Online Platform for Security of Personal Data Processing

ABOUT ENISA

The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing cross-border communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

CONTACT

For contacting the authors please use isdp@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

CONTRIBUTORS

Georgia Panagopoulou (HDPA), Giuseppe D'Acquisto (Garante), Prokopios Drogkaris (ENISA) and Athena Bourka (ENISA)

EDITORS

Prokopios Drogkaris (ENISA) and Athena Bourka (ENISA)

LEGAL NOTICE

Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 2019/881. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2019 Reproduction is authorised provided the source is acknowledged.

Copyright for the image on the cover page: © Shutterstock For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN 978-92-9204-327-8, DOI 10.2824/3000

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

TABLE OF CONTENTS

1. INTRODUCTION 5

1.1 BACKGROUND 5

1.2 SCOPE 5

1.3 STRUCTURE OF THE DOCUMENT 6

2. GUIDELINES ON THE SECURITY OF PERSONAL DATA PROCESSING 7

2.1 INTRODUCTION 7

2.2 STEP 1: DEFINITION OF THE PROCESSING OPERATION AND ITS CONTEXT 7

2.3 STEP 2: UNDERSTANDING AND EVALUATING THE IMPACT 8

2.4 STEP 3: DEFINITION OF POSSIBLE THREATS AND EVALUATION OF THEIR LIKELIHOOD 9

2.5 EVALUATION OF RISK 11

2.6 STEP 5: SELECTION OF APPROPRIATE SECURITY MEASURES 11

3. ONLINE PLATFORM 13

3.1 INTRODUCTION 13

3.2 HOMEPAGE 13

3.3 EVALUATING THE LEVEL OF RISK FOR A PERSONAL DATA PROCESSING OPERATION 14

3.3.1 Definition and Context of the processing operation 14 3.3.2 Impact evaluation 15 3.3.3 Threat Analysis 16 3.3.4 Risk Evaluation 18 3.3.5 Security Measures 18 3.3.6 Export of the analysis 19

3.4 SELF-ASSESSMENT 20

3.5 OVERVIEW OF METHODOLOGY 22

3.6 RELEVANT ENISA STUDIES 22

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING 4. CONCLUSIONS AND RECOMMENDATIONS 24

4.1 RISK ASSESSMENT FRAMEWORKS AND IMPLEMENTATION 24

4.2 SECURITY AND PRIVACY STANDARDS 24

4.3 JOINT EFFORTS ON FUTURE CERTIFICATION SCHEMES 25

5. REFERENCES 26 ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

EXECUTIVE SUMMARY

As security of personal data processing is a key obligation for data controllers and processors under the General Data Protection Regulation [1] Article 32, ENISA has proposed in 2018 a risk-based approach for the adoption of security measures for the protection of personal data. Following this, a number of use cases has also been provided to demonstrate the use of the risk-based approach in practice, together with an analysis of the different security measures (and possible implementation options). In order to support the practical implementation of the aforementioned ENISA’s guidance, an online platform was developed, which consolidates and simplifies the risk-based adoption of security measures for all interested parties.

This report presents the focus and main functionalities of the ENISA’s online platform for the security of personal data processing. This platform is only one tool, which cannot replace the need of a greater compliance and accountability framework for personal data protection on the data controllers or data processors side. Moreover, the use of the ENISA approach can be beneficial for organisations only if the special characteristics of personal data security are adequately embraced and integrated with security risk management methodologies.

In order to do so, it is essential to continue working on use cases and best practice examples of personal data security risk assessments in practice. It is also important to explore the convergence of relevant frameworks with regard to standardisation and certification frameworks in the field.

