Ignacio Orts (EVERIS)<\/em><\/p>\n <\/p>\n When creating a website, privacy and security should be taken into account. Both dimensions are highly connected and it is important to bear them in mind when an individual (in this case, a Researcher) or an organization (e.g. universities, private organizations, etc.) is going to create a website.<\/p>\n For this section, it is going to be assumed that the researcher does not have any knowledge of development, privacy, or security. Therefore, this section is going to be written attending to two different situations:<\/p>\n In both cases, privacy and security are difficult to implement when third parties are involved. For this reason, the researcher must acquire knowledge in both dimensions in order to avoid infringing data protection Laws.<\/p>\n The main objective of this section will be to provide enough awareness about the main topics related to privacy and security at the moment of creating a website.<\/p>\n The Regulation which is going to guide this section is the REGULATION (EU) 2016\/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (hereinafter, GDPR) together with DIRECTIVE 2002\/58\/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (hereinafter, e-Privacy<\/span> Directive)<\/p>\n e-Privacy<\/span> Directive affects to a website, mainly, in to aspects:<\/p>\n Going back to the website, the process starts when the Researcher decides to create one, which represents the first milestone, namely \u201cdesign phase\u201d. In line with the GDPR, we can say that this design phase is where we must ensure compliance, which is not a recommendation but an obligation of Article 25 of GDPR: Data Protection by Design and by Default.<\/p>\n This concept was a bit confusing when the GDPR came into force on 25th<\/sup> May, 2018, but Data Protection Authorities (hereinafter, DPA) have been enlightening organizations in relation to what this obligation entails.<\/p>\n In short, Data Protection by design and by default consists in this case in applying the necessary guarantees from an initial phase (design of the website) if personal data are going to be processed. These guarantees pervade all GDPR principles. In this case, it is the controller (when applicable, researcher\/university\/other organizations where the researcher works) who has the obligation to comply with this Article and ensure compliance with all GDPR principles. We have a very good example with the Spanish DPA, who has developed a guideline[1]<\/a><\/sup><\/sup>.<\/p>\n Each principle derives in specific measures which we are going to be analyzed in this section.<\/p>\n Within this principle we can differentiate two parts: Lawfulness and fairness on the one hand, and transparency on the other.<\/p>\n Lawfulness and fairness<\/strong>:<\/p>\n This principle implies that personal data can be processed if at least one of the legal bases[2]<\/a><\/sup><\/sup> identified in Article 6 of the GDPR applies. In the case of websites, normally[3]<\/a><\/sup><\/sup>, these requirements mean that it is necessary to obtain consent from the data subject.<\/p>\n If consent is required, the next website areas, among others, are normally the ones that require implementing an action in order to comply with the Regulation:<\/p>\n Consent requires an affirmative and positive action from the data subject (for example, clicking a checkbox accepting to share personal data with the researcher) but also requires being informed (developed later on here) and giving it freely. Freely given means that the options given to the data subject cannot be remarked, highlighted or in another way where benefits the process of these data.<\/p>\n As a requirement of the GDPR (Art. 7), the Researcher will need to keep a record of the consents [4]<\/a><\/sup><\/sup>gathered on this website, but also demonstrate compliance with the other requirements: informed, freely given, and unambiguous (Recital 32 together with Art. 7).<\/p>\n Consent must be proportional to the purpose for which the activity is carried out; it has to be specific. Giving consent to different purposes that bear no relation to one another fails to comply with GDPR requirements.<\/p>\n In the event that the research activity involves children, it is important to bear in mind that the GDPR establishes digital consent as the requirement for children when they are at least 16 years old (Art. 8). This Article can be modified by each Member State of the European Economic Area (hereinafter, EEA), so the Researcher must take into consideration local Data Protection Laws for this situation.<\/p>\n Anyway, when personal data are collected from children who are below the minimum digital age to consent to processing of personal data, parents or legal guardians must give consent on their behalf.<\/p>\n Transparency<\/span>:<\/strong><\/p>\n The GDPR establishes strong requirements about the information that must be given when personal data are gathered and processed. These requirements are stated in Art. 13[5]<\/a><\/sup><\/sup> and 14 when personal data comes from public sources, which can be an important source for Researchers to obtain personal data for their activities. Nevertheless, for the case of gathering personal data through a website, Art. 13 will be the one applicable.