Article 24 GDPR: Difference between revisions
Line 210: | Line 210: | ||
''Risk-based approach - elements'' | ''Risk-based approach - elements'' | ||
To know which measures should be implemented, the controller must perform an assessment to select the most appropriate ones among the different options available. The provision lists several elements that the controller must take into account when assessing the risk. First, there are the ''nature'' of the processing (manual or automated), the ''scope'' of the processing (amount of data subjects affected, amount of data collected, bulk or individual processing, sensitivity of the data), the ''context'' of the processing (how many parties are involved, which systems are used, etc.), and the ''purposes'' of the processing.<ref>''Hartung'', in Kühling & Buchner, DS-GVO BDSG, Art. 24, para 14 (C.H.Beck 2020).</ref> Second, the controller must assess the severity of the risk for the rights and freedoms of natural persons, ''and'' the likelihood that this risk materialises. Whereas Article 17 of the Data Protection Directive (DPD) merely mentioned the latter element, the controller must now also consider the likelihood of the materialisation.<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 24 GDPR, p. 564 (Oxford University Press 2020).</ref> Recital 75 gives useful guidance to determine what this risk actually entails. Besides making clear that the damage can be physical, material, or immaterial, it lists a long list of examples of damages, such as discrimination, identity theft or fraud. However, it also mentions "''loss of confidentiality of personal data protected by professional secrecy''". | To know which measures should be implemented, the controller must perform an assessment to select the most appropriate ones among the different options available. The provision lists several elements that the controller must take into account when assessing the risk. First, there are the ''nature'' of the processing (manual or automated), the ''scope'' of the processing (amount of data subjects affected, amount of data collected, bulk or individual processing, sensitivity of the data), the ''context'' of the processing (how many parties are involved, which systems are used, etc.), and the ''purposes'' of the processing.<ref>''Hartung'', in Kühling & Buchner, DS-GVO BDSG, Art. 24, para 14 (C.H.Beck 2020).</ref> Second, the controller must assess the severity of the risk for the rights and freedoms of natural persons, ''and'' the likelihood that this risk materialises. Whereas Article 17 of the Data Protection Directive (DPD) merely mentioned the latter element, the controller must now also consider the likelihood of the materialisation.<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 24 GDPR, p. 564 (Oxford University Press 2020).</ref> Recital 75 gives useful guidance to determine what this risk actually entails. Besides making clear that the damage can be physical, material, or immaterial, it lists a long list of examples of damages, such as discrimination, identity theft or fraud. However, it also mentions "''loss of confidentiality of personal data protected by professional secrecy''". Moreover, it is important to note that, although this is not mentioned in the provision, it follows from Article 52(1) Chapter of Fundamental Rights, that the principle of proportionality plays an important part in determining whether or not a measure is appropriate. Hence, the cost-effectiveness of a measure can play an important part in the assessment.<ref>''Martini'', in Paal & Pauly, DS-GVO Art. 24, para 24 (C.H.Beck 2021).</ref> Lastly, although GDPR prescribes that the controller must determine the risk, it does not provide procedural steps on ''how'' to perform this assessment.<ref>''Martini'', in Paal & Pauly, DS-GVO Art. 24, para 36 (C.H.Beck 2021).</ref> However, many DPA's, as well as the EDPB, provide guidelines for controllers to rely on. | ||
''Demonstrating'' | ''Demonstrating'' |
Revision as of 13:54, 15 February 2022
Legal Text
1. Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.
2. Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.
3. Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller.
Relevant Recitals
Commentary on Article 24
This provision opens Chapter 4’s Section 1, which is dedicated to the “General obligations” of the controller and processor. It provides an overview of the controller’s essential responsibility as the first addressee for compliance with the provisions of the GDPR.[1] Since it provides an overview, the actual obligations that follow from the controller’s responsibility are described more specifically in other provisions, such as Article 25 GDPR or Article 32 GDPR.[2] However, according to Plath, this does not mean that the provision is merely declaratory: it also establishes directly applicable obligations.[3]
Although the provision speaks of “responsibility”, it imposes accountability on the controller, next to Article 5(2) GDPR.[4] According to Docksey, this principle is one of the GDPR’s most innovative aspects,[5] since meaning has developed from ‘passive’ responsibility to a concept of ‘proactive’ and demonstrable compliance.[6] Hence, the controller’s processing operations must be known (“taking into account”), controlled (through “appropriate technical and organisational measures”) and regularly reviewed (“updated where necessary”), so that controller must do so to “ensure” compliance with the Regulation.
(1) Appropriate Technical and Organisational Measures
The controller must implement effective technical and organisational measures to ensure compliance with the entire GDPR, including respect of data protection principles (Article 5 GDPR), data subject’s rights (amongst others, Articles 12 to 22 GDPR) and controller’s obligations.
