Access Controls

Legal Framework

Access controls fall under the GDPR's security obligations, primarily Article 32(1)(b) GDPR, which requires controllers and processors to implement appropriate technical and organizational measures, including the ability to ensure ongoing confidentiality, integrity, availability, and resilience. Article 5(1)(f) GDPR reinforces this by requiring appropriate security of personal data. Article 25 GDPR mandates data protection by design and by default, meaning access rights must be limited to what is strictly necessary. The AI Act further intersects with access management where biometric data is used for authentication. Recital 14 of the AI Act aligns its definition of biometric data with Article 4(14) GDPR, encompassing data enabling authentication, identification, or categorization of individuals. Recital 15 specifies that biometric identification involves automated recognition of physical, physiological, or behavioral features for establishing identity by comparison to a reference database.

Key Developments

Enforcement actions demonstrate that inadequate access controls constitute a severe security failure. The French DPA fined Free Mobile €27,000,000 after a data breach caused by insufficient technical and organizational measures. Similarly, the Romanian DPA fined Genpact Romania €10,000 following a cyber attack exploiting insufficient technical safeguards. These cases establish that access management is not merely a best practice but a core compliance requirement with substantial financial exposure.

Dutch case law clarifies the operational standards for access controls during data subject access requests. In cases involving the police and the AIVD, courts upheld searches conducted by personnel with high authorization privileges, emphasizing that the authorization level of the employee performing the search is a critical factor in assessing adequacy. In a university case, the court scrutinized the detailed search plan across multiple systems, requiring clear documentation of which systems were accessed and by whom. In a healthcare context, a court approved the creation of a temporary guest account with full access to a patient dossier for an external expert, illustrating that access controls must accommodate legitimate third-party access while maintaining oversight.

Practical Guidance

• Implement role-based access control (RBAC): Ensure access rights are strictly limited to the data necessary for each employee's function, consistent with Article 5(1)(c) and Article 32 GDPR. The Free Mobile and Genpact fines show that broad or unmonitored access invites enforcement.
• Verify authorization for sensitive searches: When responding to data subject access requests, assign personnel with appropriate authorization levels and document their credentials. Dutch case law confirms that the authorization level of the searcher is a key determinant of search adequacy.
• Establish documented search protocols: Create a plan of action for data searches that specifies which systems, databases, and archives will be queried. Courts expect transparency regarding the scope and methodology of searches.
• Manage third-party access securely: Where external parties require access to personal data (e.g., medical experts), use dedicated accounts with defined permissions and time-limited access, as demonstrated in the UMCG patient dossier case.
• Apply heightened scrutiny to biometric authentication: Where biometric data is used for access control, ensure compliance with both GDPR Article 4(14) and AI Act Recitals 14 and 15, recognizing that biometric authentication triggers specific legal obligations regarding the processing of special category data.