<\/p>\n The common way to do this is by introducing a link to the privacy policy when consent is gathered due to the requirements already mentioned. Also, if possible, include a checkbox stating that the data subject has read the privacy policy, or ensure that the privacy policy should appear as a pop-up window when the data subject positions the mouse pointer over the consent checkbox.<\/p>\n Going back to the transparency principle, which is closely linked to the duty to inform, it is important for the Researcher to understand that the information must be given in a way that is easy to understand; this means that an average user must be able to clearly understand what is going to be done with their data. Using user-friendly language helps to reach this requirement, together with graphics or pictures, even videos.<\/p>\n In addition, information must be easily accessible for data subjects. If the information is \u201chidden\u201d or the data subject has to click on several sections to reach this information, the website will not be transparent about what is being done with personal data at the time they are processed.<\/p>\n Purpose limitation<\/span> means that personal data cannot be processed for purposes other than the ones stipulated in the privacy policy when the data were collected, unless these purposes correspond to archiving activities of public interest, purposes of scientific and historical research or statistical purposes.<\/p>\n If the Researcher falls within the exemption of archiving activities of public interest, purposes of scientific and historical research or statistical purposes, it does not entail an exemption to comply with the transparency principle in line with the duty to inform. The Researcher must indicate in the privacy policy, if they perform these activities that the main purposes of the processing activities may change to the ones already mentioned.<\/p>\n Based on the different actions named in previous section 4.2.1, the following purposes can be identified:<\/p>\n These purposes will be applied to one or more processing activities. A processing activity is any operation or set of operations which is performed on personal data or on sets of personal data; therefore, we can group the aforementioned purposes in one processing activity: website management. This name is an example and the Researcher can name the processing activity as desired.<\/p>\n Data minimization requires not processing more personal data than necessary to fulfil the different purposes of the processing activity or activities identified.<\/p>\n As guidance to comply with the data minimization principle, three questions can be asked to help Researchers to perform a brief assessment:<\/p>\n By answering these questions, the Researcher will solely see if the minimization requirement is fulfilled or not; if the above questions are answered affirmatively, the Researcher must ultimately find out which personal data are strictly needed to fulfil the purposes identified.<\/p>\n In addition to this, the most common source where data minimization could be not fulfilled is at open fields: for example, from the contact section, anyone can send as many personal data as they want to the Researcher. This entails a risk, because these personal data will also be stored and maintained during the processing activity and once it\u2019s ended. The recommendation here is to avoid as much as possible open fields and only use closed fields to gather personal data.<\/p>\n This principle states that when personal data are collected they have to be accurate and, where necessary, kept up to date. In practice, ensuring compliance with this principle seems a difficult task.<\/p>\n Data quality<\/span> can be preserved using technology (e.g. data analytics), requiring extensive efforts in order to achieve compliance with this principle. For this reason, the Researcher should also bear in mind that this principle applies only when data are going to be processed (accuracy does not have to be ensured all the time), and to make this happen, there are two recommendations:<\/p>\n These two tips will give the Researcher an easy way to comply with this principle.<\/p>\n The storage limitation principle requires that personal data not be stored longer than needed to fulfil the purposes of the processing activities identified. In addition to this, the Researcher can store personal data longer than needed if they are processed for archiving activities of public interest, purposes of scientific and historical research or statistical purposes.<\/p>\n Also, different Regulations can affect the storage of personal data, such as tax obligations or criminal laws. If none of these legal obligations or other exemptions to these principles operate, the Researcher will need to define a retention period for personal data in line with the proportionality of the purposes pursued.<\/p>\n For the common purposes and processing activities already identified in this section (website management), the recommendation will be to not store personal data for longer periods; besides, this information should be deleted once the purpose is fulfilled. In case that personal data is used for research activities, the recommendation is to transform personal data to aggregated data (using de-identification protocols such as anonymization) where the GDPR does not apply, since aggregated data are not personal data.<\/p>\n Lastly, the Researcher must be aware that, if personal data are shared with third parties, they have the obligation to delete the data once the professional relationship ends. Additionally, backup policies from different solutions such as Microsoft OneDrive should be reviewed in order to ensure that data are deleted. Backups may store these data without the knowledge of the Researcher.