European Data Protection Certification

06 december 2017

On November 29, 2017, Enisa issued the a report destined to familiarise data protection experts with the terminology of certification and to clarify concepts which are relevant to the General Data Protection Regulation (GDPR) certification. The report identifies and analyses challenges and opportunities faced by data protection certification mechanisms, including seals and marks.

 

As of 25 May 2018, GDPR will be the main data protection legal framework in the EU and will be directly applicable to all EU Member States. GDPR will introduce provisions on certification to enhance the transparency of data controllers’ processing operations and the processors. The legislature also envisages a role of certification in assisting controllers and processors to demonstrate compliance with the regulation.

 

Prof. Dr. Udo Helmbrecht, Executive Director of ENISA, stated: “The GDPR is a landmark piece of legislation which is designed to protect personal information. Given the digitalisation of our world protecting our personal data is critical to the operation of the Digital Single Market, I expect that this report will contribute to the effective implementation of this important piece of legislation.” 

Goal-oriented certifications

GDPR data protection mechanisms should not focus only on whether measures are in place or not, but also on to what extent such measures are sufficient in ensuring compliance with the provisions of the regulation.

Certifying a processing operation

The GDPR regulates the processing of personal data, which may be conducted for a product, system or service. The regulation requires that a certification mechanism under GDPR must concern an activity of data processing. However, the certification must be granted in relation to the processing activity or activities and not to the product, system or service as such.

 Certification as an accountability-based mechanism

 A controller that has had its processing operations successfully evaluated by a certification body may use the certification and its supporting documentation as an element to demonstrate compliance to the supervisory authority. The fact that data protection certification in the GDPR is an accountability-based mechanism is supported by its voluntary nature.

The recommendations of the report are meant to be of use to all actors involved, from the European Commission and the European Data Protection Board to national certification bodies and supervisory authorities – who are in a position to develop a harmonised understanding of GDPR data protection certification mechanisms and to provide further guidelines should queries and/or challenges arise.

News archive

 

Firm news

mar21

21/03/2024

Correttivo al Codice delle Comunicazioni Elettroniche

Il 20 marzo 2024, il Consiglio dei Ministri ha approvato, in esame definitivo, le disposizioni correttive al decreto legislativo 8 novembre 2021, n. 207, di attuazione della direttiva (UE)

mar20

20/03/2024

Telemarketing

Attuazione del Codice di Condotta con l' accreditamento dell'organismo di monitoraggio da parte del Grante privacy. Con l’accreditamento dell’Organismo di monitoraggio (OdM) si completa

mar19

19/03/2024

GARANTE PER LA PROTEZIONE DEI DATI PERSONALI COMUNICATO Avviso pubblico di avvio della consultazione sul termine di conservazione dei metadati generati e raccolti automaticamente dai protocolli di trasmissione e smistamento della posta el

Il Garante per la protezione dei dati personali, con provvedimento del 22 febbraio 2024, n. 127, pubblicato sul sito web istituzionale (www.garanteprivacy.it), ha deliberato l'avvio di una procedura

Lawyer News