On January 23, 2024, the Federal Data Protection and Information Commissioner (FDPIC) published an updated guide on technical and organizational measures for data protection (TOM) (Link). The guide is primarily intended for individuals responsible for information systems who are directly involved in the management of personal data. The FDPIC presents measures that should be understood as general guidelines and adapted on a case-by-case basis to the specific project and organization. This newsletter summarizes the most important takeaways from the guide as they pertain to private data controllers.
An important aspect of the guidelines concerns the data environment, particularly the infrastructure and the conduct of the individuals entrusted with data processing. It is crucial to carefully select the physical location of the data. The guidelines address the security of the premises in general, that of server rooms in particular, and also the security of workstations. This makes it clear that the infrastructure in use must be reviewed and implemented in stages until adequate data security is achieved overall.
The premises include the offices of the individuals who use the system and have access to the data. Only authorized individuals may enter the building or the offices. Access authentication must be controlled, for example, by means of a badge or access code. Access privileges must, of course, be based on the authorized individual’s role.
If multiple organizations are housed in the same building, their data protection needs may vary, requiring adjustments on a case-by-case basis.
Every area of the building designated for a specific organization should be equipped with an electronic access control system.
In addition, visitor access must be regulated to ensure that visitors cannot move freely throughout the building. A mandatory check-in and check-out procedure at the front desk provides an overview of visitor movements. It is also recommended that offices be locked outside of working hours. In our opinion, this is also advisable during regular working hours, provided that no visitors are expected. Of course, the installation of an alarm system should also be considered. The FDPIC recommends this for the most sensitive rooms, which should certainly be considered a minimum standard. However, depending on the company and the sensitivity of the data being processed, the installation of such a system should be evaluated for all areas.
The server is at the heart of many companies. However, server rooms are particularly vulnerable because they house the physical storage of data. It is important to determine who is permitted access to these rooms. Only selected technical staff should be granted access. It also makes sense to always entrust the cleaning of this room to the same trusted individuals. Furthermore, according to the EDÖB, access to server rooms must be logged. In addition, the room should be equipped with an alarm system that is constantly operational. The alarm system should be able to automatically respond to natural events such as fire or flooding. Locating the server room in a basement also makes it more difficult for intruders to gain access.
It should be noted that, in exceptional cases involving highly sensitive data, more extensive security measures—such as a single-person access control system or an iris scanner—may also be necessary.
As is well known, it is essential to ensure that employees support data protection and share responsibility for it. The FDPIC proposes the following measures regarding workplace security:
– The screens cannot be seen from the doorway.
– Printed materials are not left unattended at the printer. Entering a password at the printer itself ensures that printed documents are processed immediately.
– A clean-desk policy is strictly enforced.
– Every PC has an up-to-date firewall.
– PCs must be protected at a minimum by secure passwords known only to the respective employees.
– It is proposed that laptops be physically chained to prevent unauthorized theft, which, in our view, makes sense only in exceptional cases, since many employees regularly take their devices home and to meetings, etc., and the risk of a device being stolen is particularly high in such situations.
These safety measures should also be extended to employees working from home, provided that this is reasonable and feasible.
Using the cloud entails data protection risks. The first step is to identify the needs of the company that wishes to move to the cloud. It is important to determine whether a cloud solution is truly necessary and, if so, for which areas. When selecting the type of cloud (private, public, or hybrid), a detailed analysis of data protection requirements should be conducted early on. Particular care must also be taken when selecting a specific provider. In our view, every internal company policy should define red-flag criteria that automatically disqualify a provider. Outsourcing must be accompanied by a risk analysis, and the decision must then be carefully weighed.
The guide also focuses on access and editing. This is because, in addition to securing the infrastructure, measures must also be taken at the level of file usage and management.
Access management determines who is authorized to access the data and to what extent it may be processed (need-to-know principle). This results in various security requirements that must be implemented. Appropriate protection must be provided against unauthorized external access (see above). Both physical and electronic access must be logged. Special requirements may apply to access from outside the organization. In this context, we would like to point out that access from abroad, in particular, must be regulated within the company.
