M/530 - Privacy Management
[C(2015)102] Standardization request on privacy and personal data protection management in the design and development and in the production and service provision and process in the security technologies
Mandate M/530 requests the European standardisation organisations to develop standards on privacy and personal data protection management. The focus is on integrating these privacy principles throughout the design, development, production, service provision, and related processes within security technologies. The aim is to ensure secure technology solutions comply with data protection requirements, enhancing user trust and regulatory adherence across the EU. This mandate supports the implementation of privacy by design and by default in security technology products and services.
Purpose
The mandate M/530 concerns the standardisation of privacy and personal data protection management. It focuses on integrating privacy and data protection considerations throughout the entire lifecycle of security technologies. This includes design and development, production, service provision, and operational processes.
Standardisation request
The European Commission requests the development of harmonised standards that address privacy management and data protection requirements specifically within security technologies. These standards should guide manufacturers and service providers in embedding privacy principles and ensuring compliance with EU data protection laws.
Expected deliverables
The deliverables expected from this mandate include:
- Technical specifications and guidelines for privacy and personal data protection management systems applicable to security technologies.
- Standards that cover processes from the design stage through to production and provision of services.
- Frameworks that facilitate compliance with EU privacy regulations and enhance trust in security technology products and services.
Context
This mandate aligns with the EU’s broader objective to strengthen personal data protection and privacy by making them intrinsic elements of security technology management. It supports the Digital Single Market strategy by promoting interoperable privacy standards across member states. The request complements existing legal frameworks like the General Data Protection Regulation (GDPR) to ensure comprehensive privacy protection throughout technology lifecycles.
This mandate covers standardisation work on privacy and personal data protection management throughout the entire lifecycle of security technologies, including design, development, production, service provision, and related processes.
General Information
This document contains recommendations on how to integrate the principle of ‘data protection and privacy by design’ during the entire lifecycle of biometric access-control products and services, in order to achieve ‘data protection and privacy by default’.
NOTE 1 The GDPR requires the effective integration of data-protection safeguards into the processing of personal data (Article 25).
NOTE 2 Biometric access control includes cards and passports, biometric comparisons on card, in databases and a combination of both, as well as one-to-one and one-to-many (and many-to-many) comparisons.
NOTE 3 Biometric access control is used at work and border control as well as in combination with cards and PINs and in online and mobile services.
Facial recognition for access control is covered by this document.
This document extends EN 17529.
This document applies to aspects of data protection and privacy by design.
This document is not applicable to non-biometric aspects of access control, or to aspects not relating to data protection or privacy.
NOTE 4 In general, biometrics is for example covered by ISO/JTC 1/SC 37 and CEN/TC 224/WG 18.
- Technical report12 pagesEnglish languagee-Library read for1 day
This document contains recommendations on how to integrate the principle of ‘data protection and privacy by design’
during the entire lifecycle of biometric access-control products and services, in order to achieve ‘data protection and
privacy by default’.
Biometric facial recognition for access control is covered by this document. Biometric facial recognition for surveillance is
covered by CEN/CLC/JTC 13 TR ‘Video surveillance’.
This document specifies recommendations for the management of data protection and privacy by design in biometricaccess-
control products and services. This document extends ISO/IEC 27552. This document applies to aspects of data
protection and privacy by design. This document is not applicable to non-biometric aspects of access control, or to aspects
not relating to data protection or privacy.
- Technical report12 pagesEnglish languagee-Library read for1 day
This document contains recommendations on how to integrate the principle of ‘data protection and privacy by design’ during the entire lifecycle of video-surveillance products and services, in order to achieve ‘data protection and privacy by default’.
- Technical report15 pagesEnglish languagee-Library read for1 day
This document contains recommendations on how to integrate the principle of ‘data protection and privacy by design’ during the entire lifecycle of video-surveillance products and services, in order to achieve ‘data protection and privacy by default’.
- Technical report15 pagesEnglish languagee-Library read for1 day
This document provides requirements for manufacturers and/or service providers to implement Data protection and Privacy by Design and by Default (DPbDD) early in their development of their products and services, i.e. before (or independently of) any specific application integration, to make sure that they are as privacy ready as possible. The document will be applicable to all business sectors, including the security industry.
- Standard62 pagesEnglish languagee-Library read for1 day
This document provides requirements for manufacturers and/or service providers to implement Data protection and Privacy by Design and by Default (DPbDD) early in their development of their products and services, i.e. before (or independently of) any specific application integration, to make sure that they are as privacy ready as possible. The document will be applicable to all business sectors, including the security industry.
- Standard62 pagesEnglish languagee-Library read for1 day
Frequently Asked Questions
A European Standardization Mandate is a formal request from the European Commission to the European Standardization Organizations (CEN, CENELEC, and ETSI) to develop European standards (ENs) in support of EU legislation and policies. Mandates are issued under Regulation (EU) No 1025/2012 and help ensure that products and services meet the essential requirements set out in EU directives and regulations.
M/530 is a European Standardization Mandate titled "[C(2015)102] Standardization request on privacy and personal data protection management in the design and development and in the production and service provision and process in the security technologies". [C(2015)102] Standardization request on privacy and personal data protection management in the design and development and in the production and service provision and process in the security technologies There are 6 standards developed under this mandate.
Standards developed in response to a mandate and cited in the Official Journal of the European Union become "harmonized standards". Products manufactured in compliance with harmonized standards benefit from a presumption of conformity with the essential requirements of the corresponding EU directive or regulation, facilitating CE marking and market access across the European Economic Area.