<\/p>\n In this section, we define some cybersecurity recommendations to bear in mind at the time of creating a website.<\/p>\n First, it is necessary to differentiate between cybersecurity and information security, which is a common mistake. Information Security <\/strong>deals with the processes and methodologies designed to protect any information, regardless of its format. Cybersecurity<\/strong>, on the other hand, is concerned with protecting digital assets; everything encompassing network hardware, software and information that is processed, stored within systems or transported by internetworked information environments.<\/p>\n About the aforementioned terms, we can say that information security is part of a broad concept of cybersecurity. In this sense, we also need to safeguard cybersecurity in order to protect all the assets involved during the processing of personal data and grant a secure environment. Nevertheless, in the world of information security and cybersecurity, we cannot affirm that we are completely safe or that the risk of materialization of a threat or event that may harm our assets is 0.<\/p>\n In terms of the compliance side of security, the GDPR indicates that security of processing is an obligation (Art. 32), and forces all persons and organizations to implement a high level of security in order to grant the confidentiality, integrity and availability of personal data. Integrity and confidentiality<\/span> of data processing is also a GDPR principle (art. 5.1 f). However, the GDPR does not specify which measures should be implemented to grant these security dimensions further than encryption and anonymization. In fact, the controller and the processors are the ones responsible for defining these measures. Without any guidance and understanding of what is necessary to comply with the Regulation, this is a rather difficult task.<\/p>\n Our main goal is to offer guidance on the most important aspects to bear in mind for cybersecurity and information security, considering the most common types of attacks on websites.<\/p>\n The first thing to think about is providers. As already mentioned in the introduction, the most common option to create a website are:<\/p>\n In both situations, we will be externalizing the service and sharing personal data with third parties. The CMS and the web designer would be a processor according to the GDPR, which entails an obligation to normalise this relationship with a contract, stipulating all the requirements set forth in Art. 28[6]<\/a><\/sup><\/sup>.<\/p>\n Big solution providers such as CMS have already addressed this issue. Thus, they offer their customers some solutions to comply with Article 28 requirements.<\/p>\n In the scenario of hiring a web designer, the Researcher may face two situations that may change the management of the contract:<\/p>\n In the first case, the company may send a template to the researcher. This is because companies are used to working with other companies or customers, where processing personal data and signing a Data Processor<\/span> Agreement is a common task.<\/p>\n Then, if the company sends a template, it is important for the Researcher to carefully review the contract and see if all the requirements of the GDPR are met. To be able to do this, the best option is to compare a standard Data Processor<\/span> Agreement already approved by a National Data Protection Authority (example given in the last page: Danish Data Protection Authority).<\/p>\n On the other hand, when hiring freelance web designers, it may be necessary to send them a template, as they are not so used to dealing directly with legal compliance. It is also important to raise the freelancer\u2019s awareness about the duties arising from the contract, in addition to those corresponding to the Researcher, in order to ensure compliance throughout the whole professional relationship.<\/p>\n Information Security is an important part of the contract derived from an obligation of the GDPR. To ensure the confidentiality, availability, and integrity of personal data together with the rest of the legal obligations contained in the Regulation, the Researcher must only hire and work with those processors which offer a high level of security.<\/p>\n To reach this goal, the common practice is to include a \u201cCompliance Checklist\u201d as an addendum to the contract to be fulfilled by the processor. The recommendation here is to hire those processors which fulfil the entire checklist, meaning that they offer a high level of compliance. This checklist also includes some organizational measures derived from International Standards such as ISO asking for security[7]<\/a><\/sup><\/sup>.<\/p>\n Also, when hiring a web designer or choosing a CMS for your website, it should not be forgotten that the Researcher entails a controller position, regarding data protection roles defined in the GDPR. The controller holds a dominant position over the processor, then, regarding processing activities of personal data, the processor must hear and follow the instructions of the controller.<\/p>\n Once we have legally regulated the relationship between the Researcher and the processor (in this case, a CMS), we should say that these tools are not secure by default even though there are security measures in place based on the best standards in the market.