One of the obligations imposed on personal data processing entities by the general data protection regulation (“GDPR”) is to implement appropriate technical and organisational measures at the time when the means for processing are determined and at the time of the actual processing.
This means that privacy becomes a core part of every business from the very beginning and throughout the data processing, and not bolted as an add-on.
In this regard, the GDPR expressly requires compliance with two types of principles: data protection by design and data protection by default.
The former type means incorporating privacy into the architecture of the products (manufacturing/production) and services (offering, after-sales, maintenance, etc.) processes, by, for example, minimizing the processing of personal data the beginning to end of a process. For instance, if the purpose for application developers can be achieved using aggregated data, accessing raw data should be avoided. It also means that organizations should ensure that the relevant expertise is available at the earliest possible stage, and not only later on to resolve any privacy issues that have arisen.
The latter type of principle means that organizations must implement mechanisms for ensuring that, by default, only the minimum and necessary personal data for each specific purpose is processed, and the data are not disclosed more than necessary. For instance, default settings of social applications should ask users to review, edit, and decide on information generated by their device before they are published on social platforms, while information that have been published should, by default, not become public or be indexed by search engines.
How these principles will be enforced is not clear yet. However, it is clear that the data protection authorities will require from the organizations concerned that they provide documentation demonstrating their compliance therewith, under penalty.
Precisely, organizations are expressly encouraged to certify their data processing with a supervisory authority or an approved certification body. In this regard, it is worth mentioning that any related assessment must have regard to the state of the art and the cost of implementation. A certificate of a data processing, once granted, is valid for up to 3 years (renewable) and is recorded in a public register so that data subject can quickly assess the level of data protection provided by these organizations. More details will follow before the entry into force of the GDPR.
