GDPR: Applied Security vs Employee Contracts
<p>An Organisation has 10,000 employees.
All 10,000 employees have unrestricted access to ALL Customer PII data stored by the Organisation.
Only 200 employees require access to the PII data for the purpose of their Job.</p>

<p>The 10,000 employee contracts cover an agreement with the Organisation that the Employee will not abuse any PII data.</p>

<p>Does the contract protect the Organisation, removing the need to implement Technical measures to restrict data access to the relevant 200 employees?</p>

<h2>Almost surely not</h2>

<p>It is difficult to see how this meets the “secure by design” and “accountability” requirements of the directive. </p>

<p>A system that allows <em>unnecessary</em> organisation wide access to PII (particularly unencrypted PII) is <em>prima facie</em> not “secure by design”.</p>

<p>Similarly, if a data breach occurs, say by a disgruntled loading dock employee copying it to a USB key and uploading it at home, where is the “accountability”? Finding a leak among 10,000 people is way harder than among 200.</p>

data-protection gdpr