Protecting the Unprotectable: Navigating Sensitive Data under GDPR

In today’s digital age, the concept of personal data protection has taken on a new level of importance. With the proliferation of online services, social media, cloud storage, and digital communications, sensitive personal information is more vulnerable than ever before. Organisations must now navigate a complex landscape of laws, regulations, and standards to ensure that they handle personal data appropriately. Chief among these regulations is the General Data Protection Regulation (GDPR), a transformative piece of legislation that came into effect in May 2018.

The GDPR was established to protect the privacy and rights of European Union (EU) citizens, requiring organisations that handle personal data to adopt stringent safeguards. Among its provisions, GDPR places a special emphasis on the handling of “sensitive data”, which refers to a specific category of personal data that demands heightened protection. However, despite the GDPR’s clear guidelines and strict penalties, protecting sensitive data has proven to be one of the most challenging aspects of compliance, earning the designation of being seemingly “unprotectable”.

This article delves deep into the intricacies of protecting sensitive data under GDPR, offering insights into the nature of this data, the challenges faced by organisations, and strategies to navigate the complex regulatory landscape effectively.

Understanding Sensitive Data under GDPR

GDPR categorises personal data into two broad categories: “personal data” and “sensitive personal data”. Personal data includes any information that can directly or indirectly identify an individual, such as names, identification numbers, location data, and online identifiers. Sensitive personal data, on the other hand, refers to information that is more intimate and potentially harmful to an individual if misused or exposed.

Sensitive personal data, according to Article 9 of GDPR, includes:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data (for the purpose of uniquely identifying a natural person)
• Health data
• Data concerning a person’s sex life or sexual orientation

These categories of data are subject to stricter controls because of their potential to cause significant harm if misused or improperly disclosed. Breaches involving sensitive personal data can lead to identity theft, discrimination, reputational damage, and even physical harm. As such, GDPR demands that organisations implement robust technical and organisational measures to protect this data.

The Challenges of Protecting Sensitive Data

Protecting sensitive data under GDPR is not a simple task, and organisations face a multitude of challenges in achieving compliance. Some of the most prominent challenges include:

1. Data Proliferation and Fragmentation

In today’s interconnected world, personal data is generated and stored in multiple locations, often across different systems, platforms, and geographies. Organisations frequently use cloud services, third-party vendors, and external databases, which results in the fragmentation of sensitive data. Managing this data in such a distributed environment makes it difficult to keep track of who has access, how it is being processed, and where it is stored. Ensuring data protection across all these touchpoints is an immense challenge for compliance teams.

2. Legacy Systems

Many organisations still operate with legacy systems that were not designed with data protection or GDPR compliance in mind. These systems often lack the technical capabilities to safeguard sensitive personal data, such as encryption or advanced access controls. Upgrading or replacing these systems can be costly and time-consuming, and in some cases, may not be feasible without significant disruption to business operations.

3. Data Minimisation vs. Business Needs

The GDPR enforces the principle of data minimisation, which requires organisations to collect and retain only the minimum amount of personal data necessary for a specific purpose. However, this principle often conflicts with business needs. Many organisations rely on data analytics and customer insights to inform decision-making, marketing strategies, and service offerings. Balancing the need for data-driven insights with the requirement to limit the amount of sensitive personal data collected is a delicate and ongoing struggle for many businesses.

4. Human Error and Insider Threats

Even the most secure technical systems can be undermined by human error or malicious insiders. Employees may unintentionally mishandle sensitive data, such as sending it to the wrong recipient or storing it in an unsecure location. Furthermore, malicious insiders may abuse their access privileges to steal or exploit sensitive data for personal gain. Addressing these risks requires a combination of technical safeguards, employee training, and strong organisational policies.

5. Cross-border Data Transfers

Many organisations operate globally, which means they frequently need to transfer personal data across international borders. However, GDPR imposes strict rules on the transfer of personal data to countries outside the EU/European Economic Area (EEA) that do not provide an adequate level of data protection. Navigating the complexities of cross-border data transfers and ensuring compliance with GDPR requirements, such as the use of Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs), can be a daunting task for organisations.

Key GDPR Requirements for Sensitive Data

To navigate the challenges of protecting sensitive personal data, organisations must adhere to several key GDPR requirements. While the full scope of GDPR is vast, the following are some of the most critical obligations related to sensitive data:

1. Lawful Basis for Processing Sensitive Data

GDPR requires organisations to have a lawful basis for processing personal data, and this requirement is even stricter for sensitive data. In addition to one of the general lawful bases (such as consent, contract, legal obligation, etc.), organisations must also meet one of the specific conditions outlined in Article 9 for processing sensitive data. These conditions include explicit consent from the data subject, compliance with employment laws, protection of vital interests, or processing for public interest, among others.

