text: The popularity of mobile devices lies in the convenience, and increased functionality that they offer to users in addition to the efficient usage of IT resources. However, their use entails specific data protection risks due to the portability of these devices and the design of many of these devices for consumer use rather than professional use. The aim of these Guidelines is to provide practical advice and instruction to the EU institutions and bodies on personal data and the use of mobile devices for work purposes to ensure that they comply with their obligations as set out in the Data Protection Regulation No 45/2001 (Regulation), applicable to the EU institutions. Actively involving the Data Protection Officer, and where relevant the Data Protection Coordinators or Contacts, early in the process of planning the introduction of mobile device usage, will allow them to offer advice, suggest improvements and generally help the institution to ensure compliance with the Regulation. EU institutions need to weigh up, the benefits of using mobile devices for each specific operation (case-by-case) and take into account the risks and invasiveness that their use may imply. This assessment should also consider the added functionalities and features of the mobile devices and the impact of introducing such devices on the security of IT infrastructure. An acceptable-use policy on mobile devices is fundamental for regulating the relation between EU institutions and their staff. Where Bring-Your-Own-Devices are permitted, such a policy is even more important for clarifying the rights and obligations of EU institutions and their staff when private devices are used for work purposes. The Bring-Your-Own-Device scenario is an increasingly common one since the benefits associated with mobile devices offer greater flexibility to the institutions and their staff on the way to work. However, they also imply specific risks to corporate and private data which must be assessed before being introduced; a specific policy for Bring-Your-Own-Device will also be required. Security is one of the main enablers of data protection. To guarantee an adequate level of protection, EU institutions must implement a risk management process, assessing the security risks of using mobile devices for processing personal data; institutions must then implement measures to deal with the identified risks. These measures shall be both organisational, such as the adoption of information security policies, and technical, such as Mobile Device Management solutions. To properly control mobile devices, whether they are the property of the EU institutions or privately owned, institutions should adopt written procedures for managing the lifecycle of mobile devices. Such procedures should take into account all operations that need to be performed on the device. The measures mentioned above should reflect the policies adopted by the EU institutions and be designed with the principles of privacy by design and by default in mind. They should not collect and process more personal data than necessary (the data minimisation principle). These Guidelines address the security aspects, as set out in the Regulation, of the processing of personal data by EU institutions via mobile devices. We recommend that this document be read in conjunction with the EDPS Guidelines on personal data and electronic communications in the EU institutions, which also address the issue of the monitoring of mobile devices by EU institutions. While these guidelines are in principle aimed at the EU institutions, anyone or any organisation interested in data protection and mobile devices might find them useful; the

text: Regulation (EC) No. 45/2001

text: is similar in many respects to the data protection

text: Directive (EC) 95/46

text: , which is implemented into the national laws of EU Member States, as well as to the national rules in Iceland, Liechtenstein and Norway.

text: Regulation (EC) No 45/2001 of 18 December 2000

text: on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, OJ L 8, 12.01.2001, p. 1. 2 In the exercise of the powers conferred under Articles

text: and

text: (d) of the Regulation.

text: Since the use of the mobile device by a staff member for his/her personal purpose is not a processing done by or on behalf of an EU institution, it would fall outside the scope of the Regulation.

text: Covered by the EDPS Guidelines "on personal data and electronic communications in the EU institutions". 5 Ibid.

text: More information can be found in the coming EDPS "Guidelines on the Protection of Personal Data processed through websites managed by European institutions and bodies" and the Opinion of the

text: Article 29

text: Working Party on “Apps on smart devices”, adopted on 27 February 2013. 7 Where any particular risk of a breach of security exists, Article 35(2) of the Regulation obliges controllers to “inform users of devices about the risks and possible remedies and alternative means of communications”. 8 Although in the past MDM solutions were implemented for monitoring mobile phone use and billing purposes, in these guidelines we consider these solutions as having a security objective, hence not referring to MDM for use monitoring. As for this aspect, see the EDPS e-Communication Guidelines (footnote 4).

text: Need to know: the user access to the information must be necessary for the conduct of user's duties. Least privilege: the rights of a user regarding certain information (read, write, etc.) must be the minimum needed to perform user's duties.

text: As defined in

text: Article 2

text: (a) of the Regulation. See also the

text: Article 29

text: Data Protection Working Party Opinion 4/2007 on the concept of personal data adopted on 20th June.

text: It can be noted, as example of the application of the Regulation, that if - under this scenario - the mobile device is used to capture video or pictures, then the EU institution must address the issues raised in the EDPS thematic Guidelines on video-surveillance: at point 2.3.1 “Do the Guidelines cover devices other than CCTV systems?”: “(…) using any other electronic device or system, fixed or mobile, also comes under the scope of the Guidelines if it is capable of capturing image data” (emphasis added). 12 This scenario is out of the scope of these guidelines and addressed by the EDPS e-Communication Guidelines (footnote 4).

text: As stated in section V.1 the EU institution is the controller as it determines the purposes and the means of the processing of the personal data. 14 Set out under Article 5 of the Regulation. In many cases, processing will be based on

text: Article 5

text: (a) which includes processing necessary for the management and functioning of the institution (recitals §27). 15

text: Article 11

text: and/or 12 of the Regulation.

text: According to Article 22 of the Regulation.

text: For instance: GPS, digital compass, gyroscope, accelerometer, ambient light sensor or environmental sensors capable of measuring atmosphere pressure, temperature and humidity.

amnesord:
Privacy in the EU Institutions
IT at Work
Technologies
Mobile Devices & Apps

publisher: Europeiska datatillsynsmannen

sprak: en

title: Mobile Devices

serie: riktlinjer

text: Guidelines on the protection of personal data in mobile devices used by European institutions

type: rubrik

text: December 2015

type: stycke

text: EXECUTIVE SUMMARY

text: 2 | P a g e I. Introduction I.1.The Guidelines 1 When staff members of EU institutions, bodies or agencies ("EU Institutions") use mobile devices for their operational needs, they may be processing personal data of third persons on these devices. This could concern any individual who has any connection with the EU institutions, as a citizen using one of the EU's services, a staff member, a contractor, an applicant for EU funding, a member of the press or any other role. In these situations, it is the institution who is responsible for ensuring compliance with the data protection principles, in particular with Regulation 45/2001 (“the Regulation”) in order to guarantee the rights to privacy and to the protection of the personal data. The responsibility rests with the EU institution, regardless of the provision of the mobile devices, whether they are provided by the EU institutions to management and staff with specific professional needs, or whether they are private devices which staff is allowed to use for professional purposes (“Bring Your Own Device” or "BYOD"). 2 As the independent supervisory authority competent for the processing of personal data by the EU institutions, the European Data Protection Supervisor (EDPS) may among other tasks issue guidelines on specific issues related to the processing of personal data . The present guidelines are the result of a process where the EU institutions have been consulted.

text: 3 The guidelines are aimed at DPOs and DPCs within each EU institution, as well as IT and IT security staff and other administrative services concerned with the processes around professional use of mobile devices, and to all persons carrying responsibility for the EU institutions acting as controller.

text: 4 The guidelines provide an analysis of the generic data protection risks related to the processing of personal data on mobile devices as well as recommendations and best practices which should help EU institutions to achieve a level of data protection compliant with the Regulation. While the purpose of the guidelines is to make it easier for EU institutions to fulfill their obligations, they do not take away any of the responsibility of the EU institutions applying them. EU institutions remain accountable for properly assessing and mitigating the risks related to their processing. The list of actions and measures recommended in these guidelines is not intended to be exhaustive or exclusive. While the EDPS will consider the best practices listed hereafter as a ‘yardstick’ when assessing compliance, the EU institutions are encouraged to perform their own risk analysis and choose appropriate measures accordingly. Their measures may be different from those presented in this document, 3 | P a g e and the EDPS will assess the measures in place at an EU institution on the basis of completeness and effectiveness, not on adherence to the letter of the guidelines. I.2.Technical background

text: 5 Mobile devices, especially smartphones and tablets, pervade professional and private life. They are now ‘general purpose computing devices’ that run almost any application. In addition to voice calls and text messaging, they offer the ability to use internet services (social networks, content sharing, etc.) and feature many sensors providing an increasing amount of information linked to their users, such us location and an increasing number of environmental and personal parameters.