Taking the above considerations into account, ENISA has drawn the following conclusions and recommendations for relevant stakeholders:

 Data controllers (e.g. SMEs), associations and competent EU bodies should work towards common use cases and examples for personal data security, while supporting broader security risk assessment frameworks that embed data protection requirements.  Competent EU bodies and Data Protection Authorities should develop practical guidance documents that will be able to support and assist different types of data controllers on the selection of appropriate and adequate security measures.  The research community and standardization bodies should continue working on giving technical solutions to ever increasing security threats in different areas of security measures and privacy enhancing technologies, with the support of competent EU bodies and the European Commission, in terms of policy guidance and funding.  The European Commission, Data Protection Authorities and Competent EU bodies should explore the possible synergies between different certification frameworks as regards the security of personal data processing.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

1. INTRODUCTION

1.1 BACKGROUND

Information security risk management is the process of identifying, quantifying, and managing the IT security risks that an organisation faces. Security risk assessment is at the heart of this process, followed by risk treatment, acceptance and communication. An information security risk is the combination of the likelihood that a threat materialises and the impact that such a threat would have for the organisation. Well-known standards, such as ISO/IEC 27005:2018 [2] and NIST 800-39 [3], have contributed towards relevant methods, tools and practical implementation.

Based on GDPR Art.32 provisions, personal data security is strongly risk-based but a personal data security risk management system needs to adapt to the specificities of personal data [4]. Evidently, as a first point, in the context of the risk assessment, the impact needs to be considered towards the individuals (and their rights and freedoms), hence taking a different angle from the classic security risk assessment. The scale is not necessarily relevant towards this end, e.g. the impact may be high even if the number of affected persons is low. In addition, possible secondary effects may also need to be considered (e.g. when assessing possible impacts of a personal data breach). Moreover, after the evaluation of risks, the risk management process varies from typical security risk management. For example, risk acceptance would not be possible in cases where risks to individuals are concerned. In addition, risk treatment would need to integrate privacy enhancing technologies, e.g. technologies reducing the identifiability of data subjects (and not necessarily qualifying under the “classic” Confidentiality, Integrity, Availability (CIA) triad - protection technologies) [5].

Security of personal data processing is a key obligation for data controllers and processors under the General Data Protection Regulation (GDPR) [1]. In particular, data controllers and processors are required to implement technical and organisational measures that are appropriate to the risk presented to the rights and freedoms of individuals (article 32 GDPR).

In an effort to support organisations and especially Small and Medium Enterprises (SMEs) in the EU in complying with the GDPR obligations, ENISA has proposed a risk-based approach for the adoption of security measures for the protection of personal data [4]. A number of use cases has also been provided to demonstrate the use of the risk-based approach in practice, together with an analysis of the different security measures (and possible implementation options) [6] & [7]. The proposed security measures are based on the ISO 27000 standards family, incorporating also additional controls that are specific to the processing of personal data.

In order to support the practical implementation of the aforementioned ENISA guidance, ENISA decided under its 2019 work programme to provide an online platform, which would consolidate and simplify the risk-based adoption of security measures for all interested parties. This report presents the focus and main functionalities of the ENISA’s online platform for the security of personal data processing.

1.2 SCOPE

The scope of the ENISA’s online platform for the security of personal data processing (hereinafter “online platform”) is to provide a practical tool for security risk assessment and subsequent adoption of security measures for the protection of personal data, based on the relevant ENISA methodology [4]. The on line platform is available under https://www.enisa.europa.eu/risk-level-tool/.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

In practice, the online platform incorporates the different steps for a risk-based approach proposed by ENISA and guides any interested organisation (e.g. a data controller or processor) through an assessment of the level of security risk, leading to a list of proposed security measures appropriate to the risk presented. In addition, the platform provides the possibility of a security self-assessment, i.e. assessing the measures that have been adopted by an organisation vis-à-vis the perceived/identified level of risk.

The target audience of ENISA’s online platform is any organisation acting as a controller or processor that is interested in assessing the security risks and adopt security measures for the protection of personal data. The platform may also be of interest to Data Protection Authorities, as a tool that can support security of personal data processing.

It should be noted that ENISA’s online platform is explicitly focused on the security of personal data processing and does not constitute a Data Protection Impact Assessment (DPIA) tool, which is of broader nature . However, ENISA’s platform could be utilised in the context of a DPIA tool, as far as security of personal data processing is concerned.

For further information regarding the underlying methodology upon which the ENISA’s online platform is based, the relevant ENISA’s guidelines should be consulted [4].

1.3 STRUCTURE OF THE DOCUMENT

This report provides supporting information with regard to ENISA’s online platform for the security of personal data processing. The structure of the remainder of the report is as follows:

 Section 2 provides a summary of ENISA’s guidelines on security of personal data processing (which forms the basis of the platform’s functionality).  Section 3 presents the main functionality of the platform, including relevant screenshots and explanatory information.  Section 4 draws some conclusions and recommendations with regard to further steps in the field.

