Integrity and Confidentiality (Article 5(1)(f) GDPR)

Article 5(1)(f) GDPR elevates data security to the rank of a principle. The provision requires that personal data be processed in a manner that "ensures appropriate security of the personal data". It identifies two objectives which the measures must serve: integrity and confidentiality.

1 Overview

1.1 The two protection objectives

• Integrity denotes protection of the intactness of the data. Data must not be erased, destroyed or altered, in whole or in part, without authorization.
• Confidentiality denotes protection against unauthorized knowledge of the data and thus against unauthorized processing by third parties.

The principle covers not only deliberate interference but expressly also accidental loss, accidental destruction and accidental damage. It therefore extends to matters such as operator error, hardware failure and natural events.

1.2 Relationship to Article 32 GDPR

The principle is given concrete shape by Article 32 GDPR. Article 32(1) GDPR obliges controllers and processors to implement appropriate technical and organizational measures ensuring a level of security appropriate to the risk. Under Article 32(1)(b) GDPR, ensuring the confidentiality, integrity, availability and resilience of the systems is among the central protection objectives.

1.3 Legal consequence

An infringement of the principle renders the processing unlawful and may attract an administrative fine under Article 83(5)(a) GDPR; in addition, the notification obligations under Articles 33 and 34 GDPR may apply where there has been a personal data breach.

2 The standard of "appropriate" security

2.1 Risk-based approach

Whether the security measures are appropriate depends on the circumstances of the processing. The decisive factors are:

• the risk of unauthorized access,
• the nature, scope and context of the processing (CJEU, judgment of 8 April 2014, C-293/12, C-594/12, Digital Rights Ireland, paras. 54 et seq.),
• the significance of the data for the rights and interests of the data subjects.

Where financial data, data concerning health or other special categories of personal data under Article 9(1) GDPR are involved, the need for protection is heightened. Correspondingly higher requirements are to be imposed on encryption, access controls and logging.

2.2 Access to data and equipment

Recital 39, twelfth sentence, GDPR requires that unauthorized persons obtain neither "access to or use of personal data" nor access to "the equipment used for the processing". The principle thus covers both logical security (authentication, authorization concepts) and physical security (premises, hardware, storage media).

3 Relationship to further obligations

Article 5(1)(f) GDPR interlocks with a range of further obligations under the GDPR:

• Data protection by design (Article 25 GDPR): the security principles must be taken into account as early as the selection and design of the processing systems.
• Processing on behalf of a controller (Article 28 GDPR): the processor must provide sufficient guarantees as to the security of its processing.
• Notification and communication (Articles 33 and 34 GDPR): where the protection of personal data is breached, obligations to notify and, where applicable, to communicate arise.
• Data protection impact assessment (Article 35 GDPR): for high-risk processing operations, the security concept forms part of the assessment.