text: 6 Smart mobile devices have had a profound impact on the way organisations work. Increasingly applications for these devices are being developed that are replacing workstations and laptops for some uses. Among the benefits are increasing employee satisfaction, cost savings, and the ability to accommodate for the increasing mobility need.

text: 7 Smartphones and tablets are not the only mobile devices being used in organisations: portable storage, such as memory cards, USB sticks and hard disk drives also have had a great impact on data storage, transmission and security. The security and privacy risks implied by their use are high and should not be neglected.

text: 8 In this regard, several critical issues have been identified:  users of mobile devices for work-related reasons of EU institutions often process personal data without being aware that an action on the mobile device may involve a processing of personal data which is subject to the conditions and limits of the Regulation. The EU institutions may not realize that -since the data processing operations performed by their employees in the exercise of their functions are attributable to the EU institution- they remain liable for these processing operations, even though the operations might be only ‘transactional’ (e.g. forwarding an e-mail with the contact details of a new colleague);  ‘smart’ mobile devices allow the use of software applications which interact with web resources. They exchange information via their network interfaces sometimes without the users or institutions being aware of this;  when staff of EU institutions use their own private devices for professional purposes (for example, accessing and storing computer information) additional data protection issues are raised. The owner uses the same device for personal communications and for other purposes with apps of his choice installed. The EU institutions cannot exercise the same level of verification and control over the private devices that it has with institutionally-owned devices.

text: 9 The principle of accountability is of paramount importance in the context of the use of mobile devices. This is particularly important due to the complexity of clearly defining the specific responsibilities for each and every actor involved according to the multiple possible use-cases. Close cooperation between the data protection 4 | P a g e officers and the information security officers of EU institutions is strongly recommended. II. Scope, methodology and structure of the guidelines II.1. Scope

text: 10 These Guidelines provide advice on compliance with privacy and data protection rules in the context of the use of mobile devices by staff members of the EU institutions for professional purposes. This advice does not prejudice a separate or specific policy that the EU institutions may consider with regard to their high level or political representatives.

text: 11 These Guidelines cover both mobile devices provided by the EU institutions and those owned by its staff if used for professional purposes (BYOD). The term "mobile devices" includes phones, smartphones, tablets, laptops and netbooks, i.e. all devices enabling staff to work in mobility, as well as storage devices such as external hard drives and USB flash drives. These devices present common risks due to their ‘mobile’ aspect and small size although the security measures that can be implemented on/for them will be different. The main focus of these guidelines is on smartphones and tablets. For other mobile devices, subsets of the risks and the recommended measures apply.

text: 12 While the use of mobile devices for professional purposes generally raises many IT security issues, risks concerning the information assets belonging to the EU institutions fall under the scope of these guidelines only insofar as the IT risks have an impact on personal data.

text: 13 The following issues are addressed in these Guidelines:  general principles for the processing of personal data by mobile devices by EU institutions;  risks for personal data processed in mobile;  best practices to protect personal data.

text: 14 These Guidelines do not address the following scenarios and topics:  staff using devices owned by the EU institutions for personal purposes;  staff use only for personal purposes of private mobile devices (even if brought to the workplace);  risks for the EU institutions' interests and assets other than the ones related to the protection of personal data (e.g. protection of intellectual property or classified information); 5 | P a g e  processing of electronic communications data for detection of unauthorized use of mobile devices ; and  digital forensics on staff members’ mobile devices by competent EU institutions in the context of investigations . II.2. Methodology

text: 15 The process leading to these Guidelines was designed so that they are the result of a structured open dialogue with the EU institutions. The core steps/elements of this process are:  the survey of 21 June 2013 as fact-finding exercise for collecting facts and reaching a better understanding of the EU institutions’ position on the subjectmatter;  the Workshop held on 19 September 2013 on the topic and based on an orientation document preliminarily sent to the participants to the Workshop, where the EDPS also presented the survey results;  the review of best practices on mobile devices security;  the preliminary draft of the guidelines sent to EU institutions for their feedback, and  taking into account such feedback, the finalisation of the guidelines.

text: 16 These Guidelines will be revised by EDPS regularly re-engaging the EU institutions in an open dialogue process. A first review is intended to begin two years after adoption. II.3. Structure

text: 17 This document is structured as follows:  Section III Recommendations presents the list of recommendations to implement based on the obligations laid out in the Regulation. The content of this section is the most relevant for both DPOs/DPCs and the IT/IT security personnel of EU institutions as it specifies the content a “mobile devices policy” should have.  Section IV Security measures to protect personal data processed in mobile devices list some security measures based on best practices that the EU institutions can use to deal with the risks associated with mobile devices as those explained in section VI.  Section V Data protection issues related to the processing of personal data through mobile devices discusses in more detail the different legal issues around the use of mobile devices defined in the scope of this document. 6 | P a g e  Section VI Risks for personal data processed by mobile devices describes some of the risks associated with mobile devices. Text in italics and inside a box represents examples and clarifications to the content of the text above. The sections are tailored to the needs of the different stakeholders required when dealing with the specific problematic of mobile devices: section III should be read by everybody as it describes the obligations emanating from the Regulation. Sections IV and VI contain the most relevant technical information of these guidelines with both security measures and risks associated with the use of mobile devices. Finally section V analyses the particular cases of processing personal data through mobile devices from a legal point of view. III. Recommendations

text: 18 This section contains a set of recommendations which will help an EU institution demonstrate compliance with the Regulation when processing personal data through mobile devices. These recommendations can be understood as the different components of a mobile devices policy as per the following diagram. R1: Involve the DPO regarding all the aspects of the introduction and use of mobile devices in the EU institutions. (See section V.1) It is important that the DPO is involved from an early stage of the planning of the introduction of the use of the mobile device to ensure that the measures taken are compliant with the Regulation. 7 | P a g e R2: Perform a case-by-case assessment of the benefits of allowing the use of mobile devices for specific processing operations taking account of the risks and invasiveness that such use may imply (See section V.1). This assessment should take into account the added functionalities and features of the mobile device, such as enriching a contact list by adding photographs for the contacts with the camera of the mobile device. It also should include the impact of the introduction of mobile devices on the security of the current IT infrastructure. The introduction of insecure mobile devices might cause security challenges for an IT infrastructure that was designed relying on the assumption that all end-devices are secure and that the attackers are located outside the network. (See section V.2) R3: The concerned EU institutions should adopt an acceptable-use policy regarding mobile devices (See section V.1). This policy should also include user’s obligations regarding the life cycle of mobile devices. R4: A DPIA should be performed on the monitoring and control tools used to guarantee the security of the mobile devices. This DPIA should address the main data protection principles and rules referred to in the Regulation, including lawfulness, necessity and proportionality; purpose specification and limitation; data quality, data retention; information to data subjects and data subjects’ rights (access, rectification, erasure, blocking); data transfers and confidentiality of internal telecommunications networks or terminal equipment (See section V.3). Whenever a Data Protection Impact Assessment (DPIA) is carried out for a processing operation, the use of mobile devices for this processing operation needs to be taken into account. The DPIA could be carried out together with the IT security risk assessment, and in any case it should consider the related security risks (See section V.3). R5: Have a properly documented risk management process in place: controllers must take appropriate technical and organisational measures to safeguard the secure use of mobile devices. These measures should ensure a level of security appropriate to the risk presented, taking into account the available technical solutions and the cost of their implementation (See section V.2). In section VI, Risks for personal data processed by mobile devices, some of the risks associated with mobile devices are presented. These risks should be considered by the EU institutions when performing their risk assessment. Also, in section IV, Security measures to protect personal data processed in mobile devices, some best practices security measures are listed. The EU institutions should consider these measures as means to tackle the risks they will evaluate. R6: Adopt internal procedures for the handling of data breaches including notification by the controller to the DPO and to the EDPS (See section V.4). R7: When BYOD is allowed, the concerned EU institutions should: 8 | P a g e  Assess the risks to institutional and private personal data before introducing BYOD in the organisation (See section V.2).  Have a policy governing BYOD. (See section V.1). R8: In the case that there are local copies of personal data on mobile devices, it is also essential that the personal data stored on the mobile device is also made object of rectification, blocking or erasure when the data subject exercises the right to rectify the personal data that are inaccurate or incomplete or the right to block or erase unlawfully processed data. (See section V.5). R9: The use of mobile devices as such is not, in principle, a reason to subject processing operations to prior checking to the EDPS pursuant to Article 27 of the Regulation (See section V.1). The need to submit a processing a processing operation to prior check by the EDPS should be analysed in the light of "purpose" of processing, in accordance with Article 27.2 of the Regulation. IV. Security measures to protect personal data processed in mobile devices