Measures
The term "measure" must be understood broadly since it refers to all actions that are appropriate in serving the purpose of achieving compliance of the processing with the GDPR.[7] As the provision explains, this can be done through technical and organisational means. Technical measures are measures of which its technical effect lies in the functionality of the technique, for example by securing the access (password protection) or transfer (encryption).[8] Of course, these technical measures would not mean a lot if there were no organisational measures that secure compliance with these technical measures. One can think of the implementation of sampling routines, the duty to log activities, or training of employees by the DPO.[9] Other examples of "measures" are given in Recital 78, which lists pseudonymisation, data minimisation, and "transparency with regard to the functions and processing of personal data". It must be noted, however, that it is not always clear to distinct between technical and organisational measures, since these can overlap. However, as Hartung mentions, this is not really a problem since the GDPR does not differentiate in terms of legal requirements.[10]
Risk-based approach - elements
To know which measures should be implemented, the controller must perform an assessment to select the most appropriate ones among the different options available. The provision lists several elements that the controller must take into account when assessing the risk. First, there are the nature of the processing (manual or automated), the scope of the processing (amount of data subjects affected, amount of data collected, bulk or individual processing, sensitivity of the data), the context of the processing (how many parties are involved, which systems are used, etc.), and the purposes of the processing.[11] Second, the controller must assess the severity of the risk for the rights and freedoms of natural persons, and the likelihood that this risk materialises. Whereas Article 17 of the Data Protection Directive (DPD) merely mentioned the latter element, the controller must now also consider the likelihood of the materialisation.[12] Recital 75 gives useful guidance to determine what this risk actually entails. Besides making clear that the damage can be physical, material, or immaterial, it lists a long list of examples of damages, such as discrimination, identity theft or fraud. However, it also mentions "loss of confidentiality of personal data protected by professional secrecy". Moreover, it is important to note that, although this is not mentioned in the provision, it follows from Article 52(1) Chapter of Fundamental Rights, that the principle of proportionality plays an important part in determining whether or not a measure is appropriate. Hence, the cost-effectiveness of a measure can play an important part in the assessment.[13] Lastly, although GDPR prescribes that the controller must determine the risk, it does not provide procedural steps on how to perform this assessment.[14] However, many DPA's, as well as the EDPB, provide guidelines for controllers to rely on.
Demonstrating
Controllers not only have to ensure compliance, they also have to demonstrate it by providing evidence.[15] This comprehensiveness of this evidence must be proportionate to the risk of the processing operation: the more risky a processing operation is, the more comprehensive the evidence must be. Conversely, with a low risk, a witness statement might already suffice, instead of physical documentation.[16] Like other elements of the provision, this requirement is further specified in other provisions, like the maintaining of records of processing activities in Article 30(1), or the documenting of any personal data breaches in Article 33(5) GDPR. [17] The fact that de controller has to demonstrate compliance, however, does not necessarily imply that the burden of proof lies with the controller in case of a claim under civil law. If a data subject asserts a claim for damages under Article 82 GDPR, then they have to prove the violation of data protection law, their damages, and the causality.[18]
(2) Data Protection Policies
This paragraph expands on paragraph 1 since it emphasises measures that are primarily oriented towards procedures, rather than result.[19]
(3) Codes of Conduct as Evidence of Compliance
You can help us fill this section!
Decisions
→ You can find all related decisions in Category:Article 24 GDPR
References
- ↑ Hartung, in Kühling & Buchner, DS-GVO BDSG, Art. 24, para 1 (C.H.Beck 2020).
- ↑ Hartung, in Kühling & Buchner, DS-GVO BDSG, Art. 24, para 11 (C.H.Beck 2020).
- ↑ Hartung, in Kühling & Buchner, DS-GVO BDSG, Art. 24, para 11 (C.H.Beck 2020) referring to Plath, in Plath Art. 24, para 2.
- ↑ Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 24 GDPR, p. 557 (Oxford University Press 2020).
- ↑ Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 24 GDPR, p. 557 (Oxford University Press 2020).
- ↑ Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 24 GDPR, p. 561 (Oxford University Press 2020).
- ↑ Martini, in Paal & Pauly, DS-GVO Art. 24, para 20a (C.H.Beck 2021).
- ↑ Martini, in Paal & Pauly, DS-GVO Art. 24, para 21 (C.H.Beck 2021).
- ↑ Martini, in Paal & Pauly, DS-GVO Art. 24, para 22 (C.H.Beck 2021).
- ↑ Hartung, in Kühling & Buchner, DS-GVO BDSG, Art. 24, para 11 (C.H.Beck 2020) referring to Plath, in Plath Art. 24, para 17.
- ↑ Hartung, in Kühling & Buchner, DS-GVO BDSG, Art. 24, para 14 (C.H.Beck 2020).
- ↑ Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 24 GDPR, p. 564 (Oxford University Press 2020).
- ↑ Martini, in Paal & Pauly, DS-GVO Art. 24, para 24 (C.H.Beck 2021).
- ↑ Martini, in Paal & Pauly, DS-GVO Art. 24, para 36 (C.H.Beck 2021).
- ↑ Martini, in Paal & Pauly, DS-GVO Art. 24, para 25 (C.H.Beck 2021).
- ↑ Martini, in Paal & Pauly, DS-GVO Art. 24, para 25a, 25b (C.H.Beck 2021).
- ↑ Martini, in Paal & Pauly, DS-GVO Art. 24, para 25a (C.H.Beck 2021).
- ↑ Martini, in Paal & Pauly, DS-GVO Art. 24, para 25d (C.H.Beck 2021).
- ↑ Martini, in Paal & Pauly, DS-GVO Art. 24, para 39 (C.H.Beck 2021).