NIST Privacy Framework, Protect-PPR.DS-P2

If you provide a publicly available electronic communications network or service, take all due technical and organizational measures to secure the confidentiality of any communication carried over it and of the related traffic data, and make sure your employees do the same (Article 99, paragraph 1).

If you provide a public communications network or a publicly available electronic communications service, ensure, technically and organizationally, the confidentiality of messages and of the related traffic and location data transmitted over your network and services.

If you provide a publicly available telecommunications service, help provide one, offer a telecommunications service commercially, or operate a public telecommunications network or a telecommunications installation used commercially, keep the content of telecommunication and its circumstances secret, including whether anyone takes or took part in it and the circumstances of unsuccessful connection attempts, and keep doing so after your activity ends (TDDDG § 3(1) and (2)).

If you provide electronic communications networks or services, take appropriate organizational and technical measures to ensure the confidentiality of communications, and give the State Data Protection Inspectorate the conditions to carry out its control.

If you are a service provider or operator, guarantee the confidentiality of communications made over a public communications network and publicly available electronic communications services, and of the related traffic data.

If you offer electronic communications networks or services, guarantee the inviolability of communications and of the related traffic data carried over public communications networks and publicly available electronic communications services.

Maintain the secrecy of the content of transmitted messages, data about the communicating party, traffic data and location data if you come into contact with them in the provision of networks and services, in the use of services, by chance or otherwise (section 117, paragraphs 1 and 2).

If you are an operator, keep the confidentiality of the content of communications, the related traffic and location data, and facts about interrupted or unestablished connections, also after your activity ends, obtain information about communications only as strictly needed to provide the public communications service, and tell the subscriber or user at contract conclusion or service start when you must obtain content or record or store communications (article 214, paragraphs 1 to 4).

For identification, rely on qualified certificates for electronic seals or for website authentication under Regulation (EU) No 910/2014 that include the additional attributes in Article 34(3) (Article 34). When exchanging data over the internet, apply secure encryption with strong and widely recognized encryption techniques throughout the communication session. If you issue card-based payment instruments or are an account information service provider or a payment initiation service provider, keep the access sessions offered by account servicing payment service providers as short as possible and terminate them as soon as the requested action is completed. Keep personalized security credentials and authentication codes unreadable, directly or indirectly, by any staff at any time, and inform the payment services user and the issuer of the credentials without undue delay of any loss of their confidentiality under your sphere of competence (Article 35).

Have sound security mechanisms to meet the requirements of Regulation (EU) 2022/2554 that secure and authenticate the channels of information transfer, minimise the risk of data corruption and unauthorised access and prevent information leaks, so that the confidentiality of data is always ensured (Section 80(1) sentence 2 number 4).

Implement a written policy requiring encryption that meets industry standards, to protect the nonpublic information you hold or transmit both in transit over external networks and at rest.

Implement technical and organizational methods to protect communication networks, telecommunications facilities, restricted-access information about the organization of communication networks, and information transmitted over those networks, and cooperate with law-enforcement bodies to protect communication facilities and structures from unauthorized access.

Guarantee the inviolability and secrecy of communications you carry as a telecommunications, network, or ICT service provider.

Take all reasonable steps to keep a consumer's communications confidential, and do not intercept, monitor, alter, or modify the content of a message without authorisation.

Before transferring personal data to another country or international organization, confirm the receiving country meets at minimum this Law's data protection principles or applicable international standards, and take appropriate measures to secure the data at the point of transfer if the receiving country's protection is not adequate.

Before any transfer, implement technical and organisational security measures, including encryption and measures for availability, confidentiality, integrity and system resilience, and obtain the HAPDP's authorisation for the transfer.

Encrypt Tier 3 (Private Sensitive) and Tier 4 (Highly Sensitive) data whenever you transmit it between physical locations.

If you do not accept payment cards, do not transfer a Nevada resident's personal information through an electronic, nonvoice transmission other than a facsimile outside your secure system, and do not move a data storage device containing that personal information beyond your logical or physical controls, unless the data is encrypted using an encryption technology adopted by an established standards-setting body, with appropriate management and safeguards of the cryptographic keys.

As a covered application store provider, limit the collection and processing of personal age verification data to verifying age, obtaining parental consent and maintaining compliance records, and transmit it using industry-standard encryption.

Apply Provvedimento 146/2019's security measures (documented access controls, encryption or pseudonymization, controlled transmission) before processing genetic data of a person in Italy.

Take all reasonable steps to keep customer communications confidential, and do not intercept, monitor, alter, or modify their content except as the Act permits.