text: 19 This section provides a list of recommended organisational and technical security measures. This list is non-exhaustive and EU institutions may choose among them or adopt alternative measures addressing their specific needs on the basis of their own assessment of risks and needed level of security. The following diagram summarizes these security measures: 9 | P a g e IV.1. Organisational measures

text: 20 The introduction of mobile devices into an organisation requires the establishment of a comprehensive policy including processes, training plans, management involvement, and procedures for dealing with incidents such as data breaches. IV.1.1. Life-cycle management of the mobile device

text: 21 The concerned EU institutions should adopt documented procedures for the managing of the whole lifecycle of mobile devices. 22 Such procedures should cover all relevant phases of the mobile device’s lifecycle from the purchase to the disposal- taking into account all operations that need to be performed on the device. 23 As part of this life-cycle management the EU institution will need to setup and maintain an inventory of mobile devices which includes for every device, at least:  device identification and, where applicable, SIM identification;  status of the device (e.g.: new, in maintenance, assigned, to be disposed of…);  user to which the device is allocated, with begin and end time of allocation where appropriate (e.g. temporary allocated pool devices);  ownership (institutionally-owned /BYOD). 24 An asset disposal policy is especially important for mobile devices. This policy should define the users' obligations. It must also provide for the retention of information as part of the full inventory of mobile devices about those devices marked for disposal. The choice of disposal methods should be based on the evaluation of the security vulnerabilities associated with each method of disposal and provide that devices are disposed of in a way that ensures in particular that all personal data is deleted in case the devices are removed. IV.1.2. Information security policy

text: 25 The concerned EU institutions should adopt an information security policy and specifically a mobile device security policy as well as the respective (clear and comprehensive) privacy notice. The involvement of the management of the EU institution is paramount to the success of the policy which should reflect the security decisions and culture of the EU institution. All security policies should take into consideration data protection requirements. 26 Security officers and DPOs need to be involved in the drafting of the security policies and of the privacy notices from the very early stages. IV.1.3. Training

text: 27 A training plan should be established to raise awareness on how to protect personal data on mobile devices when allowing their use to staff members. 10 | P a g e This training is particularly important for management, since managers are likely to have access to the most sensitive data in the organisation. They also need to be made aware of their potential personal and financial liability for failure to respect the data protection obligations, similar to their responsibility under the Financial Regulation. 28 This training plan should follow the mobile device policies of the EU institution and may include the following scenarios and topics:  Mobile device basic, security and privacy features;  Business-related applications and services;  Out-premises (travel) use and security;  Private use of institutionally-owned devices;  BYOD. 29 The training plan should be evaluated and updated periodically. 30 The training may be obligatory regularly as a ‘refresher course’ for every mobile device user. IV.1.4. Organisational measures for BYOD

text: 31 Establish organisational structures and processes ensuring that the organisation’s policies are applied to the devices (e.g. restrictions on the type or version of the device, type of operating system, configurations, etc.). 32 Provide users with support for configuring the devices with in line with the mobile device policies with respect to security, privacy and data protection. IV.1.5. Security breaches/security incidents

text: 33 Security procedures need to be in place to promptly and effectively respond to any security incident (such as the loss or theft of a mobile device). These processes need to take into account data protection requirements and involve the DPO. 34 Users need to be informed about how and where to report security incidents like the lost or theft of the device. Particular attention should be paid to the fact that users will typically not be in the office at the moment of the incident and thus adequate means for reporting security incidents should be set up covering all reasonable scenarios a user may find him/herself in. IV.2. Technical measures

text: 35 There are several risks concerning the processing of personal data. Most of the times the best, and even the only, solution to some of these issues is the careful evaluation 11 | P a g e of the applications installed on a mobile device and the proper configuration of the operating systems as well as of the applications . 36 Managing and configuring devices, operating systems and applications was traditionally performed by dedicated professionals of the IT department. With the introduction of mobile devices, often used as BYOD, some of these tasks are now performed directly by the users, who are often neither IT specialists nor security/privacy experts. 37 To tackle this challenging situation, two approaches should be jointly used by the EU institutions concerned, namely:  increase users’ understanding and awareness of the data protection risks and on the possible countermeasures ; and  use suitable “mobile device management” (“MDM”) solutions which, as technical measures, address security and data protection requirements. IV.2.1. Mobile device management (“MDM”)

text: 38 Mobile device management (“MDM”) solutions can be used by the IT department of the EU institution to perform certain tasks related to the configuration and management of mobile devices for security purposes . However, this capacity comes with increased responsibilities for the EU institution since this kind of software entails a -rather intrusive- processing of personal data (e.g. MDM may allow mobile devices to be tracked in real-time). Compliance with data protection requirements is therefore of essence. 39 The typical set of features a MDM solution should include is:  Security: o enforcing device PIN/password use for accessing the mobile device, specific applications or containers as well as private keys; o remote device lock and wipe (of either all data on the device or of institutional information only); o detection of configuration change; o restrict user and application access to the device hardware; o restrict user and application access to native OS services; o secure logs and audit trails of management BYOD activities; 12 | P a g e o backup and restore of institutional information in the mobile device; o compliance check before accessing institutional resources; o data encryption both at rest (in the device) and in transit (communications encryption); o distribution and management of digital certificates.  Device management: o centralized security policy enforcement; o over-the-air (OTA) distribution of software (applications and updates) and policy changes;  Application management: o remote application lock and wipe; o applications whitelists and blacklists; o enterprise application stores; o secure distribution of applications with appropriate controls against tampering; o per device applications inventory (both institutional and personal); o application security. 40 MDM systems might not be capable to implement these features on all possible mobile devices but only a subset. This needs to be taken into consideration when deciding which mobile devices to allow. 41 In case a MDM solution is implemented the following measures need to be taken:  Assess the data protection impact of the MDM solution. As part of this assessment is important to identify what personal data the MDM solution collects and the purposes they serve, where and for how long it is stored, who has access to the data and the logging capabilities. The EU institution shall verify whether this information is strictly necessary for the envisaged purpose or there are less intrusive solutions.  Inform the users via the acceptable use policy of the use of the MDM solution on their device, the type of information collected via the MDM and the purpose of this collection. The MDM solution that the EU institution may put in place to ensure the security of the institutional data processed by the staff members on their personal devices can entail increased monitoring at work of the staff members by the EU institution. This monitoring could include, for instance, recording the geo-location of the mobile device or monitoring the internet traffic on the same device. 13 | P a g e  Restrict the access to the MDM solution administrative console on a leastprivilege, need-to-know basis .  Evaluate the coverage of the MDM solution with respect to the full inventory of mobile devices and to other sources of information like applications or network logs. IV.2.2. Other technical measures

