Grenzen der Sicherheit der Verarbeitung personenbezogener Daten

Art. 32 GDPR requires the implementation of technical and organizational measures (TOMs) to ensure an adequate level of security for the processing. However, if these TOMs themselves process personal data (“data processing TOMs”), they are subject to the requirements of the GDPR. Consequently, this requires, inter alia, a legal basis in accordance with Art. 6 GDPR.
Data processing TOMs thus create a tension between the requirements of Art. 32 and Art. 6. In extreme cases, Art. 32 threatens the obligation to implement data processing TOMs whose processing of personal data cannot be justified under Art. 6.
On the basis of the relevant provisions, this thesis first examines the nature of this tension and the associated consequences. These findings are then used to develop solutions for the respective provisions. Result is an overall solution, where a balance between the two provisions is sought.