How to correctly implement the security measures required by the GDPR and the LOPDGDD (Supreme Court judgement of 15 February 2022)

It has been four months since the Judgment of the Supreme Court dated 15 February 2022, handed down following an appeal lodged by Auris Advocats, in which the High Court established case law on how data protection legislation should be interpreted in relation to the obligation to implement a series of security measures to protect the company’s information.

Numerous leading experts in the field of data protection have commented on this judgement, and there is unanimous agreement on its importance and the implications it has for ensuring the correct implementation of measures to guarantee that we will not face penalties should an incident occur and/or an inspection take place.

Let us recall that the main issue centred on whether the obligation to implement security measures to protect data was an obligation of means or an obligation of result. Whilst the Spanish Data Protection Agency, backed by the National High Court, maintained that it was an obligation of result (which meant that, however many measures the company put in place, it would be penalised without fail in the event of a data breach), Auris took the case all the way to the Supreme Court, arguing that it is an obligation of means and, therefore, if a breach occurs but the necessary measures have been correctly implemented, the company should not be penalised.

Although the Supreme Court fully accepted our reasoning in its judgement and took a clear stance in favour of the duty of care, it included three very important issues which must be taken into account when adopting the necessary measures:

1. – The Supreme Court confirms that it is not enough simply to put in place the necessary technical and organisational measures. Furthermore, It is essential that they are correctly implemented and used appropriately, so that the data controller will also be held liable for any lack of due care in their use.

If we relate this to one of the basic principles of the GDPR, namely the implementation of measures by design and by default, there can be no doubt that, in order to comply with the regulation, it is not enough simply to implement a series of security measures; rather, we must be able to demonstrate ongoing diligence through regular checks to ensure the measures are functioning, and document these checks. It will also be necessary to analyse, on a case-by-case basis, which measures are appropriate – not only technical measures, but also organisational, training and contractual measures.

2. The Supreme Court states that when we act as data processors (when we process data on behalf of third-party companies under a subcontracting arrangement), we must also implement the necessary technical and organisational measures to ensure the security of personal data, regardless of whether the system is imposed on us in its entirety by the data controller. The The Data Processor must also assess the tools provided or imposed by the Data Controller, must determine whether the system lacks adequate safeguards and, if this is the case, must refrain from using it or seek or promote alternatives.

When we opt to outsource services, or when we share data processing with a third party, it is very important to choose partners who guarantee adequate levels of compliance, because if one of them fails to comply and a data breach occurs, it is highly likely that all parties involved in the processing will be penalised.

3. It rules on the need to implement the system of double opt-in or email verification system, on the understanding that it is a double-check system which ensures that users have accepted the privacy policy before receiving any form of communication, thereby preventing the information from being sent to the wrong address. In short, it is a means of verifying that the information collected is accurate and truthful, which the Supreme Court considers necessary; failure to do so would constitute a breach of the duty of care as set out in the legislation.

All of the above means that companies must ask themselves whether they are doing things correctly and whether they are prepared in the event of a data breach and/or an inspection:

• Have I put the appropriate security measures (technical, organisational and training) in place?
• Can I provide evidence that I regularly check its effectiveness?
• What measures do my customers, employees or suppliers – with whom I share data processing – put in place?

At Auris, we have put together a compliance assessment questionnaire which may be of help: Access the questionnaire.

Questionnaires 3 and 4 relate to safety measures.