text: 42 An MDM solution by itself will not address all the risks implied by the use of mobile devices. The follow list provides technical measures that can be envisaged, depending on the specific risks of every EU institution. Some of these measures would benefit from an MDM solution for their implementation, although they do not require one to be functional. These security measures also need to be considered with specific devices in mind: encryption can be applied to portable memory storage, e.g. USB sticks, but not anti-malware software, at least in the USB stick itself. 43 T1: Design, implement and maintain a sandboxing, compartmentalisation or virtualisation solution to segregate private and institutional information. Sandboxing provides a tightly controlled environment in a mobile device for applications to run in. With compartmentalisation an encrypted data store is created on the mobile device. The access to the information in the closed compartment requires authentication which is additional to any other authentication system currently applied in the mobile device. 44 T2: Develop, implement and test an encryption solution which should ensure that personal data stored on the mobile devices (or, at least, in the ‘institutional compartment’ of the device, if a compartmentalisation/MDM solution is in use) are encrypted. 45 This solution may contain:  The requirement for full disk encryption for all devices and of additional encryption for secure containers of applications;  The requirement to use only standard encryption algorithms;  The length of the encryption keys chosen must be appropriate to the security requirements. 46 T3: Develop, implement and test a backup solution to guarantee the availability of information stored only in the mobile device. 14 | P a g e In most cases the mobile device is not the main storage for professional information and the configuration of the device is provided from a central repository which makes the backups unnecessary. On the other hand, personal data (like contact information) may only reside in the mobile device and may need to be backed up. 47 T4: Design and enforce adequate user authentication to the mobile device including PINs and passwords to unlock the mobile device. Users with access to sensitive information may have a second authentication factor in addition to the PIN/password. The mobile device should be locked and/or wiped after a predetermined number of unsuccessful PIN/password attempts. 48 T5: Disable unneeded functionality. E.g. disabling by default unnecessary or risky features, such as GPS, Near Field Communication (NFC), Bluetooth, etc. Disabling unneeded functionalities will provide a more secure mobile device thanks to reducing the attack surface an attacker may use to compromise the device and will make the mobile device easier to maintain because of the reduce number of components. 49 T6: Apply secure and privacy-friendly default configuration for mobile devices and applications. E.g.: automatic lock of the mobile device while inactive. 50 T7: Ensure timely software updates of the mobile device and of the applications installed on it (whether using an MDM solution or not). 51 T8: Access to the internal networks of the EU institutions should only be granted after validating the network connection from a mobile device against the institutional directory and authorisations. Device digital certificates and/or user digital certificates can be used to identify and authenticate the mobile device/user before granting access to the network. Two factors authentication may be implemented for connections regarding sensitive applications or information. 52 T9: Only allow encrypted traffic between the mobile devices and the internal network of the EU institution. Users need to be aware that VPNs (Virtual Private Networks) used for the encryption of the traffic between the mobile device and the internal network may redirect all traffic, including private communications, through the IT network of the EU institution. 53 T10: Use industry-standard firewall and anti-malware applications on the mobile devices and block the access to the institutional network to devices devoid of such firewalls and applications and/or with outdated configurations. Both firewall and antimalware application should be updated periodically (automatically or not, through an 15 | P a g e MDM solution or directly with the vendor of the firewall or anti-malware application).

text: 54 T11: According to the use policy, block any use of third parties applications to process the EU institution personal data, unless provided by the institution’s policies and after an adequate assessment focusing on risks for personal data. V. Data protection issues related to the processing of personal data through mobile devices V.1. EU institutions as controllers accountable for data protection under the Regulation

text: 55 In the context of the processing activities done via mobile devices it is particularly important to point out that personal data is any information relating to any identified or identifiable natural person: this includes not only data relating to the staff of EU institutions, but also to natural persons outside a working relationship with EU institutions or agencies. For example, devices could be used for mobile access to the user’s institutional email account, or to access a database containing personal data and downloading or synchronizing that information into the mobile device. Professional mobile applications could be installed onto the device to access information databases or web portals where different categories of personal data could also be available (for instance, a human resources management system). The personal data in question may thus include names, e-mail addresses, telephone numbers, traffic and location data, IP addresses and cookies, as long as they can identify a natural person. It should also be noted that the personal data may be processed under any form, such as in an e-mail which contains personal data, and with any technology, including Internet protocols. Even in the simplest case, for example when the device is used only for phone communications and SMS, traffic and contact data of the phone users and their communications partners will be processed. In addition, smart phones and tablets utilize a number of techniques that make it possible to identify and track individuals with regard to their physical location and in relation to how they make use of their device and applications (location-based services available on mobile phones and tablets collect location information that allows third parties to identify the precise whereabouts of users). Moreover, personal data of third persons (namely, persons outside the employment relationship with the EU institutions) may be contained in messages and stored calls, e.g. in a voice mail system.

text: 56 The EU institutions also need to collect and further process personal data for the management of the mobile devices themselves, and may often also install ad-hoc software on them. This is the case of the installation of so-called “Mobile Device Management” (MDM) solutions, which add functionality for security related data 16 | P a g e collection and interventions to the devices, connecting them with dedicated central control servers. 57 When a staff member of an EU institution uses a mobile device for work-related tasks upon instructions of the EU institution, this institution is the controller as it determines the purposes and the means of the processing of the personal data. The processing performed via the mobile device thus falls within the scope of application of the Regulation. 58 Also in the ‘BYOD’ scenario, most problematic than the institutional one due to the reduced control the EU institution will have on the mobile device, the EU institution is still responsible for taking all measures necessary to comply with their obligations under the Regulation and for setting up the internal mechanism to demonstrate such compliance. 59 EU institutions should take care not to overlook that the processing via mobile devices needs to meet the same requirements and principles as processing operations in the ‘traditional’ desktop environment. 60 The staff member of an EU institution using his or her own device for the performance of work-related tasks (BYOD) has the obligation to implement the policies specifically adopted by the EU institution for this context. 61 In line with the principle of accountability, it is important that the DPO is involved from the early stage of the planning and management of data processing via mobile devices to ensure that the measures taken to mitigate or annul the data protection risks are appropriate and compliant with the Regulation. 62 The following scenarios can thus be considered the main examples of processing of personal data through the use of mobile devices:  The processing of data by (staff of) EU institutions via mobile devices (by devices owned by the EU institution or according to the BYOD scenario) as a tool for data processing operations similar to those already performed by EU institutions in the traditional IT (‘desktop’) environment.  The monitoring of staff members’ use of the mobile device by EU institutions .  The processing of personal data within the context of the deployment of MDM solutions. 63 In all of the above cases, the Regulation is applicable. 17 | P a g e

text: 64 Recital 12 of the Regulation requires that “consistent and homogeneous application of the rules for the protection of individuals' fundamental rights and freedoms with regard to the processing of personal data should be ensured throughout the Community”. That includes the e-Privacy Directive (Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector). Without prejudice to specific provisions, these rules are a point of reference for EU institutions. In this regard it is important to consider the following: “In the case of a personal data breach, the provider of publicly available electronic communications services shall, without undue delay, notify the personal data breach to the competent national authority. When the personal data breach is likely to adversely affect the personal data or privacy of a subscriber or individual, the provider shall also notify the subscriber or individual of the breach without undue delay.” - Article 4(3) of Directive 2002/58 (as amended by Directive

text: ). These rules are not directly applicable to EU institutions and bodies, however they might be considered as a good practise (see point V.4 below). 65 The Regulation lays down the conditions under which the processing of personal data may be lawful. The controller must ensure that staff members do not use mobile devices for processing not covered by a legal basis . 66 The necessity and proportionality of the processing of personal data by mobile devices requires that the EU institutions perform a case-by-case assessment of the benefits of such tools compared to the risks and invasiveness that the processing may imply. This assessment should take into account the added functionalities and features of the mobile device, such as enriching a contact list with photographs taken with the mobile device. 67 The users of the mobile devices need to be informed of the data processing being performed because of their use of mobile devices, whatever they are institutionallyowned or personal devices. Even more when personal data is collected and further processed for the management of the mobile devices themselves. The EU institutions should adopt an acceptable-use policy regarding mobile devices, which should include:  clearly defined uses of the mobile devices approved by the EU institution,  consequences of misuse of mobile resources,  what institutional information and personal data is allowed to be stored and transferred to mobile devices,  type and version of the mobile devices and operating systems approved, 18 | P a g e  what applications are permitted to be installed and used,  the EU institution policy regarding the use of cloud services,  return and disposal policy,  a clear description of the responsibilities of the user and of the EU institution,  under which conditions the monitoring of the use of mobile devices by EU staff members is allowed , and  a notice on the personal data the user may collect and process via his or her mobile device. 68 The acceptable-use policy should be formally accepted by users before they can use mobile devices. In case the acceptable use policy changes, the new one should be promptly communicated to the users which will need to accept it again. 69 As for the BYOD scenario the policy governing BYOD should be easily available to all possible users of BYOD before they decide to use or not their own mobile devices for professional matters. This policy should include "opt-in" compliance with the policy, besides the acceptable use policy for all mobile devices, as a condition for BYOD permission; and "opt-in" user permission for systems management and monitoring of BYOD devices. 70 The configuration of the mobile device should reflect (“incorporate”) the rules (also pursuant to the principles of privacy by design and by default, and to the data minimisation principle). As for the implementation of the principle of purpose specification/limitation it is important to avoid ‘function creep’ (the collection and processing of data for not permitted secondary purposes), for example by excluding the installation of apps which are unnecessary for the work-related tasks and segregating office data from private data. 71 Regardless of the legal basis applicable to a specific processing operation, it is important to make reference -first of all- to the purpose of the data processing, and not to the technical device in use: the use of mobile devices as such is not, in principle, a reason to subject processing operations to prior checking to the EDPS pursuant to Article 27 of the Regulation. The need to submit a processing a processing operation to prior check by the EDPS should be analysed in the light of "purpose" of processing, in accordance with Article 27.2 of the Regulation. V.2. Security obligation under the Regulation

