T 2.61 Unauthorised collection of person-related data

When using management systems, a large amount of logged data is incurred within the framework of the normal procedure, which is normally generated and analysed automatically. This particularly applies to the fields of network and system monitoring. Without extensively logging the system activities, security violations cannot be detected, for example. However, one requirement within the framework of monitoring is the unambiguous allocation of certain accesses to users. This way, the monitored user activities require person-related logging, however. Normally, the management strategy defines the user activities to be monitored for security reasons in a cross-organisational manner and in consultation with the Data Protection Officer. The affected users must be informed accordingly. However, compliance with the specifications defined by the management strategy must be checked within the framework of system auditing. Furthermore, it is possible that the management system creates temporary log files within the framework of a regular function that are stored in the low-protection area for temporary files, for example. In this case, the log files are potentially accessible for the time they exist and may additionally contain user information.