Unauthorised Access: Physical Penetration Testing For IT Security Teams

C.1.2. Data Protection Directive

As previously stated, there is very little legislation that penetration testers need to consider at the EU level as this is handled in its entirely by the relevant member state though local laws or through transposed laws brought about through an EU Directive. However, one area that should be discussed is the Data Protection Directive.

This directive, (officially Directive 95/46/EC) originally conceived in 1995, has now been transposed into local law by every member state. In some cases, the creation of new legislation was not necessary. For example, in the UK the Data Protection Act already contains many of the necessary provisions, as does the Personal Data Act in Finland.

Naturally, there are a number of provisions that don't directly concern security consultants however the following are of interest:

• Notice – Data subjects should be given notice when their data is being collected.

• Purpose – Data should only be used for the purpose stated and not for any other purpose.

• Consent – Data should not be disclosed without the data subject's consent.

• Security – Collected data should be kept secure from any potential abuses.

• Disclosure – Data subjects should be informed as to who is collecting their data.

• Access – Data subjects should be allowed to access their data and make corrections to any inaccurate data.

• Accountability – Data subjects should have a method available to them to hold data collectors accountable for following the above principles.

By now, ...