A municipal contractor takes printed citizen case files home overnight to finish work. Leadership calls it harmless because the files never left paper form. Which response best reflects GDPR security of personal data expectations?
Select an answer to reveal the explanation.
Short Explanation
Paper is still personal data—think of it like leaving a stack of medical charts on the subway seat. GDPR security is not a digital-only club. Physical custody rules, locked storage, and 'don't take case files home' controls matter just as much as encryption.
Full Explanation
GDPR security obligations under Article 32 require appropriate technical and organisational measures for personal data, including personal data on paper. A municipal contractor taking citizen case files home overnight remains within the Regulation’s material scope: filing format does not remove confidentiality or integrity duties. The correct response is therefore to require physical and organisational safeguards—secure storage, controlled transport, and clear rules against unsupervised removal—scaled to the sensitivity of the files and the risk of loss or disclosure.
Treating paper as outside GDPR fails the material-scope concept: non-automated filing systems that form part of a filing system can still involve personal data processing. A one-line confidentiality email after the fact is not a substitute for prior, enforceable custody controls and does not cure unauthorised removal. Relying only on year-end shredding ignores interim custody risk—the period when lost or left-behind files most often harm residents.
Exam caveat: “electronic only” is a common trap; GDPR is not limited to IT systems when filing-system personal data are processed. Operational check: update contractor instructions and contracts, lock cabinets or sealed transport bags, log removals, prohibit unsupervised home storage unless a documented exception with compensating controls exists, and spot-check compliance. In civic administration, physical handling of citizen case files is a public-trust control: residents reasonably expect the city to protect their papers with the same seriousness as digital records, and supervisors should record why weaker custody options were rejected.