required to implement any prescribed technical and organizational measures or safeguards, so long as the chosen measures and safeguards already in place are in fact appropriate for implementing data protection into data processing.
• Data controllers must be able to demonstrate that the measures and safeguards they have implemented achieve the desired effect in terms of data protection. To do so, data controllers may determine appropriate key performance indicators to demonstrate compliance, including quantitative or qualitative metrics to demonstrate the effectiveness of the measures in question. Alternatively, data controllers may provide the rationale behind their assessment of the effectiveness of the chosen measures and safeguards.
• When determining the appropriate technical and organizational measures, data controllers must take into account the “state of art,” i.e., they must stay up to date on technological progress. Technology providers should play an active role in ensuring that the “state of the art” criterion is met, and should notify data controllers of any changes to the “state of the art” that may affect the effectiveness of the measures they have in place. Data controllers should include this requirement as a contractual clause to ensure they are kept up to date.
• Data controllers must take into account the cost and resources required for the effective implementation and continued maintenance of all data protection principles throughout the processing operation. This includes the potential cost of monetary fines as a result of non-compliance with the GDPR.
• Data controllers must take into account the nature, scope, context and purpose of data processing, and the risk posed to individuals’ rights and freedoms by such processing. With respect to risk assessment, the Guidelines refer to the EDPB guidelines on Data Protection Impact Assessment (“DPIA”), which provides guidance on how to assess data protection risks that could apply to other situations where the GDPR requires that assessment, such as in the context of DPbDD.
• The GDPR requires data controllers to implement data protection by design when they are in the process of determining which means or design elements (g., the architecture, procedures, protocols, layout and appearance) must be incorporated into the data processing. The Guidelines go further and recommend thinking of DPbDD from the initial stages of planning a data processing operation, even before the time of determination of the means of data processing.
• Data controllers have a continued obligation to maintain DPbDD once the data processing operations have started. This includes any data processing operations carried out by data processors, which should be regularly reviewed and assessed to ensure that they enable continual compliance with the DPbDD principles and support the data controller’s obligations.

Data protection by default

• The obligation to only process personal data that is necessary for a specific purpose applies to the following elements:
  • the amount of personal data collected—data controllers must consider both the volume of personal data and the types, categories and level of detail of the personal data required for the purposes of data processing;
  • the extent of processing;
  • the period of storage—if personal data is not needed after initial processing, it shall be by default deleted or anonymized. Any retention should be objectively justifiable and demonstrable by the data controller in an accountable way. Data controllers must have systematic procedures for data deletion (or anonymization) embedded in the data processing; and,
  • accessibility—access controls must be observed for the whole data flow during processing. Data controllers must ensure that personal data is readily accessible to those who need it when necessary, e.g., in critical situations.

The EDPB is accepting comments on these Guidelines until January 16, 2020.