- These environments are a guarantee for the re-use of sensitive data, in particular health data, since the data are processed without leaving a controlled environment
- Both authorities stress that the entity providing the environment must retain real and effective control, including where it relies on third parties
- The guide includes a risk analysis methodology together with a catalogue of measures, an analysis of data protection engineering techniques and a case study on health research developed in phases
The Ηellenic DPA and the Spanish Data Protection Agency (AEPD) jointly prepared and published the guide Secure Processing Environments from a Data Protection Perspective. The document was also reviewed by experts from Eurostat, the Italian Data Protection Authority (Garante per la protezione dei dati personali), the UK Information Commissioner’s Office (ICO) and the Directorate-General for Data of the Spanish Ministry for Digital Transformation and Public Administration. These experts provided valuable comments and suggestions that were taken into account during the finalisation of the document, enhancing the scientific comprehensiveness of the study and its international dimension.
Secure processing environments (SPEs) are infrastructures that allow protected or sensitive data, such as health data, to be accessed and processed without the user receiving or downloading them. They are a key component of the Data Governance Act and the European Health Data Space Regulation. The latter provides that access to health data for secondary use, for purposes such as research, innovation or policy-making, must necessarily take place through an SPE. For citizens, these environments are the guarantee that their health data can be re-used while protecting their rights and freedoms.
The guide offers guidance to controllers, data protection officers, advisers and third parties involved in the design, deployment and operation of these environments. The document stresses that an SPE relies on a set of legal, organisational and technical measures that goes beyond conventional cybersecurity, and that data protection principles must be built into it by design. It also explains that these environments make it possible to move from the traditional concept of sharing data, with the transfer of data that this entails, to that of accessing data, in which the user accesses the data without the need to transmit them.
One of the aspects highlighted by both Authorities is that the entity providing the SPE must have real and effective control over the infrastructure and the processing operations, even where the infrastructure is provided by a third party. Contractual guarantees or certifications are not sufficient on their own: they must be backed by technical measures, oversight and a genuine capacity to audit.
The guide also addresses comprehensive risk management, including dependence on providers and digital sovereignty. Such management must go beyond conventional cybersecurity and data protection risks, adopting an approach that also covers risks related to intellectual property, trade secrets or national security, among others. To this end, it puts forward a risk analysis methodology that combines the ten LIINE4DU threat categories with the Five Safes framework. The document also recalls that the data protection impact assessment (DPIA) is, as a general rule, mandatory for such processing operations.
Furthermore, the guide analyses data protection engineering techniques and includes a case study on health research.
The collaboration between the Hellenic and Spanish Data Protection Authorities, together with contributions from other european organisations, highlights the value of cooperation and the exchange of knowledge and experience in developing scientifically grounded guidance that can be used by data controllers, professionals, and other interested stakeholders to effectively protect personal data.
The Guide is available here
Ιndependent Department of Communication and Public Relations