text: 72 Controllers must take appropriate technical and organisational measures to safeguard the secure use of mobile devices. These measures should ensure a level of security appropriate to the risk presented, taking into account any available technical solutions and the cost of their implementation . 19 | P a g e

text: 73 This implies that controllers have to implement an information risk management process according to established principles of good practice. The first step of this process is the assessment of the risks, which should include an analysis of the use of mobile devices. This risk assessment will help determine the main security risks, and provide the basis for selecting the appropriate controls that must be implemented in order to reduce the risks to a level acceptable by management. The risk management process has to include periodical review of the risk assessment and the appropriateness of the safeguards and controls. 74 This information risk management process must be properly documented as a policy of the EU institution. It must also be regularly reviewed to ensure it remains effective, and aligned with new and changing business objectives. Staff members taking part in the process (especially in the analysis of the security risks) should not only be those dealing with security within the EU institution. Representatives from the ‘core business’ side (HR, core/operational business activities) and the DPO should also participate in discussions to ensure that the analysis takes into account the impact on all facets of the business. 75 The staff members concerned should be clearly aware of the main results of the information risk management process and of existing security risks, while management and key stakeholders may benefit from a detailed communication of the outcomes of this process. V.3. Data Protection Impact Assessment (DPIA)

text: 76 The EDPS recommends that when a Data Protection Impact Assessment ("DPIA") is carried out by the EU institutions, the use of mobile devices needs to be taken into account. In particular, the DPIA assessment should be carried out together with the IT security risk assessment, and in any case considering the related security risks. 77 The DPIA should be performed in particular on the monitoring and control tools used to guarantee the security of the mobile devices. This DPIA should address the main data protection principles and rules referred to in the Regulation, including the principle of lawfulness, necessity and proportionality of the data processing; purpose specification and limitation; data quality, data retention; information to data subjects and data subjects’ rights (access, rectification, erasure, blocking) and data transfers. V.4. Communication of data breaches

text: 78 The EDPS recommends the EU institutions to adopt internal procedures for the handling of security and data breaches that foresee in particular the notification of the occurrence of such events by the controller to the DPO. 20 | P a g e For example, in case of loss or theft of the mobile device entailing a personal data breach, the staff member should report the event internally according to the EU institution’s policy on the handling of security and data breaches. The DPO should assess and document the breach and the measures taken in reaction for future assessment and verification and consider whether it is appropriate to inform the EDPS. The EDPS response to such data breaches will obviously depend on a number of factors including the seriousness of the breach, the type and volume of data involved, the numbers of data subjects affected, the location of the recipients, etc. V.5. A specific scenario: secondary storage of personal data via mobile devices

text: 79 When personal data is processed via a mobile device, the user might store copies of personal data from central information systems on the device. This ‘secondary storing’ may lead to problems regarding the quality of the data, exercise of the rights to rectification, blocking and erasure by the data subject and as for the respect of the relevant data retention period. It might be the case that these data stored on the mobile device are not accurate or kept up-to-date, whereas the data are updated in the central storage system of the EU institution. The risks for the EU institution are increased by this possible lack of awareness of the processing operations taking place via a mobile device. For example, a staff member of the HR department of an EU institution downloads on the mobile devise the document attached to an e-mail containing the personal data of a colleague. Under another possible scenario the user may use an application that replicates in the cloud the information stored in the mobile device without user’s awareness. This scenario presents further risks regarding the confidentiality of the personal data being processed. 80 In case local copies of personal data on mobile devices are part of the processing operation as designed by the EU institution, it is also essential that when the data subject exercises the right to rectify the personal data that are inaccurate or incomplete or the right to block or erase unlawfully processed data, the personal data stored on the mobile device are also considered for rectification, blocking or erasure. VI. Risks for personal data processed by mobile devices

text: 81 This section provides a list of typical risks and threats to personal data in mobile devices, which should be considered by the EU institutions when performing their own risk assessment. This list provides a basis for identifying the most important risks and threats although it is not exhaustive: The actual risks and the security measures to control those risks need to be determined by each EU institution in the context of their assessment. As a reminder, in the next diagram the main components of the risk management process are presented. 21 | P a g e

text: 82 Mobile devices present more risks to personal data than desktop computers due to their portability, and, in case of smartphones and tablets, their ability to collect and share large quantities of contextual information, their ‘always-on’ nature, their number and diversity of sensors , and the users’ expectation of a ‘seamless interaction’. 83 Mixed use of mobile devices both for private and professional purposes may bring a further layer of complexity. Personal data processed in the context of professional life could potentially be processed without authorisation and its confidentiality, integrity and availability compromised while using the device for private purposes and viceversa, even without the knowledge of the user. 84 The most relevant risks to the personal data are:  accidental loss of personal data;  alteration or destruction of personal data due to an unlawful access to users’ personal data by mobile devices administrators, including remote switch off and remote alteration/wiping of personal data (photos, videos, local contacts, local copies of e-mails, documents, etc.);  leakage of personal data due to non-authorized access to those data possibly also causing reputational or financial damages to the EU institution;  unlawful geographical location of the user by potential attackers via location services;  identity theft through the compromise of credentials (usernames, passwords, certificates) stored on mobile devices. 22 | P a g e

text: 85 The most relevant threats that could lead to the previous risks are:  mobile applications and/or the mobile devices unlawfully collecting and processing personal data; E.g.: geographical location of the users without their consent. Analysing text messages exchange for commercial profiling.  customisation by device manufacturers, carriers and OS developers leading to locked configurations and features; For example, not being able to deactivate location (GPS) sensors or to limit what information the mobile device sends to the vendor of the device or the provider of a particular application.  intentional exploitation by hackers (externals or insiders) of mobile devices vulnerabilities to target personal data (directly o as a side effect of the targeting of business related data); E.g.: an infected PDF file is sent to the user of a mobile device with the aim of compromising the device to be able to read the user’s emails.  accidental loss or theft of the mobile device;  tampering physically with the device for accessing the information in it or for installing malware; The mobile device is left unattended in a hotel or meeting room and because of that somebody physically interacts with the device and manages to install/modify the applications contained in the mobile device or to physically alter the mobile device itself.  misuse; Due to a wrong configuration the user is able to disable the firewall installed on the mobile device. For using a specific application the user disables the firewall even if the user is aware that it is forbidden by the organisation policy.  human error. The user ignores a security warning provided by a mobile device and the device is infected with malware. VI.1. Breach of the stored data

text: 86 If adequate measures to secure the data stored on the mobile devices from unauthorized or inappropriate access are not in place, the EU institution may be exposed to potential financial, reputational, or even physical harm. Some examples may illustrate this threat: • a mobile device is stolen, including the personal data stored thereon; • a mobile or storage device is disposed of into the trash or sold without removing the personal data so that the person who acquires the device may have access to the stored personal data; 23 | P a g e • institutional/private information stored on the device may be exposed to applications used for private/professional purposes; • file sharing and file storage applications may make confidential information available to third parties; • personal data is stored in the cloud and then compromised. VI.2. Processing of ‘third party personal data’

text: 87 Some of the personal data processed through mobile devices relate to individuals which are not staff members of the EU institutions: third party personal data. For example, a user from an EU institution may access an institutional application containing personal data and download these data into the mobile device. This new "database" ("shadow database") contains the same personal data as the “original” institutional application but would not be protected by the security measures in place for the latter (e.g. access controls by strong authentication measures) or in case of download on the EU institutions’ personal computer (traditional hardware). 88 If we consider that mobile devices are subject to higher risks of loss or theft, and that the security measures which can be implemented on a mobile device are limited, it is evident that the data protection risks are considerably higher in this scenario than in case of normal access to the institutional database by personal computers. VI.3. Interception of communications

