+CON.2 Data Protection
---+CON.2.G1. Non-Compliance with Data Protection Laws or Use of an Incomplete Risk Model
---+CON.2.G2. Definition of Insufficient Protection Needs
---+CON.2.A1 Implementing the German Standard Data Protection Model (B)

CON.2 Data Protection

Introduction

The aim of data protection is to protect individuals so that the use of their personal data by third parties does not affect their fundamental rights. The constitution of the Federal Republic of Germany includes citizens' fundamental right to decide how their personal data is used. The federal and state data protection laws refer to this when they emphasise the protection of the right to informational self-determination. In Article 8, the EU Charter of Fundamental Rights directly describes the right to protection of personal data (paragraph 1), highlights the necessity of a legal basis for data processing (paragraph 2), and prescribes the monitoring of compliance with data protection regulations by an independent body (paragraph 3). The General Data Protection Regulation (GDPR) provides more details on the requirements of the Charter of Fundamental Rights. Article 5 of the GDPR, which states the basic principles for processing personal data (and specifies some of them as protection goals), is of central importance in this regard. The German Standard Data Protection Model (SDM) offers a method of systematically monitoring the required implementation of data protection regulations on the basis of seven data protection goals.

Objective

The aim of this module is to show how the requirements of the German Standard Data Protection Model relate to IT-Grundschutz.

Scoping and Modelling

Module CON.2 Data Protection is intended for users in Germany as a basic guide to identifying components that process or otherwise use personal or person-related data as part of the effort to determine protection needs. Each organisation should then assess whether the module should be applied not just to individual information domains or procedures, but to its entire undertaking.

The conference of the independent federal and state data protection agencies (also known as the Data Protection Conference, or DSK) developed the German Standard Data Protection Model as a concept that systematises the technical and organisational safeguards stated in the German and European legal regulations on the basis of data protection goals. On the one hand, the model is used by the bodies responsible for processing to systematically plan and implement required safeguards. It thus promotes the data protection-compliant design and organisation of information technology processes and applications. On the other hand, the model offers the data protection agencies a way to render a transparent, comprehensible, and robust overall assessment of a given method and its components using a uniform system. As a method, the SDM is suitable for regularly checking and professionally evaluating the effectiveness of the technical and organisational safeguards of a given data processing system on the basis of and in accordance with the criteria of the GDPR.

For the selection of appropriate technical and organisational safeguards, the SDM adopts the perspective of data subjects in asserting their fundamental rights, which is why it differs significantly from the viewpoint of IT-Grundschutz, which focuses primarily on information security and seeks to protect data-processing organisations. In the SDM, safeguards are selected based on the impairment that data subjects must accept as a result of a given organisation’s data processing activities.

Against this background, a distinction must be made between the selection of safeguards to ensure information security for organisations and the selection of safeguards to ensure data subjects’ rights. The IT-Grundschutz methodology primarily promotes information security; the SDM is meant to preserve data subjects' rights.

The SDM thus seeks to fulfil the following standards:

  • it transfers requirements under data protection law into a catalogue of data protection goals
  • it divides the considered methods into three components: data, IT systems, and processes
  • it factors in the categorisation of data into three levels of information security requirements—“normal”, “high”, and “very high”—and supplements this classification with corresponding considerations at the level of processes and IT systems
  • it offers a catalogue with standardised protective safeguards

Useful Resources

EU General Data Protection Regulation: “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)”, imposes fundamental, Europe-wide legal requirements for data protection compliance.

“The Standard Data Protection Model – A method for Data Protection advising and controlling on the basis of uniform protection goals” from the technology working group (AK Technik) of the Independent Data Protection Supervisory Authorities at the federal and state levels provides a method for implementing the requirements of data protection law.

1. Ħarsa ġenerali

CON.2.A1 Implementing the German Standard Data Protection Model (B)

Compliance with the legal provisions on data protection MUST be ensured at the EU, federal, and state levels (GDPR, BDSG, and LDSG). If the SDM methodology is not taken into account (i.e. the safeguards are not systematised on the basis of the protection goals and compared with the SDM reference safeguards catalogue), this SHOULD be justified and documented.

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
includes CON.2.G1. Non-Compliance with Data Protection Laws or Use of an Incomplete Risk Model
includes CON.2.G2. Definition of Insufficient Protection Needs