The online platform for the security of personal data processing is part of the work of ENISA in the area of privacy and data protection , which focuses on analysing technical solutions for the implementation of GDPR, privacy by design and security of personal data processing.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

2. GUIDELINES ON THE SECURITY OF PERSONAL DATA PROCESSING

2.1 INTRODUCTION

This Chapter provides an overview of ENISA’s guidelines on security of personal data processing, which mainly includes a risk-based approach towards adopting security measures [4].

In particular, ENISA has presented a simplified approach in order to guide organisations (in their role as controllers or processors) through their specific data processing operations and assist them in understanding and evaluating the relevant security risks. The proposed approach is based on four main steps, as depicted in Figure 1 (steps 1 to 4).

Figure 1: Overview of proposed approach on evaluating the risk on personal data processing

After the evaluation of the risk, an additional step (step 5 in Figure 1) is the selection of security measures (that are appropriate to the risk presented).

In the next sections, the different steps of ENISA’s proposed methodology are explained in more detail. The terms organisation and controller/processor are used interchangeably to describe the entity that conducts the risk assessment for the security of personal data.

2.2 STEP 1: DEFINITION OF THE PROCESSING OPERATION AND ITS CONTEXT

This step is the starting point of the risk assessment and is fundamental for the data controller/processor in order to define the boundaries of the data processing system (under

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

assessment) and its relevant context. In doing so, the organisation needs to consider the different phases of data processing (collection, storage, use, transfer, disposal, etc.) along with relevant aspects such as data recipients, means used for processing, etc.

The following questions (Table 1) need, as a minimum, to be asked and clearly understood by the data controller/processor. Relevant examples and practical guidance, through use cases, can be sourced in [6].

Table 1: Minimum set of questions for defining the processing operation and its context

The result of this step is a more thorough understanding of the data processing operation (for the controller/processor), which forms the basis of the analysis in the following steps of the assessment.

2.3 STEP 2: UNDERSTANDING AND EVALUATING THE IMPACT

Once the processing operation and its context are well defined, the data controller/processor is guided to evaluate the potential impact to the rights and freedoms of individuals that a security incident (related to the data processing system) might bring. The security incident may be associated with any type of breach of confidentiality, integrity or availability of personal data.

Due to the ad-hoc nature and diversity of personal data processing operations, only a qualitative approach can be used, based on the overall understanding (by the organisation) of its specific data processing operation. To this end, the evaluation of the impact is based on a number of parameters, such as the type and volume of personal data, the criticality of the processing operation, special characteristics of the data controller/processor, special characteristics of the data subjects, as well as the level of identifiability of data subjects.

Following this assessment, the controller/processor is finally asked to assess the impact, based on four predefined levels, i.e. low, medium, high and very high, as shown in Table 2 below.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

Table 2: Levels of impact

The impact is assessed separately for data confidentiality, integrity and availability. The highest of these levels is then considered as the result of the evaluation of the impact, relating to the overall processing of personal data.

2.4 STEP 3: DEFINITION OF POSSIBLE THREATS AND EVALUATION OF THEIR LIKELIHOOD

A threat is any circumstance or event, which has the potential to adversely affect the security of personal data. At this step, the goal for the data controller/processor is to understand the threats related to the overall environment of the personal data processing (external or internal) and assess their likelihood (threat occurrence probability). Varying levels and types of threats to the confidentiality, integrity and availability of personal data could be considered in this respect.

Similar to the case of the evaluation of impact, the assessment of threat occurrence probability can only be qualitative, as it is very much related to the specific personal data processing environment. In the context of ENISA’s approach, three levels of threat occurrence probability are defined, namely:

 Low: the threat is unlikely to materialise.  Medium: it is possible that the threat materialises.  High: the threat is likely to materialise.

To simplify the process for SMEs, the ENISA’s approach defines four areas of assessment for threat occurrence probability, namely:

 Network and technical resources (hardware and software).  Processes/procedures related to the data processing operation.  Different parties and people involved in the processing operation.  Business sector and scale of the processing.

