feat: FISA 702 / Drittlandrisiko — YAML-Regeln + DSGVO Obligations
1. YAML Policy: 3 neue Regeln (Kategorie J. Drittlandrisiko) - R-FISA-001: US-Cloud-Provider = FISA 702 Exposure (+20 Risk, DSFA empfohlen) - R-FISA-002: PII bei US-Provider ohne E2EE (+15 Risk) - R-FISA-003: Art. 9 Daten bei US-Provider (+25 Risk, CONDITIONAL) - Erkennt: aws, azure, google, microsoft, amazon, openai, anthropic, oracle 2. DSGVO Obligations: 4 neue Drittland-Pflichten (OBL-081 bis OBL-084) - Art. 44-49: Drittlanduebermittlung nur mit Garantien - Transfer Impact Assessment (TIA) bei US-Anbietern (Schrems II) - Zusaetzliche technische Massnahmen (EDPB Recommendations 01/2020) - Informationspflicht bei Drittlanduebermittlung (Art. 13) 370 Obligations total (war 366) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
@@ -5,7 +5,7 @@
|
||||
"id": "dsgvo",
|
||||
"file": "dsgvo_v2.json",
|
||||
"version": "1.0",
|
||||
"count": 80
|
||||
"count": 84
|
||||
},
|
||||
{
|
||||
"id": "ai_act",
|
||||
@@ -69,5 +69,5 @@
|
||||
}
|
||||
],
|
||||
"tom_mapping_file": "_tom_mapping.json",
|
||||
"total_obligations": 366
|
||||
"total_obligations": 370
|
||||
}
|
||||
@@ -4591,6 +4591,209 @@
|
||||
"valid_from": "2018-05-25",
|
||||
"valid_until": null,
|
||||
"version": "1.0"
|
||||
},
|
||||
{
|
||||
"id": "DSGVO-OBL-081",
|
||||
"title": "Drittlanduebermittlung nur mit geeigneten Garantien",
|
||||
"description": "Die Uebermittlung personenbezogener Daten in Drittlaender (insbesondere USA) ist nur zulaessig, wenn ein Angemessenheitsbeschluss vorliegt oder geeignete Garantien (z.B. Standardvertragsklauseln) implementiert sind. Nach Schrems II (C-311/18) muessen zusaetzliche Massnahmen geprueft werden.",
|
||||
"applies_when": "data transferred to third country or US provider used",
|
||||
"applies_when_condition": {
|
||||
"all_of": [
|
||||
{
|
||||
"field": "data_protection.processes_personal_data",
|
||||
"operator": "EQUALS",
|
||||
"value": true
|
||||
}
|
||||
]
|
||||
},
|
||||
"legal_basis": [
|
||||
{
|
||||
"norm": "DSGVO",
|
||||
"article": "Art. 44",
|
||||
"title": "Allgemeine Grundsaetze der Datenuebermittlung"
|
||||
},
|
||||
{
|
||||
"norm": "DSGVO",
|
||||
"article": "Art. 46",
|
||||
"title": "Datenuebermittlung vorbehaltlich geeigneter Garantien"
|
||||
}
|
||||
],
|
||||
"sources": [
|
||||
{
|
||||
"type": "regulation",
|
||||
"ref": "Art. 44-49 DSGVO"
|
||||
},
|
||||
{
|
||||
"type": "court_decision",
|
||||
"ref": "EuGH C-311/18 (Schrems II)"
|
||||
}
|
||||
],
|
||||
"category": "Governance",
|
||||
"responsible": "Datenschutzbeauftragter",
|
||||
"deadline": {
|
||||
"type": "on_event",
|
||||
"event": "Vor Beginn der Datenuebermittlung"
|
||||
},
|
||||
"sanctions": {
|
||||
"max_fine": "20 Mio. EUR oder 4% Jahresumsatz"
|
||||
},
|
||||
"evidence": [
|
||||
{
|
||||
"name": "Transfer Impact Assessment (TIA)",
|
||||
"required": true
|
||||
},
|
||||
"Standardvertragsklauseln (SCC)",
|
||||
"Dokumentation zusaetzlicher Massnahmen"
|
||||
],
|
||||
"priority": "kritisch",
|
||||
"tom_control_ids": [
|
||||
"TOM.GOV.01",
|
||||
"TOM.CRY.01"
|
||||
],
|
||||
"valid_from": "2018-05-25",
|
||||
"version": "1.0"
|
||||
},
|
||||
{
|
||||
"id": "DSGVO-OBL-082",
|
||||
"title": "Transfer Impact Assessment (TIA) bei US-Anbietern",
|
||||
"description": "Bei Nutzung von US-Cloud-Anbietern (AWS, Azure, Google etc.) muss ein Transfer Impact Assessment durchgefuehrt werden, das FISA 702 und Cloud Act Risiken bewertet und dokumentiert, ob die Standardvertragsklauseln wirksam schuetzen.",
|
||||
"applies_when": "US cloud provider used for personal data",
|
||||
"applies_when_condition": {
|
||||
"all_of": [
|
||||
{
|
||||
"field": "data_protection.processes_personal_data",
|
||||
"operator": "EQUALS",
|
||||
"value": true
|
||||
}
|
||||
]
|
||||
},
|
||||
"legal_basis": [
|
||||
{
|
||||
