Privacy/TPWG/Change Proposal Remove auditable security requirement
Remove auditability requirement from security section
Proposal from Jack Hobaugh; issue-235.
Remove text
From "Reasonable Security" section:
Third parties SHOULD ensure that the access and use of data retained for permitted uses is auditable.
Add explanatory non-normative text
Proposal by Walter van Holst
To "Reasonable Security" section add:
For the purposes of this recommendation, auditable is understood as having sufficient records of access and use of data retained such that an independent auditor would have a reasonable level of confidence that the data retained is exclusively used for the permitted uses or that breaches of this can be detected ex-post. For example, an auditor might use a similar level of confidence to that required for the organization's financial records.