For each of these areas of assessment, a number of guiding questions is also provided, as presented in Table 3 below.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

Table 3: Guiding questions for assessing threat occurrence probability

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

Using the answers to the aforementioned questions as drivers/indicators, the controller/processor assesses the threat occurrence probability for each of the four areas mentioned above. At the end, the threat occurrence probability is obtained as the highest of the scores obtained per area.

2.5 EVALUATION OF RISK

After evaluating the impact of the personal data processing operation and the relevant threat occurrence probability, the final evaluation of risk is possible, as shown in Figure 3 and Table 4 below.

Figure 3: Evaluating risk

Threat Occurrence Impact Risk Level Probability

Table 4: Levels of risk

The controller/processor can always modify the level of risk based on its particular circumstances and providing relevant justification for this modification.

2.6 STEP 5: SELECTION OF APPROPRIATE SECURITY MEASURES

Following the evaluation of the risk level, the data controller/processor can proceed with the selection of appropriate security measures for the protection of personal data. Two broad categories of measures, organisational and technical ones, which are further divided in specific categories, are considered (Table 5). In principle, they follow the categorization given in ISO/IEC 27001:2013 Annex A and ISO/IEC 27002:2013.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

Table 5: Categories of security measures

It should be noted that the matching of measures to specific risk levels should not be perceived as absolute. Depending on the context of the personal data processing, the organisation can consider adopting additional measures, even if they are assigned to a higher level of risk. Furthermore, the proposed list of measures does not take into account other additional sector specific security requirements, as well as specific regulatory obligations, arising for example

from the ePrivacy Directive or the NIS Directive .

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

3. ONLINE PLATFORM

3.1 INTRODUCTION

ENISA’s online platform for the security of personal data processing is based on the ENISA guidelines presented in Chapter 2 and aims to provide a simple tool supporting personal data security.

The on line platform is available under https://www.enisa.europa.eu/risk-level-tool/.

This Section presents the main functionality of the online platform, which consists mainly of two parts:

 A security risk-assessment approach for personal data processing.  A security self-assessment tool for data controllers/processors.

While the security risk assessment approach practically implements the relevant ENISA’s guidelines (see in Chapter 2), the self-assessment tool aims to provide an additional control mechanism for data controllers/processor for assessing the adopted security measures (see also relevant finding under ENISA’s 2019 report [7]).

Additional material and links to ENISA’s relevant work is also available through the platform.

It should be noted that none of the data/information entered in the platform is saved by/at the platform; therefore all entered data/information become unavailable once the browser is closed (the users of the platform are, thus, advised to run this exercise all iat once). Still, in order to support data controllers/processors, the platform offers the possibility to export the results of both parts (security risk assessment and self-assessment tool) in PDF format.

The next sections present in more detail the different functions of the online platform.

3.2 HOMEPAGE

The homepage of the tool displays the four different options that are available to the user:

 Evaluating the level of risk for a personal data processing operation.  (Self)-assessing implemented security measures.  Overview of the ENISA’s guidelines upon which the risk assessment methodology is based.  Relevant ENISA studies in the field.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

Figure 2: Home Page Overview

The next Sections describe each of these options in more detail.

3.3 EVALUATING THE LEVEL OF RISK FOR A PERSONAL DATA PROCESSING OPERATION

As already mentioned, the risk assessment option implements ENISA’s guidelines for security risk assessment of personal data processing [3]. All different steps of these guidelines are subsequently embedded in the online platform.

3.3.1 Definition and Context of the processing operation

This step is linked to Step 1 of ENISA’s guidelines, as discussed in Section 2.2 of this document. Through relevant input text boxes, the user (i.e. from an organisation acting as controller or processor) is asked to define the boundaries of the data processing operation under assessment.

Figure 3: Definition and Context of the processing operation

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

This step supports the user to understand better the data processing operation under assessment.

3.3.2 Impact evaluation

The next step is linked to Step 2 of ENISA’s guidelines, as discussed in Section 2.3 of this document. Firstly, user is presented with information on the four levels of impact that are available. Next, he or she is asked to assess the impact for data confidentiality, then integrity and then availability. Apart from selecting the level of impact for each assessment, the user is also able to optionally provide justification on the level of impact selected. Lastly, the user is presented with the overall impact evaluation of the processing operation, based on the selections he or she made in the previous sub-steps.