<\/p>\n Nevertheless, there are a few tips that will improve the security of your CMS:<\/p>\n As already mentioned, within the cybersecurity world, we cannot talk about 0 risks. All these tips to be aware of while building a CMS for the web site might be not enough to completely secure your website.<\/p>\n The recommendation here is to have support, if possible, from cybersecurity professionals who are always up to date regarding new vulnerabilities and security improvements, and also to have the necessary tools to improve security on your website.<\/p>\n If not possible, the five tips above should give a minimum of security for your website.<\/p>\n In the event that the Researcher prefers to hire a company or a freelancer specialized in web design and development, it is a common mistake to think about a web designer as a developer.<\/p>\n A web designer may have knowledge on development but focuses on front-end<\/em> design. Front-end<\/em> design refers to the work done on the website interface, not anything related to the back-end or connections to the database, etc. This is done by a back-end developer, who focuses on writing all the code that manages the relationship between the website and all systems that work to make it run.<\/p>\n That said, some tips can be provided to the developers during the web creation project:<\/p>\n As already mentioned, the GDPR only refers to two security measures as a basis to ensure the integrity and confidentiality of personal data: encryption [11]<\/a><\/sup><\/sup>and anonymization.<\/p>\n Encryption is a broad concept that can be applied to different assets in several ways. Focusing on website encryption, what we need to be aware of is the connection between the website and the database.<\/p>\n Using SSL\/TLS (Secure Sockets Layer\/Transport Layer Security) protocols allows ensuring security by encrypting data traffic between a web browser (e.g. Firefox) and a web server (where all the elements of the website are stored). Basically, these protocols protect the data processed within the website using two keys (public and private), making it unlikely for third parties to access data without the proper rights.<\/p>\n When the protocol is implemented, the website will earn the status of HTTPS (HyperText Protocol Secure) meaning that this site is protected by an SSL\/TLS certification.<\/p>\n SSL\/TLS protocols do not only transport data securely (converting plain text to ciphered text) but also acts as an authentication between the receiver and the sender, allowing client-server applications to communicate in a way designed to prevent eavesdropping (interception of communication between two parties) and tampering (modifying data through unauthorised channels), among other things.<\/p>\n SSL\/TLS encryption protocols are the most commonly used in the context of Internet connections. Nevertheless, it should be noted that SSL 2.0 and 3.0 are no longer valid due to the detection of huge vulnerabilities; it is recommended to only use TLS protocols for encryption.<\/p>\n\n
Data protection: what to take into account at the time of creating a website<\/h2>\n
\n
Lawfulness, fairness and transparency principle<\/h3>\n
\n
Purpose limitation<\/span><\/h3>\n
\n
Data minimization<\/h3>\n
\n
Accuracy<\/span><\/h3>\n
\n
Storage limitation<\/span><\/h3>\n
Secure the information: minimum tips to ensure information security when creating a website.<\/h2>\n
\n
\n
Deeping into cybersecurity: CMS security tips<\/h3>\n
\n
\nTechnology is constantly changing. This has positive consequences but also negative ones in terms of cybersecurity; hackers can take advantage of old systems (as well-known as legacy systems) to discover vulnerabilities in the code which may allow a potential attack. Companies are normally aware of this, and they make updates to patch these vulnerabilities and keep the environment safe. Within your CMS management dashboard, you will have to regularly check out the update section and install those which improve security.<\/li>\n
\nIt may seem to be a very basic topic, but people still use default or easy passwords (e.g. 1234\/admin\/password, etc.) to access the environment where their sensitive information is stored and processed. Within the FAQ section, you can learn how to build a robust password and avoid hacker attacks.<\/li>\n
\nYou may fall under the situation of working with a team, consisting of people who need to work in this environment and make changes or management of the web site. Make sure to manage within your control dashboard these privileges following the concept.<\/li>\n
\nIn the event of losing information, receiving an attack, or any other situation that may lead to the unavailability of the information of the website, backups are the solution to maintain this dimension untouched.<\/li>\n
\nThe best option is that your host be located in Europe. If you choose, or for any other reason it is by default located outside of the European Economic Area, you will be making international transfer of personal data, which requires taking specific measures into account (not legal and technical). You will have to make sure that your host uses a valid certificate for your website (SSL\/TLS certificates, further explained in section 4.3.3).<\/li>\n<\/ol>\nWeb design: basic tips to develop a secure website<\/h2>\n
\n
Encryption: the importance of the SSL\/TLS certificate<\/h3>\n