#14.1 Preliminary Remarks
GDPR provides legal grounds for industry organisations to devise, in the form of codes of practice, common rules for personal data processing in their business activity. The GDPR sees introduction of codes of conduct as a means of correct application of the GDPR, taking account of the specific nature of various sectors in which processing takes place and special needs of microenterprises and small and medium-sized enterprises. In turn, introducing certification, and consequently quality labels with respect to personal data protection, is meant to show that the certified businesses process personal data in compliance with the GDPR.
Certification processes have been known for a long time, and not only with regard to security. The obvious examples are of course ISO standards, for instance ISO 9000 and ISO 27000 standards families.
Self-regulation in different forms, including industry codes of practice, works better or worse in EU Member States. However, the option of creating industry codes of practice and certifying controllers and processors is a new development in data protection law.
This is a major change not only for data controllers and processors, i.e. entities subject to inspection, but also for the supervisory authorities themselves, which in addition to an inspection role might also be a certifying body.
#14.2 Codes of Conduct
#14.2.1 Drafting Codes of Conduct
Codes of conduct can be drawn up by business associations and ‘other bodies representing categories of controllers or processors’. For instance, these can be business associations, associations, chambers of commerce, and craftsmen associations.
Codes of conduct should be based on data protection best practice. There are certain practical issues with industry codes of conduct. First is that either they become an industry’s wish list hard to approve for a supervisory body or they are not touching real issues in order to facilitate acceptance. Second that they require to establish an effective monitoring body. Third that national codes of conduct are not automatically recognised in other Member States unless positively opined by the EDPB (or further adopted for the whole EU in a decision of the EC).
We are not getting into detail with code of conducts in this book. The EDPB issued in February 2019 guidelines for codes of conducts which give some basic insight allowing for building a checklist for a particular code of conduct mechanism. Though the GDPR is silent on the use of ISO standards in relation to codes of conduct, one may think of reaching to ISO quality management system rules (ISO 9000 family).
#14.2.2 Approval
A code of conduct is approved by a supervisory authority of a Member State. When a code of conduct is approved, it is published by the supervisory authority.
#14.3 Certification
#14.3.1 Certification Schemes
The GDPR allows for creating certification schemes in which supervisory authorities or other professional bodies can certify controllers and processors as personal data protection compliant and award the appropriate quality labels.
Certification means submitting to an audit of an external body to establish whether a personal data protection standard set by that body is complied with. If this test is passed, the organisation is authorised to use the specified quality label certifying that the specific data protection standard is met.
Therefore certification is a means of obtaining external confirmation of data protection compliance and obtaining recommendations on how to implement data protection.
The GDPR’s certification approach is built entirely on ISO 17000 standards family concerning conformity assessment. An accreditation standard EN-ISO/IEC 17065/2012 is directly named in Article 43(1)(b) GDPR. EDPB’s guidelines on accreditation and certification are based on the same as well.
#14.4 Benefits
Observance of an approved code of conduct or approved certification mechanism has many advantages. The benefits are not insignificant and are explained below, and this is an argument for treating certification and observance of codes of conduct seriously. They make it possible to demonstrate the appropriate level of security and that an organisation gives sufficient guarantees of implementation of the appropriate personal data protection measures. They make processing risk assessment and DPIA easier, constitute exonerating or mitigating circumstances for administrative fines, and simplify lawful data export (when the recipient has an approved code of conduct in place).
Under Article 32 GDPR:
Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk […].
Implementation of appropriate technical and organisational measures has a direct impact on responsibility of the controller in the event of a leak of data or inspection by the authority regulating personal data processing. Observance of an approved code of conduct or certification mechanism helps to prove that requirements are met with respect to use of the appropriate technical and organisation measures. In practice, this means the possibility of repudiating a potential fin in the millions.
Due to certification, it is also possible to demonstrate compliance with the principles of privacy by design and privacy by default.
Use of a graphic symbol confirming that personal data processing complies with the GDPR will be a factor that helps directly to build credibility and trust among customers, and this will certainly also be a contributing factor in good financial results of the organisation in question. For this reason, compliance with the GDPR should not be treated as compliance with yet another tiresome obligation (series of obligations). The necessity of compliance with the GDPR can be forged into something of financial benefit and beneficial for an organisation’s image.
We see also the following benefits:
- it is easier to share personal data under agreements on entrusting personal data processing – the signatories to the code of conduct will have the same security requirements and therefore meeting them means fulfilling requirements of all of the other organisations that apply the industry code of conduct in question;
- organisations do not hinder each other due to various, sometimes conflicting, security requirements – as in the preceding point, organisations that observe the code of conduct will have probably common requirements. This will mean significantly lower costs of implementing the security measures required under the GDPR;
- there is no need to reinvent the wheel – instead of devising your own best practices, which, for various reasons, not every organisation can afford to do, it is easier to obtain them from a trustworthy supplier.
These benefits described are arguments for observing industry codes of conduct and becoming certified.
#14.5 Private Certification
Using a recognised private certification mechanism, before the appropriate state authority or accredited certification systems are available, should also have substantial benefits. Certification is affirmation by a trustworthy organisation that a set of practices is employed that meets the standard. Using recognised certification is proof of due diligence because an additional verification mechanism has been used and also provides access to data protection know-how developed by experts, of course, if the certification scheme in question encompasses this.
#14.6 SMEs and Self-Certification
Current certification schemes are based on external audits requiring a lot of manpower. Therefore they are rather not available to micro, small or even medium enterprises, due to financial and organisational cost associated. There is however interesting far-reaching exception to the rule that a physical third-party audit is required for certification. The Privacy Shield allowing US businesses to declare compliance with the EU data protection rules is a so-called self-certification scheme. So, if self-certification is available to Americans of all sizes, why should not it be available to small local EU organisations? Self-certification for small and medium enterprises (SMEs) should consist not only on asking questions but also on providing default answers, as they do not have resources for studying and debating the GDPR intricacies for weeks or months. If left with questions only SMEs usually just take the risk and carry on their business as usual (maybe except for changing their privacy policies and information obligation forms). That is why we are fans of developing self-certification mechanisms for SMEs even if they would not be accredited by supervisory authorities.