"norm": "DSGVO",
|
||||
"article": "Art. 46 Abs. 1",
|
||||
"title": "Geeignete Garantien"
|
||||
},
|
||||
{
|
||||
"norm": "EuGH",
|
||||
"article": "C-311/18",
|
||||
"title": "Schrems II — Wirksamkeit von SCCs pruefen"
|
||||
}
|
||||
],
|
||||
"sources": [
|
||||
{
|
||||
"type": "court_decision",
|
||||
"ref": "EuGH C-311/18 (Schrems II)"
|
||||
},
|
||||
{
|
||||
"type": "guidance",
|
||||
"ref": "EDPB Recommendations 01/2020 Supplementary Measures"
|
||||
}
|
||||
],
|
||||
"category": "Governance",
|
||||
"responsible": "Datenschutzbeauftragter / Legal",
|
||||
"deadline": {
|
||||
"type": "on_event",
|
||||
"event": "Vor Vertragsschluss mit US-Anbieter"
|
||||
},
|
||||
"sanctions": {
|
||||
"max_fine": "20 Mio. EUR oder 4% Jahresumsatz"
|
||||
},
|
||||
"evidence": [
|
||||
{
|
||||
"name": "Transfer Impact Assessment",
|
||||
"required": true
|
||||
},
|
||||
"FISA 702 Risikobewertung"
|
||||
],
|
||||
"priority": "kritisch",
|
||||
"tom_control_ids": [
|
||||
"TOM.GOV.01"
|
||||
],
|
||||
"valid_from": "2020-07-16",
|
||||
"version": "1.0"
|
||||
},
|
||||
{
|
||||
"id": "DSGVO-OBL-083",
|
||||
"title": "Zusaetzliche technische Massnahmen bei Drittlanduebermittlung",
|
||||
"description": "Wenn Standardvertragsklauseln allein nicht ausreichen (z.B. bei FISA 702 Exposure), muessen zusaetzliche technische Massnahmen implementiert werden: E2EE mit eigener Schluesselhoheit, Pseudonymisierung vor Uebermittlung, oder Verzicht auf den US-Anbieter.",
|
||||
"applies_when": "SCC alone insufficient due to surveillance laws",
|
||||
"applies_when_condition": {
|
||||
"all_of": [
|
||||
{
|
||||
"field": "data_protection.processes_personal_data",
|
||||
"operator": "EQUALS",
|
||||
"value": true
|
||||
}
|
||||
]
|
||||
},
|
||||
"legal_basis": [
|
||||
{
|
||||
"norm": "DSGVO",
|
||||
"article": "Art. 46 Abs. 1",
|
||||
"title": "Zusaetzliche Massnahmen"
|
||||
},
|
||||
{
|
||||
"norm": "EDPB",
|
||||
"article": "Recommendations 01/2020",
|
||||
"title": "Supplementary Measures"
|
||||
}
|
||||
],
|
||||
"sources": [
|
||||
{
|
||||
"type": "guidance",
|
||||
"ref": "EDPB Recommendations 01/2020"
|
||||
}
|
||||
],
|
||||
"category": "Technisch",
|
||||
"responsible": "IT-Sicherheit / Datenschutzbeauftragter",
|
||||
"priority": "hoch",
|
||||
"evidence": [
|
||||
{
|
||||
"name": "Nachweis zusaetzlicher Schutzmassnahmen",
|
||||
"required": true
|
||||
},
|
||||
"E2EE Dokumentation oder Pseudonymisierungskonzept"
|
||||
],
|
||||
"tom_control_ids": [
|
||||
"TOM.CRY.01",
|
||||
"TOM.GOV.01"
|
||||
],
|
||||
"valid_from": "2020-07-16",
|
||||
"version": "1.0"
|
||||
},
|
||||
{
|
||||
"id": "DSGVO-OBL-084",
|
||||
"title": "Informationspflicht bei Drittlanduebermittlung",
|
||||
"description": "Betroffene Personen muessen darueber informiert werden, dass ihre Daten in ein Drittland uebermittelt werden, einschliesslich der Angabe des Drittlands und der genutzten Garantien (Art. 13 Abs. 1 lit. f DSGVO).",
|
||||
"applies_when": "personal data transferred to third country",
|
||||
"applies_when_condition": {
|
||||
"all_of": [
|
||||
{
|
||||
"field": "data_protection.processes_personal_data",
|
||||
"operator": "EQUALS",
|
||||
"value": true
|
||||
}
|
||||
]
|
||||
},
|
||||
"legal_basis": [
|
||||
{
|
||||
"norm": "DSGVO",
|
||||
"article": "Art. 13 Abs. 1 lit. f",
|
||||
"title": "Informationspflicht bei Drittlanduebermittlung"
|
||||
}
|
||||
],
|
||||
"category": "Organisatorisch",
|
||||
"responsible": "Datenschutzbeauftragter",
|
||||
"priority": "hoch",
|
||||
"evidence": [
|
||||
{
|
||||
"name": "Datenschutzerklaerung mit Drittland-Hinweis",
|
||||
"required": true
|
||||
}
|
||||
],
|
||||
"tom_control_ids": [],
|
||||
"valid_from": "2018-05-25",
|
||||
"version": "1.0"
|
||||
}
|
||||
],
|
||||
"controls": [
|
||||
|
||||
Reference in New Issue
Block a user