The fixed by the Organic Law on Protection of Personal Data of Spain establish different degrees that must be taken into account when handle information of natural persons.
For this reason, you need to know what those levels are and how you must comply with them, according to the LOPD. This information can be found in the following paragraphs of this post.
You will also be able to read an analysis related to the possibility of being penalized if you do not comply with current regulations. Pay attention and know all the legal aspects of cybersecurity.
What are the file security levels established by the LOPD?
The Organic Law on Protection of Personal Dataalso known by its acronym LOPD, is a Spanish law that was put into effect in its new version in 2018 and that regulates and protects the rights of people in terms of their privacy and social meaning. It is based on the Article 18 of the Spanish Constitution of ’78. In general terms, the Personal Data Protection Law states the precautions that the agencies and entities that handle the information of individuals must have.
That is, it must be complete, be available when required by the owner of the data or any other organization established by law, get only the amount of data needed to reach the goal and not save any longer of what corresponds once the task for which the data was needed has been completed. In case of not complying with the elements mentioned in the previous paragraph a fine of up to 600 thousand Euros can be applied.
To avoid this inconvenience due to lack of attention or other external issues, every time you want to save, share or destroy the documents that contain personal data a certain system must be chosen according to the security levels established by law. which can be basic, medium or high. That is, the law organizes 3 levels of security to consider that it correctly complies with the protection, delivery and destruction of the files that stored the data.
This is regulated in accordance with article 103 and successive of the regulation. This article establishes the bases to determine the criteria necessary to decide the level of security to use. It is in this section of the law where it is necessary to take into account what data is stored in the files. It is possible to find issues related to political ideologies, religion, sexual orientation and other types of beliefs held by individuals who submit their data to computer sites.
The three levels of data security What does each one consist of according to the LOPD?
As we mentioned before, the three levels of security that grants the LOPD are low, medium and high. Due to the importance of compliance with the regulations in order not to incur a mistake, it is necessary analyze each of these levels that must be fulfilled by the entities that keep personal information of individuals.
Next, we develop each one:
Bass
The organizations that safeguard the information in files They must have a basic level of security when data is transferred between different entities authorized by law. Among these data is, for example, address, ID or telephone number.
In order to comply with the implementation of the measures it is necessary that all personnel, who works in the company that protects the information, learn about the functions and obligations that exist regarding data protection. Also, it is necessary to keep a record or accounts up to date, this will allow any type of incident that has occurred in a given period to be notified. Finally, a backup copy should be carried out once a week.
Medium
As with many laws, this level must meet the basic security requirements mentioned abovebut also include additional rules of .
If you want to comply with the law, it is necessary to carry out the following type of control:
- Have a check-in and check-out of all the files that are saved in one place. To this must be added the name of the person in charge who takes out and delivers the folders from the place of control. There must also be a record of the person in charge of keeping the files.
- take notes with a detailed detail of the treatment of the files.
- Carry out surprise and planned audits. In this case, it is important to make the results known and explain the recommendations for the deviations found in this process.
To establish this level of security, it is necessary to include documents related to the following activities as data in the files:
- criminal offenses and administrative.
- economic solvency and property of the individual.
- tax administrations and any organization that exercises powers related to this issue.
- social security services, including work accidents and occupational diseases.
- Professionals or any person who performs and evaluates aspects personality related of the inhabitants of the national territory.
Tall
High security levels are related to files that deal with topics such as:
- Religion, racial origin, identity and sexual activity and union membership.
- Acts and facts that are related to gender violence.
- Files that collect data and police investigations.
For this reason, in order to comply with the requirements established by law, it is necessary have previous security levels and add other measures much more efficient for protection.
Among these techniques are:
- Data encryption keep a significant number of backupswhich must be stored on different computers that are protected with video cameras and authorized personnel.
- Keep the record of people entering the data for 2 years. This information must be saved and backed up with a backup made once a month.
- Have a fire control and protection systemfloods and any other type of natural catastrophe.
- In those data that cannot be backed up digitally, you must make one or more copies and keep them in a safe place by personnel who are trained to handle these files.
Can I be sanctioned if I do not comply with this regulation?
If the legal provisions established in the Organic Law on Protection of Personal Data the organizations that handle personal data may receive civil and criminal sentences. Therefore, it must be answered with the patrimony and with prison sentences. The sanctions will depend on the degree of non-compliance with the security level and its recurrence.
The amount of sanctions stipulated by law are classified as:
- Mild: from €900 to €40,000
- Serious: up to €300,000
- Very serious: You can pay up to 600 thousand Euros.
Facebook Comments
Disqus