Privacy by design

Little data collected, short retention, and clear guidance on faxing personal information.

Updated on:

The GDPR (Regulation (EU) 2016/679) does not mention fax, but it applies to it: sending a document about an identifiable person is processing of personal data. CaptainFax is operated from France, so European rules apply to us. We keep the uploaded document only until the fax is sent, we ask for no account, and card payments go through Stripe. If you are the one faxing personal data, you are usually the controller. The sections below set out what that implies, in particular for security and for a fax that reaches the wrong person.

Four ideas to start from

The GDPR reasons about data and risk, not about technology. These points apply to a fax as they do to an e-mail or a letter.

  • Transmitting is processing

    Under Article 4(2), disclosure by transmission counts as a processing operation. Sending a payslip, a medical form or a customer file by fax therefore comes under the Regulation.

  • A lawful basis is required

    Article 6 provides six: consent, contract, legal obligation, vital interests, public interest and legitimate interests. Which one fits depends on why you are sending the document and to whom.

  • Send what is necessary, nothing more

    Data minimisation (Article 5(1)(c)) means data must be adequate, relevant and no more than the purpose requires. Remove unneeded pages and details before building the PDF.

  • Transfers outside the EU have conditions

    Faxing outside the European Economic Area counts as a transfer under Chapter V (Articles 44 to 49). Canada, one of our destinations, has a European Commission adequacy decision covering commercial organisations subject to PIPEDA (Decision 2002/2/EC). For other recipients there, check which safeguard applies.

What Article 32 means for a fax

Article 32 obliges controllers and processors to adopt technical and organisational measures matched to the risk, considering the state of the art, the cost and the nature of the data. Encryption is one measure it names, alongside pseudonymisation and regular testing.

With fax, encryption covers only the first leg. At CaptainFax the upload goes over HTTPS and the file is erased once the fax is sent. The phone leg stays unencrypted, as with any fax. The rest must come from organisational measures: checked numbers, a second person reviewing sensitive faxes, a prior call to the recipient, and anonymised pages whenever the purpose permits.

Document your decisions. Article 5(2) makes you responsible for demonstrating compliance, and a brief note stating why fax is used for a particular flow, with the precautions that accompany it, serves this purpose. If your risk assessment finds that fax without end-to-end encryption is too risky for some content, use another channel for it.

A fax went to the wrong person

Under Article 4(12), a page holding personal data that ends up with the wrong recipient is a personal data breach, even when the error was innocent. Follow these steps in order.

  1. Limit the damage

    Get in touch with the wrong recipient, request that the pages be destroyed and, where possible, that they confirm this in writing. Keep a record of these exchanges.

  2. Record it internally

    Article 33(5) requires you to document every breach: what happened, its effects and what you did about it. This applies even when no notification is needed.

  3. Notify the authority within 72 hours if needed

    Unless the breach is unlikely to put individuals at risk, notify your national supervisory authority without undue delay and, if possible, no later than 72 hours after you learn of it (Article 33(1)). A notification made later must explain the delay.

  4. Tell the people concerned if the risk is high

    When the risk is high, such as health or financial data, or details enabling identity theft, the individuals affected must be informed without undue delay and in plain language (Article 34). A processor must inform the controller promptly (Article 33(2)).

What to set up in your organisation

A list of verified numbers
Keep regular recipients such as an insurer, a laboratory or a court registry in a checked and dated list. People pick the number from the list and never from memory.
A second look for sensitive faxes
With a medical or financial file, have a colleague verify the number and content before sending. It takes two minutes and avoids most mistakes.
A standard cover sheet
Name of the recipient, number of pages, sender details and what to do if the fax arrived by mistake. Placed first in every transmission, it tells whoever finds the pages what to do.
Control of your own machines
For incoming faxes, put the machine in a room that can be locked, or enable reception into protected memory with a PIN where the model supports it. Wipe the memory or the disk before returning leased equipment.
An entry in your record of processing
When fax belongs to your routine workflows, put it in the record Article 30 requires: the purpose, the data categories, the recipients, transfers, retention periods and security measures.

Frequently asked questions

Is it allowed to fax health data?
The GDPR does not prohibit it. Health data is among the special categories in Article 9, so one of the exceptions listed there must apply, for instance the provision of care, together with a higher standard of care. National rules, medical confidentiality among them, also apply. Ask your data protection officer or your professional body what applies to your practice.
Do I need a contract with CaptainFax?
Article 28 says that any provider processing personal data for you must be bound by a contract covering instructions, confidentiality, security and the return or deletion of data at the end of the service. If your organisation plans to use CaptainFax regularly for documents containing personal data, contact us through the contact page so that we can look at it together.
How long are my documents kept?
With CaptainFax, the uploaded file is used to send the fax and then erased automatically. Stripe handles card payments. For your own copies and receipts, decide how long to keep them (Article 5(1)(e)). The recipient's retention period depends on their own policy.
Can a person named in a fax exercise their rights?
Yes. Rights of access, rectification, erasure, objection and the rest, set out in Articles 15 to 22, are addressed to the controller, i.e. whoever decided to send the document. The controller must answer within one month, a period that can be extended by two further months where requests are complex or numerous (Article 12(3)).

Keep exploring

A few pages that go well with the one you just read.

Related questions