text: 89 Interception of communications may be defined as the observation or monitoring of an individual's communications or activities. Monitoring someone's activities typically happens in three ways: by eavesdropping on their communication; by inspecting data that is collected by communication activities (metadata); and by gaining access to the mobile device itself. Examples of factors and means used for interception of communications include: • lack of security in communication protocols to protect e-mail or web traffic; • malware on devices; • privacy invasive applications that access and use personal data in illegitimate ways. For example, a compromised WiFi public access point may be used to perform a man-in-the-middle attack and extract information from the communication of the users. VI.4. BYOD specific risks

text: 90 The possibility for EU institutions’ staff to use ("bring") their own mobile devices for accessing institutional information may bring some benefits to both EU institutions and their staff. Nonetheless, this also comes with added risks. The degree of control that the EU institutions and their IT departments can exercise -also having regard to the configuration of the devices- might be reduced in the BYOD scenario as compared to a scenario where the devices and the apps are preselected, approved and managed by the EU institution. 24 | P a g e

text: 91 If the mobile device connects to the network of the EU institution it may present an additional risk (also due to the unfeasibility of managing the security of the mobile device). Rogue applications and malware may use the personal device for intruding into a protected network. 92 As remarked, BYOD leads to blurring of personal and professional use. The EU institutions risk getting access to personal and private data of their staff members (e.g. by accessing personal data synchronized to the institutional infrastructure), and the staff members risk exposing institutional information through the use of personal services like cloud storage or backup (easily activated by the users themselves), or via applications installed for personal uses which could subsequently offer ‘gateways’ for unlawful access to information hold by the EU institution. 93 The wide offer on the market of different models of mobile devices using different operating systems makes it difficult if not impossible for the IT departments of the EU institutions to provide support regarding the choice and management of all these devices. In addition, the IT department will hardly have any control on security updates and configurations which may be applied by the user or by the mobile device provider. None the less, the complexity and difficulty, under both a legal and a technical point of view, of the data protection aspects of the data processing by EU institutions by an IT infrastructure making use of mobile devices provided to staff members, cannot be used by EU institutions as a justification in case of lack of compliance with the Regulation. Ultimately, if the data processing entails processing of particularly sensitive data and information, a ‘not-to-go’ decision could be envisaged by the EU institution, not allowing for example the use of mobile devices (either institutional-owned and/or under the BYOD scenario) for the collection, storage and transmission of these personal data. 25 | P a g e


text: Security of processing

text: Having regard to the state of the art and the cost of their implementation, the controller shall implement

text: appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected.

text: Such measures shall be taken in particular to prevent any unauthorised disclosure or access, accidental or unlawful destruction or accidental loss, or alteration, and to prevent all other unlawful forms of processing. 2. Where personal data are processed by automated means, measures shall be taken as appropriate in view of the risks in particular with the aim of: a. preventing any unauthorised person from gaining access to computer systems processing personal data; b. preventing any unauthorised reading, copying, alteration or removal of storage media; c. preventing any unauthorised memory inputs as well as any unauthorised disclosure, alteration or erasure of stored personal data; d. preventing unauthorised persons from using data-processing systems by means of data transmission facilities; e. ensuring that authorised users of a data-processing system can access no personal data other than those to which their access right refers; f. recording which personal data have been communicated, at what times and to whom; g. ensuring that it will subsequently be possible to check which personal data have been processed, at what times and by whom; h. ensuring that personal data being processed on behalf of third parties can be processed only in the manner prescribed by the contracting institution or body; i. ensuring that, during communication of personal data and during transport of storage media, the data

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, OJ L 8 of 12.1.2001, p. 1 2

text: Article 29

text: WP 173

text: , Opinion 3/2010 of 13/07/2010

text: cannot be read, copied or erased without authorisation; j. designing the organisational structure within an institution or body in such a way that it will meet the special requirements of data protection.

text: https://www.sans.org/information-security/ 4 An information asset is a piece of data which has value to the organisation (e.g. an employee record, analysis reports, financial data of the organisation, etc.)

text: Figure 1: overview of Information Security Risk Management

text: Other frameworks exist such as NIST SP 800-39 or COBIT (ISACA) See ISO 27005 7 ibidem 8 Although ISO 27000 and ISO 27005 provide a bigger set of definitions, the ones formalised here are the ones essential for understanding the rest of this document. 9 See chapter 5

text: B.1 Risk Identification

text: B.2 Risk Analysis

text: http://www.ssi.gouv.fr/guide/ebios-2010-expression-des-besoins-et-identification-des-objectifs-de-securite/ 11 http://www.cert.org/resilience/products-services/octave/ 12 http://administracionelectronica.gob.es/pae_Home/pae_Documentacion/pae_Metodolog/pae_Magerit.html?idio ma=en

text: B.3 Risk Evaluation

text: On the timing of the ‘implementation of the security measures, we note that Directive

text: under

text: Article 17

text: contains provisions which are similar to the ones contained under Article 22 of the Regulation. In particular, recital 46 of the Directive clarifies that the security measures have to be taken “both at the time of the design of the processing system and at the time of the processing itself”. 14 As documented in the following standards: ISO 27005, BSI standard 100-3, NIST special publication 800- 30…

text: ISO 27001 definition: systematic use of information to identify sources and to estimate the risk, and to compare the estimated risk against given risk criteria to determine the significance of the risk 16 Such as ISO 27005, BSI standard 100-3, EBIOS, Octave Allegro, NIST special publication 800-30, MAGERIT… 17 This document focusses on Information Security Risk Management. An organisation would typically also deal with overall Risk Management (often referred to as Enterprise Risk Management), which is the process designed to identify potential events that may affect the entity, and manage risks: such process goes beyond looking at the information the organisation processes and the security of this information. In this regard, see ISO 31000.

text: See ISO 20000:2014

identifier: EDPS riktlinjer (2016)

amnesord:
Information Security
Privacy in the EU Institutions
IT at Work

title: Security Measures for Personal Data Processing

text: Guidance

text: Security Measures for Personal Data Processing Article 22 of Regulation 45/2001

text: 21 March 2016 1 | P a g e

text: Executive Summary

text: The EDPS aims in this guidance document at explaining Article 22 of Regulation 45/2001 and provides information on the main practical steps EU institutions and bodies should take in order to comply with it. It is based on generally accepted good practices in Information Security Risk Management (ISRM) and aims at helping EU institutions, as controllers, to assume their responsibility according to the accountability principle.

text: Securing information is a key objective that any organisation must manage in order to fulfil its stated mission. Moreover, most organisations must deal with an ever changing landscape affecting their operations. Uncertainties created by such changes will affect how the organisation needs to react in order to ensure that its information assets are suitably protected. Therefore, there is a need for a specific framework that helps individuals responsible for information security to manage the uncertainties which might affect the security of their organisation's information over time. Such framework for a specific organisation is referred to as ISRM process.

text: In the context of processing personal data, risks must be mitigated as per the legal requirement stated in Article 22 of Regulation 45/2001 which means that - In its analysis, Information Security Risk Management must also cover information security risks affecting personal data - From it analysis, a set of suitable security measures may be defined and implemented

text: Security measures protecting personal data cannot be defined generically since they must come from the Information Security Risk Management process, which takes into account the specific context in which personal data is processed.

text: 1. Having management buy-in and approval on the ISRM process itself as well as providing guidance on the acceptable levels of risks.

text: 2. Allocating resources to tackle all tasks related to ISRM.

text: 3. Providing adequate training and awareness to staff on the existence and implementation of the ISRM process.

text: 4. Linking the ISRM process to other processes of the EU institution as appropriate.

text: 5. Following risk assessments, analysing possible security measures and selecting the most appropriate ones based on security, data protection and needs.

text: 6. Regularly reviewing all steps of the ISRM process, in the light of the changes to the operations and to the risks to information including personal data processed by the EU institution. This includes reviewing the implementation of security controls and their suitability in the light of technology and market developments, as well as taking into account the changes in the processing of personal data by the EU institution.

text: 7. Efficiently documenting all key steps of the ISRM process and making use of tools to ease the implementation of all steps of that process.

