On July 18, 2017, Italy's Data Protection Authority (Garante per la Privacy) clarified, through an important press release, a doubt regarding the concept of "Certifications" envisaged in art. 42 and 43 of the new General Data Protection Regulation, making for the first time clarity on an important doubt: data protection certifications currently present on the Italian market are NOT compliant with art. 42 and 43 GDPR. This article will explain you why.
The Garante's Clarification
Since the publication of the GDPR in the Official Journal of the European Union in 2016, many companies had begun to propose non-reliable GDPR compliance models to other companies under the name of "certifications".
So the first question is:
Who is the subject responsible in issuing GDPR certifications?
The Garante clarifies that the subjects eligible to issue certifications in Italy are the Italian Data Protection Authority (DPA) or the Certification Organisms. The latter may be accredited by the same Italy DPA or by the national accreditation body (for Italy, ACCREDIA), following the requirements identified in ISO/IEC 17065:2012 and "Additional Requirements" which are to be identified by the Garante.
Certification bodies and Italy's DPA can then issue certifications. However, these need to follow some "certification criteria" (as demanded in art. 42(5) GDPR) which must be as well identified by the Garante.
The Ultimate Guide on GDPR and HIPAA compliance
The Garante has distanced itself from entities or companies that offered certifications to businesses, and this is for two reasons (as you can see as well in the schema):
- We still miss the "Additional requirements" necessary to accredit Certification Bodies (pursuant to art. 43(1)(b)). They still need to beidentified by the Garante.
- We still miss the "Certification Criteria" necessary to issue certifications pursuant to art. 42(5) GDPR (both from the DPA and Certification Bodies). They still need to be identified by the same Garante.
This is the reason why certification currently issued on GDPR compliance are not effectively compliant with GDPR.
The following months will be crucial to define these missing requirements, and the Garante is working together with other European DPA in order to define them.