Adding Safeguards to DPV

[coolharsh55]

How and where to model Safeguard as a concept within the DPV.

[coolharsh55]

References for consideration:

• Meeting Notes 2021-06-30
• Wikipedia entry on Safeguard as under International Law
• HIPAA and Technical Safeguards (PDF)
• HIPAA and Technical Safeguards article
• GDPR Art.46 Data Transfer Safeguards

[coolharsh55]

Note that DPV now contains safeguards as a concept, as well as the data transfer safeguards from GDPR. A review of their sufficiency is to be undertaken and its outcome to determine closing of this issue.

[Paul-Ryan76]

Reviewed this topic ,

From A GDPR perspective need to model the appropriate safeguards from Article 46

Appropriate safeguards
a) Legally enforceable instrument
b) Binding corporate rules
c) Standard clauses adopted by commission
d) Standard clauses adopted by Supervisory authority
e) Code of conduct
f) Certification

We also need to consider adding in Transfer Impact assessment and Supplementary measures, which are part of any international transfer to a non-adequate country

I looked at HIPPA safeguards and they mainly relate to Technical and Organisational measures. I t believe we have sufficient coverage in that area

[coolharsh55]

a) Legally enforceable instrument
b) Binding corporate rules
c) Standard clauses adopted by commission
d) Standard clauses adopted by Supervisory authority
e) Code of conduct
f) Certification

Thanks Paul. From that list, what concepts are missing in DPV? I think we have all of them (across DPV + DPV-GDPR)

Also please note that "Supplementary Measures" doesn't have a definition by itself, and instead is what we use to refer to additional TOMs to safeguard the data. And because the term is EU-specific, I would not create a separate concept with that label since Safeguard/RiskMitigationMeasure also has the same role.

[Paul-Ryan76]

Agreed, I confirm that DPV-GDPR contains items a to F

[coolharsh55]

Thanks, closing the issue as completed.