text: 8. As quickly as possible, reviewing current security measures for existing processes and IT systems in order to align them with the appropriate risk assessments.

text: 2 | P a g e

text: 1 Introduction

text: 1.1 Aim and scope of this document

text: This document aims at explaining Article 22 of Regulation 45/2001 (“the Regulation”) and providing guidance for EU institutions and bodies (“EU institutions) on the main concept described in this article. The document is targeted at the EU institutions’ management and staff responsible for securing the processing of personal data through technical and organisational measures, as well as the staff members monitoring and ensuring compliance with data protection obligations.

text: It is based on generally accepted good practices in Information Security Risk Management and aims at helping EU institutions, as controllers, to assume their responsibility according to

text: the accountability principle .

text: The provisions under Article 22 of the Regulation are analogous in substance to the ones contained in other data protection legal instruments (e.g. Directive

text: ; Directive

text: ; Council Framework Decision 2008/977/JHA). Thus the approach layed out in this document should also be useful for bodies, organisations or companies that are subject to these other legal instruments.

text: In the legal text of

text: Article 22

text: [see box below] emphasis is added to indicate the references to Information Security Risk Management:

text: 4 | P a g e

text: Information Security Risk Management is a concept broader than the processing of personal data. A description of that concept is provided for the reader in chapter 1.2 – the reader should note however that in the context of processing personal data, risks must be mitigated as per the legal requirement stated in Article 22 of Regulation 45/2001 which means that  In its analysis, Information Security Risk Management must also cover information security risks affecting personal data;  From it analysis, a set of suitable security measures may be defined and implemented (see also chapter 1.2.2.2). Security measures protecting personal data cannot be defined generically (it is not possible to define a set of security measures that can be applied in all cases) since they must come from the Information Security Risk Management process, which takes into account the specific context in which personal data is processed.

text: 1.2 Background

text: 1.2.1 The ‘bigger picture’ Securing information is a key objective that any organisation must manage in order to fulfil its stated mission. This key objective is associated with a specific field of knowledge called "Information Security" which refers to the processes and methodologies which are designed and implemented to protect printed, electronic, or any other form of confidential, private and sensitive information or data from unauthorized access, use, misuse, disclosure, destruction, modification, or disruption. It should be noted that Information Security applies irrespective of the nature of the information; its key concepts apply whether or not personal data is processed. They are recalled here to provide background and complement the reading of Article 22 of the Regulation. Most organisations must deal with an ever changing landscape affecting their operations. Uncertainties created by such changes will affect how the organisation needs to react in order to ensure that its information assets are suitably protected. Furthermore, individuals responsible for their organisation's Information Security would need to fulfil their task and manage these uncertainties with a limited set of resources and often tight deadlines stemming from the organisation's needs. Therefore, there is a need for a specific framework that helps individuals responsible for information security to manage the uncertainties which might affect the security of their organisation's information over time and indicates how to best react to these uncertainties within the constraints of their work environment (e.g. with the staff working in the organisation, within their budget, within their time constraints, management strategy etc.). This framework would also serve to help sharing views on the necessary activities that need to be carried out in order to ensure proper Information Security within the organisation. Such

text: 5 | P a g e

text: framework for a specific organisation is referred to as Information Security Risk Management process. Security measures can only be defined and implemented in the final phase of the Information Security Risk Management process, otherwise, an organisation has no guarantee that the selected security measures are adequate or sufficient in order to mitigate the risks to a level acceptable by the organisation’s management.

text: 1.2.2 Basis of Information Security Risk Management (ISRM) 1.2.2.1 Overview 5 A possible framework to manage uncertainties which might affect the security of an organisation's information has been defined by ISO as Information Security Risk Management (ISRM). ISO views the ISRM as a continual process that aims to "… assess the risks and treat the risks using a risk treatment plan to implement the recommendations and decisions" . In order to fully understand what is meant by ISO by this definition of ISRM, it is necessary to also make reference to the definition of "risk" as "effect of uncertainty on objectives". In this context, we are focused on the objective to secure information. Accordingly, in the context of this document, we are only interested in risks to Information Security. Figure 1 gives an overview of the ISRM process. Each step is summarily described in the next subchapters.

text: 6 | P a g e

text: Basically, ISRM is achieved by iterating through each step [as shown on Figure 1], i.e. going through each step and then starting again once the full process has finished. Each iteration uses the previous results as a stepping stone. The first iteration is of course the most expensive in terms of resources as there are no previous results to build upon. However, it should be noted that going through subsequent iterations requires investment and commitment from the organisation. This exercise allows the organisation to: - Identify the risks to the organisation and assess the consequences of these risks to the operations. - Make informed decisions on how to react with regards to these risks. - Prioritise actions in order to deal with these risks. - Effectively monitor its activities. - Raise staff awareness on Information Security.

text: 1.2.2.2 The steps of Information Security Risk Management This chapter summarises each step shown in Figure 1. The reader is encouraged to consult ISO 27005 for more detailed information.

text: A Context Establishment

text: This step serves to launch an iteration of the ISRM process. All relevant information is collected, the elements to carry out the rest of the exercise are defined (e.g. risk evaluation criteria, impact criteria, etc.), the scope and objective of the ISRM is defined and responsibilities are assigned to key staff in order to carry out the exercise.

text: B Risk Assessment

text: Taking the information collected and defined in the previous "Context Establishment" step, "Risk Assessment" aims at identifying and describing the risks the organisation is subject to by performing the following steps:

text: The goal of this step is to determine what risks can affect the organisation (i.e. to determine what can go wrong, how it can go wrong, and understand why this could happen). For this identification to be meaningful, the previous analysis of the specific context [1.2.2.2 A] of the organisation is of paramount importance.

text: Once a set of risks has been identified, each risk is analysed in order to determine the probability that this risk materialises and the consequences it may then have on the organisation. There are several risk analysis methodologies available such as EBIOS , 11 12 Octave/Octave Allegro , MAGERIT . The selection of an appropriate methodology is done in the "Context Establishment" step [1.2.2.2 A]

text: 7 | P a g e

text: Each risk that has been analysed and estimated in the previous step is then compared against criteria defined in the "Context Establishment" step. The evaluated risks are then prioritised in order to feed the next step.

text: C Risk Treatment

text: Once risks have been evaluated and prioritised, a decision on what to do with each risk needs to be taken by the organisation. Typically, an organisation may decide to reduce the risk (by implementing, changing or removing security measures); to retain the risk (i.e. keep the situation as it is); to avoid the risk (decide to avoid an activity in order to avoid that risk); to share the risk (use an external party that could better cope with managing that risk). These decisions are not mutually exclusive. After decisions have been taken, a risk treatment plan is devised (i.e. security measures are defined with a plan on how and when they need to be implemented). Additionally, the residual risks are estimated (i.e. after treatment, a risk is usually not completely eliminated; it is thus necessary to evaluate the level of this remaining risk).

text: D Risk Acceptance

text: If the residual risks are deemed acceptable by the organisation, a formal decision by the organisation's decision makers is recorded. Otherwise, further analysis or treatment is performed. Following this process, ultimately, the organisation's decision makers take the responsibility to deal with risks taking into account the organisation's overall strategy and available resources. Security measures may therefore be implemented or not depending on whether the acceptable level of risks for the organisation is reached.

text: E Risk Communication and Consultation

text: This step aims at communicating risk related information (the risk analysis, evaluation, treatment and acceptance) to all stakeholders in order to achieve a ‘buy-in’ (acceptance) on the practical activities to take in order to deal with the risks. This means that stakeholders are aware and committed to do ‘whatever it takes’ to implement the measures foreseen under the security plan. This step also ensures that the appropriate information is considered throughout the ISRM.

text: F Risk Monitoring and Review

text: As with any security-related activity, risks need to be constantly monitored in order to react appropriately to changes to the risks and adapt the appropriate parts of the ISRM accordingly. Furthermore, the ISRM process itself should be reviewed and improved so that any subsequent iteration is more effective and efficient.