2. Data Protection by Design and by Default

GDPR mandates that organisations implement “data protection by design and by default”. This means that data protection measures should be integrated into every aspect of the organisation’s operations from the very beginning, rather than being added as an afterthought. For sensitive data, this might involve encrypting data at rest and in transit, limiting access to authorised personnel, and ensuring that sensitive data is anonymised or pseudonymised wherever possible.

3. Data Subject Rights

Under GDPR, individuals (data subjects) have a range of rights that organisations must respect, including the right to access, rectify, erase, and restrict the processing of their personal data. When it comes to sensitive data, these rights become even more critical, as the exposure of this data could cause significant harm to the individual. Organisations must have processes in place to respond to data subject requests promptly and in compliance with GDPR requirements.

4. Data Breach Notification

In the event of a data breach involving sensitive personal data, organisations have an obligation to notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to the rights and freedoms of individuals, the organisation must also inform the affected individuals without undue delay. This means that organisations must have robust incident response plans in place to detect, contain, and report breaches quickly.

5. Record Keeping and Accountability

GDPR places a strong emphasis on accountability, requiring organisations to demonstrate their compliance with the regulation. This includes maintaining detailed records of data processing activities, conducting data protection impact assessments (DPIAs) when processing sensitive data, and appointing a Data Protection Officer (DPO) if necessary. Failure to comply with these obligations can result in significant fines and reputational damage.

Strategies for Protecting Sensitive Data under GDPR

Given the challenges and complexities involved, how can organisations effectively protect sensitive data under GDPR? While there is no one-size-fits-all solution, there are several strategies and best practices that organisations can adopt to improve their data protection posture:

1. Conduct Data Mapping and Audits

The first step in protecting sensitive data is knowing where it resides. Organisations should conduct comprehensive data mapping exercises to identify where sensitive personal data is stored, how it is being processed, and who has access to it. Regular data audits should also be performed to ensure that data protection measures are being followed and to identify any areas of non-compliance.

2. Implement Robust Encryption and Access Controls

One of the most effective ways to protect sensitive data is through encryption. Organisations should encrypt sensitive data both at rest and in transit to ensure that it cannot be accessed or read by unauthorised individuals, even in the event of a breach. Additionally, strong access controls should be implemented to restrict access to sensitive data to only those employees or systems that require it for legitimate business purposes.

3. Invest in Employee Training

Human error is one of the leading causes of data breaches, so it is essential that employees are trained on GDPR requirements and best practices for handling sensitive data. Regular training sessions should be conducted to ensure that employees understand their responsibilities, recognise potential risks, and know how to report suspicious activities or incidents. Training should also focus on preventing insider threats and ensuring that employees are aware of the consequences of mishandling sensitive data.

4. Utilise Data Anonymisation and Pseudonymisation

Whenever possible, organisations should anonymise or pseudonymise sensitive data. Anonymisation involves removing all identifying information from the data so that it cannot be linked back to an individual, while pseudonymisation involves replacing identifiable information with pseudonyms or codes. These techniques reduce the risk of harm in the event of a data breach, as the data would be rendered useless without the corresponding identifying information.

5. Adopt Privacy-enhancing Technologies (PETs)

Privacy-enhancing technologies (PETs) are tools and techniques designed to enhance privacy and data protection. These can include encryption, anonymisation, tokenisation, and secure multi-party computation, among others. By adopting PETs, organisations can better protect sensitive data while still allowing for necessary data processing and analysis.

6. Engage in Continuous Monitoring and Incident Response

Protecting sensitive data requires constant vigilance. Organisations should implement continuous monitoring of their systems and networks to detect any potential security threats or breaches. Additionally, they should have a well-defined incident response plan in place to respond quickly and effectively to data breaches, minimising the impact on individuals and ensuring that regulatory requirements are met.

7. Collaborate with Third Parties and Vendors

Many organisations rely on third-party vendors to process or store sensitive data. It is essential that these vendors comply with GDPR requirements and implement adequate security measures to protect the data. Organisations should conduct due diligence when selecting vendors and include GDPR-compliant clauses in contracts to ensure that third parties are held accountable for protecting sensitive data.

Conclusion

Navigating the complexities of sensitive data protection under GDPR is no small task. However, by understanding the nature of sensitive data, adhering to GDPR’s requirements, and implementing best practices for data protection, organisations can significantly reduce the risk of data breaches and ensure that they remain compliant with the regulation.

GDPR has raised the bar for data protection, and as the digital landscape continues to evolve, organisations must remain proactive in their efforts to protect sensitive data. While the challenges are significant, the potential consequences of non-compliance are far greater, both in terms of financial penalties and reputational damage. By adopting a comprehensive approach to data protection, organisations can safeguard the unprotectable and navigate the complexities of sensitive data under GDPR with confidence.