Figure 4: Impact Evaluation Overview

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

In all phases of this step, the user is supported by relevant examples.

3.3.3 Threat Analysis

The next step is linked to Step 3 of ENISA’s guidelines, as discussed in Section 2.4 of this document. Firstly, the user is presented with information on the three levels of threat occurrence probability and the four areas of assessment. Next, for each area he or she is presented with guiding questions and at the end he or she is asked to assess the threat occurrence probability for the specific evaluation area. Under each guiding question, further to the examples provided, the user is also able to optionally select “yes” or “no” and provide a short justification. Similarly to the impact evaluation in Section 3.3.2, this input, even if it is not part of the methodological steps described in Chapter 2, is meant to support the data controller/processor when reviewing the outcome of the evaluation. Following the completion of all four assessment areas, the user is presented with the overall threat occurrence probability of the processing operation, based on the selections he or she made in the previous sub-steps.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

Figure 5: Threat Analysis Overview

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

At the end of this step, the main part of the risk assessment is concluded.

3.3.4 Risk Evaluation

The next step is linked to Step 4 of ENISA’s guidelines, as discussed in Section 2.5 of this document. Based on the impact level identified in Step 2 and the threat occurrence probability identified in Step 3, the user is presented with the overall risk level of the specific processing operation.

Figure 6: Risk Evaluation

Following an obtained level of risk, the controller/processor may modify this risk level, depending on the specific processing context and provided that relevant justification is available.,

3.3.5 Security Measures

The next step is linked to Step 5 of ENISA’s guidelines, as discussed in Section 2.6 of this document. Based on the identified level of risk, a list of appropriate technical and organisational security measures is presented to the user.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

Figure 7: Security Measures

The proposed security measures span across different categories and levels of detail, as explained in Section 2.6 of this document.

3.3.6 Export of the analysis

The last step of the security risk assessment in the online platform is the export in PDF format of all the input that the user provided for the specific processing operation, in addition to the identified level of impact, the threat occurrence probability, the level of risk and the proposed technical and organisational security measures.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

Figure 8: Export of the analysis

This export providers to the user (organisation acting as data controller/processor) with the detailed analysis of the performed risk-assessment on the basis of ENISA’s guidelines [3].

The data/information provided by the user and the results of the analysis are not stored in the online platform (and, therefore, are not anymore available to the user after the browser is closed).

3.4 SELF-ASSESSMENT

The self-assessment option of the online platform is complimentary to the security risk assessment function described in 3.3. It was developed in an attempt to continue supporting the data controllers/processor after the initial risk assessment (see also findings under [7] for putting forward practical self-evaluation tools for controllers/processors).

In this case, the user is asked to select the identified level of risk (obtained through a prior security risk assessment) and provide a short description of the processing operation. Following this input, the user is then presented with all applicable (to the level of risk) technical and organisational measures and is able to select the ones already implemented. The final step of this exercise is a PDF document, which lists the implemented measures and the ones pending implementation. This output can either serve as a self-assessment of the measures to be implemented or as a continuous progress monitoring of the steps taken by the data controller/processor towards deployment of the all proposed measures.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

Figure 9: Self-Assessment Overview

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

Depending on the specific context of the data processing operation, the controller/processor may choose to implement further measures (e.g. corresponding to higher levels of risk).

3.5 OVERVIEW OF METHODOLOGY

This part of the online platform provides a concise overview of the ENISA’s guidelines, as presented in Section 2 of this document. It is meant to familiarise users with the different methodological steps and serve as a quick reference point.

Figure 10: Overview of methodology

The presentation follows strictly ENISA’s guidelines in this field [3].

3.6 RELEVANT ENISA STUDIES

This part of the online platform provides an overview of relevant ENISA publications in the area of security of personal data processing. In particular the following publications are listed:

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

Figure 10: Relevant ENISA studies

This part will be updated to reflect further ENISA’s work in the field.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

4. CONCLUSIONS AND RECOMMENDATIONS

With the development of an online platform for the security of personal data processing, ENISA concludes a 4-year work thread in the area of security of personal data processing. Starting from the development of a risk assessment approach, extending to the presentation of specific use case examples and the definition of available security measures, the platform depicts ENISA’s proposal towards considering security requirements for data protection in a simple and practical way.