When it comes to access management, identification and authentication are, of course, also crucial. Identification establishes a person’s identity, while authentication verifies whether the person is actually who they claim to be; this requires that each person have an individual user account. This can be achieved through possession (e.g., a smart card), knowledge (e.g., a password), or biometric characteristics (e.g., a fingerprint). Multi-factor authentication (MFA) involves the simultaneous use of at least two of these methods. Detailed password policies specify how to create a strong password. The criteria for setting up passwords include minimum length, expiration time, the use of special characters and uppercase letters, as well as the number of failed attempts before an account is locked.
The FDPIC’s guidelines state that the integrity and reliability of data must be ensured throughout the entire lifecycle of the relevant data. This underscores the fact that data protection is a dynamic process.
The life cycle begins when the data is first recorded. Therefore, it is important not to record incomplete or incorrect data. According to the guidelines, only trained and authorized personnel should be permitted to record data. Systems should include mechanisms to detect gaps in information. Data entries must be logged.
Data encryption prevents unauthorized access and unauthorized modifications by converting the data into an unintelligible code using a key, so that it is no longer in plain text. There are various levels of encryption. Ideally, stored data (“at rest”) should be encrypted at all times. Since unencrypted data is sometimes required for processing, an additional level of encryption is recommended internally. The data can be divided into different zones that are encrypted separately, allowing only authorized employees and applications to access unencrypted data. This level protects against unauthorized internal access.
The encryption algorithms recommended by the EDÖB are as follows:
· AES (with key lengths of 128 or 256 bits) using an appropriate operating mode (CCM, GCM, or EAX) or ChaCha20 (in Poly-1305 mode) for symmetric encryption.
· RSA-OAEP, ECIES-KEM, or DLIES-KEM for asymmetric encryption.
· SHA-256, SHA-512, or SHA-3 as hash functions.
According to the FDPIC, the handling of external data storage media must also be regulated. External data storage media containing particularly sensitive personal data should be encrypted. Furthermore, external data storage media must be stored securely.
Every company must implement a backup strategy. This strategy is based on the type of data, its volume, and the frequency of changes. Furthermore, backup servers are subject to the same security measures as the central servers. Data recovery must be performed by trained personnel.
A clear data deletion strategy is established to remove personal data in a phased and comprehensive manner, including backups that are no longer needed. Specialized software is used to securely delete data and clean up empty storage space. Paper documents are destroyed using a paper shredder. In this context, we would like to emphasize that we adhere to established industry standards.
In the case of CD-ROMs and other removable storage media, physical destruction is carried out if no other method of complete data erasure is possible.
Modern communication technologies make it possible to work online and exchange information quickly and easily. Data protection must also be ensured during such data transfers.
The EDÖB requires that secure transmission protocols be used at all times. The TLS (Transport Layer Security) protocol enables encrypted data transmission between the client and the server. This process occurs transparently and is indicated by a padlock icon in most browsers. In addition, VPN connections help secure intranet access. The encrypted data to be transmitted is encapsulated via such connections. The EDÖB rightly emphasizes that all systems must be kept up to date. Accordingly, companies should select a professional IT partner.
It is important to encrypt not only hard drives and files, but also the messages themselves. The choice of encryption method should be tailored to the sensitivity of the data and the third parties with whom the organization interacts.
For information on selecting an encryption method, see above.
The recipient may want to verify that the sender is indeed who she claims to be. This is accomplished through the digital signature on the message.
The secure transfer of portable data storage devices is critical, as some of the data physically leaves the organization and is transported to another location. It is essential that these storage devices be protected during transport so that, in the event of loss or theft, the data cannot be read by third parties.
The transmission of data via the Internet and the transfer of portable data storage devices must be logged. According to the EDÖB, this makes it possible to track senders, recipients, and the history of data storage device transfers. In the event of misuse, improper use, or mishandling, this information can help trace the path of the data from the time of transfer until the problem occurred.
The updated EDÖB guidelines provide companies with practical guidance on the systematic implementation of measures to ensure data security. The measures outlined meet technical standards, and we endorse their implementation. Of course, it must not be overlooked that smaller companies may face high implementation costs when implementing all of these measures. In accordance with the Data Protection Act (DSG), costs are a factor that may be taken into account when determining data security measures. Accordingly, it is not always necessary to choose the most comprehensive solution in order to be compliant.
Do you have any questions about this topic, or would you like a personal consultation? Write to us—we’re happy to help.