text: 8 | P a g e

text: 2 Interpretation of Article 22 of the Regulation

text: As pointed out by the emphasized sections above in

text: Article 22

text: , and, in particular, under

text: Article 22(1)

text: , the need for measures has to be analysed in light of the need to ensure a level of security appropriate to the “risks represented by the processing” of personal data performed by the EU institutions and bodies and the nature of the personal data processed. Explicitly mentioned are risks to confidentiality (unauthorised disclosure or access), integrity (unlawful … or accidental … alteration) and availability (accidental or unlawful destruction or accidental loss), but other risks also have to be considered (all other unlawful forms of processing). All the identified risks must be mitigated and thus appropriate security measures must be implemented. The ISRM must cover all manual or automated processing operations, and all factors of relevant risks posed by the processing, taking into account not only the systems more directly used for the processing but also infrastructural and environmental elements, such as physical security, energy supply/network, buildings access and other factors . Both paragraphs 22(1) and 22(2) underline the importance of risk management. They also indicate (see wording “in particular”) that the risks listed in paragraph 1 and the security objectives listed in subparagraphs 2(a) to (j) are to be considered in the context of the risk assessment and that these lists are neither exhaustive nor prescriptive. The list is not exhaustive because there may be additional risks not explicitly mentioned under

text: Article 22

text: , but still relevant for certain specific processing operation; and, it is not prescriptive since there may be security objectives which are only relevant for specific operations. Since paragraph 22(2) is not exhaustive, it cannot be relied upon as a check-list ensuring security of processing. Nonetheless, we see that the security objectives under

text: Article 22(2)

text: apply to all automated processing operations, and therefore as a rule the respective security controls need to be implemented (unless, in a given context, justification is provided and properly documented and approved by the management on why a specific item in the ‘

text: Article 22(2)

text: list’ does not raise the need for such security controls). In order to properly comply with the legal obligation under Article 22 of the Regulation and meet all the security objectives under letters (a)-(j) of

text: Article 22(2)

text: , EU institutions must always apply state of the art risk assessment and risk management.

text: Appropriate security measures can only be derived from this process of risk management.

text: Ultimately, management is accountable for the decisions to be taken according to the state of 14 the art and concerning in particular : - risk treatment (in broad terms, these decisions relate to whether accepting, reducing, transferring or avoiding risks), - the security measures selected and implemented to reduce the risks, and - the residual risks (i.e. the risks which remain after the implementation of the selected security measures).

text: 9 | P a g e

text: The Regulation (as other data protection legal instruments) refers to costs as a factor: this requires careful evaluation. A comprehensive cost-benefit analysis should be used to assess the security measures to be chosen, where appropriate also considering different options to be implemented. In practice, most security measures will serve more than one security objective and thus will create benefits for the EU institutions which go beyond compliance with data protection obligations (ensuring security in a broad sense, that is, also when personal data are not ‘at stake’). In other words the cost-benefit analysis should take into account such ‘synergies of benefits’ (costs must not be considered ‘in isolation’). Since threats, technologies, processes and other factors relevant for the risk assessment evolve constantly, it is necessary for EU institutions to regularly review their risk assessment and the selection of security measures. Thus, the EU institutions should implement a robust ISRM process covering the security risks on their processing of personal data over time. The ISRM process would provide the full set of justifications for and details on what security controls are implemented for a given data processing operation in the specific circumstances of the case.

text: 3 Implications for the EU Institution

text: Implementing a proper ISRM process implies at least the following: (1) Having management buy-in and approval on the ISRM process itself as well as providing guidance on the acceptable levels of risks. This also includes selecting an appropriate risk assessment methodology and applying it consistently. In order to ensure that the state of the art is taken into account, consideration should be given to recognised 16 standards for performing risk assessments. (2) Allocating resources to tackle all tasks related to ISRM. (3) Providing adequate training and awareness to staff on the existence and implementation of the ISRM process (including on the risk assessments and on the selected security controls). (4) Linking the ISRM process to other processes of the EU institution as appropriate. For example: (i) some processes such as security incident management (the procedure for the handling of security and data breaches) should feed the ISRM process; (ii) the ISRM process needs to adapt to the changing strategy laid out by management and to the overall organisation's risk management process . (5) Following risk assessments, analysing possible security measures and selecting the most appropriate ones based on security, data protection and needs. Furthermore, the implementation of the selected security controls, as the rest of the ISRM process, needs to be planned appropriately, involving all stakeholders as necessary. Stakeholders would typically include staff members having the following functions: the Information Security Officer, the Security Officer, the Data Protection Officer, the Documents Management Officer and other process owners, the project officers and any other decision makers

text: 10 | P a g e

text: (management). The Information Security Officer and the Data Protection Officer, specifically, should always be involved in the ISRM process. (6) Regularly reviewing all steps of the ISRM process, in the light of the changes to the operations and to the risks to information including personal data processed by the EU institution. This includes reviewing the implementation of security controls and their suitability in the light of technology and market developments, as well as taking into account the changes in the processing of personal data by the EU institution (for example, the starting of the processing of sensitive data). (7) Efficiently documenting all key steps of the ISRM process and making use of tools to ease the implementation of all steps of that process. (8) As quickly as possible, reviewing current security measures for existing processes and IT systems in order to align them with the appropriate risk assessments.

text: 4 Distribution of the main ISRM tasks

text: ISRM is a complex process covering all information processed by an organisation (including personal data) and requiring very specific expertise. Thus, several profiles would need to work together in order to ensure an optimal result. The tables below provide some guidance on which function should perform the main ISRM tasks. Depending on the exact definition of functions within an organisation, these allocation of tasks may vary.

text: Management

text: - Allocate resources for the ISRM - Provide input to build the ISRM framework - Approve all documentation related to the ISRM - Decide on the risk treatment - Agree to the residual risks - Support the implementation of security controls by allocating budget and resources - Take into consideration input from the Data Protection Officer with regards to the need for protection of personal data

text: Information Security Officer (typically LISO in the EU Institutions)/Security Officer

text: - Main responsible function for the ISRM - Document the ISRM - Iterate the ISRM process over time - Perform the Risk assessments - Draft all documents related to the ISRM - Present results to management - Implement management’s guidance/decisions on the ISRM - In light of the ISRM and management’s decisions, determine the most suitable security control - Follow up on the implementation of security controls - Provide training and raise awareness on all aspects related to the ISRM

text: 11 | P a g e

text: The Data Protection Officer

text: - Support the ISRM with his specific expertise on risks associated to personal data processing - Review ISRM documentation - Provide input as to the most suitable security controls when personal data is concerned - Discuss with Management the need to reduce risks related to the processing of personal data

text: Process owners and IT operations

text: - Support the ISRM process - Provide input for the ISRM and the risk assessments - Review ISRM documentation - Provide input as to the most suitable security controls in a given context - Implement the security controls

text: Done in Brussels, 21 March 2016

text: (Signed)

text: Wojciech Rafał WIEWIÓROWSKI

text: Assistant European Data Protection Supervisor

text: 12 | P a g e

text: 5 Glossary

text: Availability Property of being accessible and usable upon demand by an authorized entity Confidentiality Property that information is not made available or disclosed to unauthorized individuals, entities, or processes Control Measure that is modifying risk Control objective Statement describing what is to be achieved as a result of implementing controls Information security Preservation of confidentiality, integrity and availability of information Integrity Property of accuracy and completeness Level of risk Magnitude of a risk expressed in terms of the combination of consequences and their likelihood Residual risk Risk remaining after risk treatment Risk Effect of uncertainty on objectives Risk acceptance Informed decision to take a particular risk Risk analysis Process to comprehend the nature of risk and to determine the level of risk Risk assessment Overall process of risk identification, risk analysis and risk evaluation Risk communication Continual and iterative processes that an organization conducts to and consultation provide, share or obtain information, and to engage in dialogue with stakeholders regarding the management of risk Risk criteria Terms of reference against which the significance of risk is evaluated Risk evaluation Process of comparing the results of risk analysis with risk criteria to determine whether the risk and/or its magnitude is acceptable or tolerable Risk identification Process of finding, recognizing and describing risks Risk management Coordinated activities to direct and control an organization with regard to risk Risk management Systematic application of management policies, procedures and process practices to the activities of communicating, consulting, establishing the context and identifying, analysing, evaluating, treating, monitoring and reviewing risk Risk treatment Process to modify risk Threat Potential cause of an unwanted incident, which may result in harm to a system or organization Vulnerability Weakness of an asset or control that can be exploited by one or more threats

text: 13 | P a g e

type: vagledning

utgivare: edps