Privacy & Information Security Law Blog

On April 2, 2020, the French Data Protection Authority (the “CNIL”) published a press release highlighting the importance of the ISO/IEC 27701 standard for the protection of personal data. The CNIL reminds that this is an international standard that defines the management system and security measures that need to be implemented for the processing of personal data (“personally identifiable information” under the ISO/IEC 27701 standard), by extending the requirements of two well-known information security standards.

Background

The ISO/IEC 27701 standard was published in August 2019, and is based on the following ISO information security standards:

• ISO/IEC 27001 that certifies an Information Security Management System (“ISMS”); and
• ISO/IEC 27002 that details best practices for implementing necessary security measures.

The ISO/IEC 27701 standard extends the requirements and guidance of these information security standards to take into account the protection of personal data.

ISO/IEC 27701 Requirements

For the purposes of standardizing and strengthening the protection of personal data, the ISO/IEC 27701 standard extends the ISMS to cover the specificities of the processing of personal data. Key specificities include:

• Determination of the role of the organization as a data controller and/or data processor;
• Unified management of IT risks for the organization and of privacy risks for the individuals concerned;
• Appointment of a person responsible for the protection of privacy (the data protection officer in the context of the ISO/IEC 27701 standard);
• Staff awareness;
• Data classification;
• Protection of removable media;
• User access management and data encryption;
• Backups and event logging;
• Conditions for the transfer of personal data;
• Privacy by design and by default;
• Incident management; and
• Compliance with legal and regulatory requirements, etc.

The ISO/IEC 27701 standard also provides specific measures for the processing of personal data, taking into account the role of the organization as a data controller, data processor or sub-processor. This includes the following measures or aspects:

• Fundamental Data Protection Principles: purpose of the data processing, legal basis for the data processing, obtaining individuals’ consent and mechanisms to modify or withdraw that consent, records of data processing activities, and privacy impact assessments;
• Individuals’ Data Protection Rights: notice, access, correction, erasure, and automated decisions;
• Privacy By Design and by Default: data minimization, de-identification and deletion, and data retention; and
• Data processing agreements, data transfers and data sharing.

A Global Standard Representing the State of the Art in Privacy Protection

The CNIL stresses that the ISO/IEC 27701 standard is a truly global standard. It was drafted at an international level with contributions from experts from all continents and the participation of many data protection authorities. The EU General Data Protection Regulation (“GDPR”) and other major data protection laws (such as those adopted in Australia, Brazil, California and Canada) were taken into account when drafting the standard. In particular, the ICO/IEC 27701 standard pays special attention to the GDPR, as demonstrated by Annex D of that standard, which maps each clause of the standard against the corresponding GDPR article. That said, the CNIL highlights that the ISO/IEC 27701 standard is not specific to the GDPR and does not therefore constitute a certification instrument within the meaning of Article 42 of the GDPR. Instead, the ISO/IEC 27701 standard represents the state of the art in the protection of privacy. In the CNIL’s view, the standard allows organizations who adopt it to increase the level of maturity of their data protection compliance program and demonstrate a proactive approach to the protection of personal data.