Which statement is FALSE regarding the use of technical security controls?

Most modern, principles-based privacy legislation, such as the GDPR, is intentionally technology-neutral. These laws require organizations to implement "appropriate technical and organizational measures" based on a risk assessment, rather than prescribing a specific list of technologies. This approach ensures the law remains durable as technology evolves and allows organizations the flexibility to select controls best suited to their specific processing activities, data types, and identified risks. Mandating specific controls would quickly render the legislation obsolete and would be ill-suited for the diverse range of organizations and technologies it governs.

A. Data governance frameworks are designed to manage and protect data assets, making technical security controls a critical and integral component.
B. Core technical controls (e.g., encryption, access control) are often based on global standards, making them broadly applicable and sufficient across many jurisdictions.
D. The effective deployment and configuration of technical security controls require specialized expertise to prevent vulnerabilities and ensure they meet security objectives.

1. General Data Protection Regulation (EU) 2016/679

Article 32(1). The regulation states that controllers and processors shall implement "appropriate technical and organisational measures to ensure a level of security appropriate to the risk

" providing examples like encryption and pseudonymization

but not a mandatory

exhaustive list.

2. IAPP. (2019). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). Chapter 5

Section on "Information Security

" explains that selecting controls is a risk-based decision and that laws like the GDPR do not prescribe specific technologies

instead requiring "reasonable" or "appropriate" security.

3. Voigt

P.

& von dem Bussche

A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing. In the commentary on Article 32 (pp. 345-348)

the authors highlight the technology-neutral and risk-based approach

noting that the GDPR "does not prescribe any specific technical or organisational measures." (DOI: 10.1007/978-3-319-57959-7).