This being said, the proposed platform is only one tool, which cannot replace the need of a greater compliance and accountability framework for personal data protection. Moreover, the exploitation of the ENISA’s approach can be beneficial for organisations only if the special characteristics of personal data security are adequately embraced and integrated with security risk management methodologies that these organisations follow. In order to do so, it is essential to continue working on use cases and best practice examples of personal data security risk assessments. Lastly, it is also important to explore the convergence of relevant frameworks with regard to standardisation and certification frameworks in the field.

Taking the above considerations into account, ENISA draws in the following some subsections conclusions and recommendations for all relevant stakeholders.

4.1 RISK ASSESSMENT FRAMEWORKS AND IMPLEMENTATION

Despite its specificities, security of personal data processing cannot (and should not) be considered within an organisation as an isolated issue. However, it is not always trivial to adequately combine and embed data protection requirements within “traditional” security risk assessment methodologies. How can a tool such as ENISA’s online platform for personal data processing (or other similar tools) support organisations, especially SMEs, to this end? While specific use cases can help, a broader perspective towards security and data protection risk management frameworks for SMEs could be of great value.

Data controllers (e.g. SMEs) associations and competent EU bodies should work towards common use cases and examples for personal data security, while supporting broader security risk assessment frameworks that embed data protection requirements.

Competent EU bodies and Data Protection Authorities should develop practical guidance documents that will be able to support and assist different types of data controllers on the selection of appropriate and adequate security measures.

4.2 SECURITY AND PRIVACY STANDARDS

Security and data protection risk assessment frameworks can greatly be supported by standardisation activities. While security standards in the field (such as the ISO2700 family) are well established, privacy standards do not have the same level of adoption. Towards this direction, the newly published ISO/IEC 27701:2019 [8] is a promising step, however, as also acknowledged by a relevant ENISA study on privacy standards for information security [9], a structured approach on definition, endorsement or affirmation of potential standardisation goals is still needed.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

The research community and standardization bodies should continue working on giving technical solutions to ever increasing security threats in different areas of security measures and privacy enhancing technologies, with the support of competent EU bodies and the European Commission, in terms of policy guidance and funding.

4.3 JOINT EFFORTS ON FUTURE CERTIFICATION SCHEMES

With the Regulation (EU) 2019/881 (Cybersecurity Act), a European framework on cybersecurity certification is established. At the same time, GDPR (in its article 42) provides specific provisions for the certification of data processing operations. While the two frameworks differ in nature and in scope, it is apparent that they could mutually benefit from a joint approach in the area of security of personal data processing. Relevant risk assessment methodologies and tools can greatly contribute towards the definition of relevant synergies in the field.

The European Commission, Data Protection Authorities and Competent EU bodies should explore the possible synergies between different certification frameworks as regards the security of personal data processing.

ONLINE PLATFORM FOR SECURITY OF PERSONAL DATA PROCESSING

5. REFERENCES

[1] European Union, "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data," 2016. [2] ISO/IEC, "ISO/IEC 27005:2018 - Information technology — Security techniques — Information security risk management," 2018. [3] NIST, "NIST Special Publication 800-39 - Managing Information Security Risk," 2011. [4] ENISA, "Guidelines for SMEs on the security of personal data processing," 2017. [5] A. Bourka and P. Drogkaris, "Security meets data protection: from risk management to systems engineering," in 15 years of ENISA: A Success story, Publications Office of the European Union, 2019, pp. 125-135. [6] ENISA, "Handbook on Security of Personal Data Processing," 2018. [7] ENISA, "Reinforcing trust and security in the area of electronic communications and online services," 2019. [8] ISO/IEC, "ISO/IEC 27701:2019 - Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines," 2019. [9] ENISA, "Privacy standards for information security," 2019.

-N -EN -039 -20 -01 TP

ABOUT ENIS A

The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing crossborder communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

ISBN 978-92-9204-327-8 doi: 10.2824/3000