Chapter 5 Data security, privacy and safety

In the context of MSP, SDI serves as a critical foundation for integrating, analysing and sharing geospatial information. However, the increasing reliance on digital data brings heightened concerns about data security, privacy and safety. The sensitivity of geospatial data in MSP stems from its potential to reveal critical information about ecosystems, resources, and human activities. Mismanagement or unauthorized access to such data could result in environmental harm, economic losses, or breaches of privacy.

As MSP processes involve diverse stakeholders —including governments, industries, and communities— ensuring the protection of sensitive geospatial data is essential for fostering trust and enabling effective collaboration. This chapter explores the principles and practices required to safeguard geospatial data within an SDI.

5.1 Geospatial data sensitivity – definitions

First, it is essential to clarify the key concepts related to the sensitivity of geospatial data, specifically privacy and security. In the context of SDI for MSP, the sensitivity of geospatial data refers to the level of protection required, determined by the nature of the data and the associated access controls and visibility restrictions. This sensitivity is typically managed through varying degrees of protection, ensuring that sensitive information is only accessible to authorised users. Organisations must consider developing regulatory requirements that outline how geospatial data should be safeguarded, ensuring compliance with established standards and protocols (IHO, 2023). Generally, these regulatory requirements can be categorised into three broad categories:

Traditional data protection (backup and restore copies);
Data security (encryption, access control, authentication, threat monitoring);
Data privacy (legislation, policies, good practices for data governance).

While traditional data protection is widely accepted, it is important to recognize that data security and data privacy, though closely related, have distinct scopes.

Data security

Data security safeguards data from compromise by external attackers and malicious insiders. In the context of geospatial data, security encompasses the protection of systems, assets, information, facilities, and datasets that an organisation considers critical, along with the strategies implemented to defend these assets. Security controls may involve how an organisation addresses and mitigates vulnerabilities in its information systems, as well as the procedures established for authentication and access control to facilities or assets. Additionally, these security controls often form the foundation for ensuring and maintaining data privacy, enabling organisations to protect sensitive information effectively.

Data privacy

Data privacy, on the other hand, concerns how an entity discloses, uses, controls, or shares the sensitive personal data of users. The key distinction here is that privacy-relevant information typically relates directly to an individual, such as a fisher's details. In contrast, data security might involve protecting sensitive information related to a company’s metrics or strategy (e.g., a fishery company) or government interests (e.g., military zones). While this information is sensitive, it does not affect the privacy of an individual, their identity, or personal data. For geospatial data, privacy controls may include encrypting users’ personal data, particularly when dealing with spatiotemporal resolution, and implementing measures like blurring data at specific zoom levels within the map viewer of an SDI to protect individual privacy.

In the context of MSP, a crucial aspect to consider, especially when collaborating across national borders, is geospatial data sovereignty. This concept refers to the principle that digital geospatial data is subject to the laws of the country in which it is stored. The growing adoption of cloud data services, coupled with concerns over data security, has prompted many countries to enact legislation requiring that data be kept within the borders of the country where the customer resides. This secures that the data is governed by the local legal framework, addressing issues of jurisdiction and compliance with national regulations.

To effectively integrate data sensitivity into good practices for SDI management, it is widely accepted that an iterative or step-by-step approach should be followed. This process is typically summarised in six general sequences, as illustrated in Figure 30, with some additional details outlined in the text below. An illustration of a detailed decision tree may be found in Annex 1.

Figure 30: Step-by-step approach to integrate data sensitivity into best practices for SDI management.

Step 1: Assess data sensitivity

The first step to secure geospatial data is to assess its sensitivity and identify the potential threats and impacts of data breaches. According to nature in terms of topics cover and context of data, it may need to apply different levels of protection and access control. For example, it may need to classify data according to a security framework, such as General Data Protection Regulation (GDPR) in the EU or the Federal Information Security Management Act (FISMA) in the US. It is also necessary to conduct a risk assessment and a privacy impact assessment to evaluate the likelihood and consequences of data loss or exposure.

Step 2: Encrypt data

The second step in securing the data is to encrypt it both at rest and in transit. Encryption is the process of transforming data into an unreadable form that can only be deciphered with a key or password. Encryption can help prevent unauthorised access, modification or theft of the data, particularly when it is stored on external devices, cloud servers or transferred over networks.

Step 3: Control data access

The third step in securing spatial data is to control who can access, view, modify or share the data. There are various access control mechanisms and tools, such as passwords, authentication, authorisation, roles, permissions or certificates, to restrict or grant access to the data based on the identity of the user, role or group. It is also possible to use audit logs and monitoring tools to track and record data access activities and detect any anomalies or breaches. A data retention and destruction policy should also be implemented to delete or archive data when it is no longer needed or relevant.

Step 4: Protect data integrity

The fourth step in securing the spatial data is to protect its integrity and accuracy. Data integrity is the assurance that the data is consistent, complete and correct throughout its lifecycle. Data integrity can be compromised by human error, malicious attacks or technical failures. Various data integrity tools and techniques are available, such as checksums, digital signatures, hashing or blockchain, to verify and validate the data and confirm that it has not been altered or corrupted.

Step 5: Acculturate date users

The fifth step in securing spatial data is to educate the data users and stakeholders about the importance and good practices of data security. Data security is not just a technical issue, but also a human and organisational one. Training and guidance to the data users and stakeholders should be provided about how to handle, store and share sensitive spatial data responsibly and ethically. A data security policy and code of conduct that define the roles, responsibilities and data security rules for SDI projects must also be established and implemented.

Step 6: Update data security

The sixth and final step in securing spatial data is to regularly update the data security and adapt to changing needs and threats. Data security is not a one-off event, but an ongoing process that requires constant monitoring, evaluation and improvement. Review and update data security measures and tools have to be reviewed periodically, and compatibility and compliance with the latest laws, policies and standards must be maintained. Regular data security audits and tests should be carried out to identify and correct any vulnerabilities or gaps in the security of the data.

Sensitivity of MSP data – assessment according to existing regulations and policies

MSP data are not sensitive by nature, but according to structural or cyclical factors, themselves based on multiscale contexts. Structural factors refer to the broader political, economic, social and environmental conditions and institutions at the national, regional or international level that increase or decrease the ability to collect, process and visualise data, as well as the power to access it. Cyclical factors are relative to the current situation. Both factors impact the sensitivity of the data, and the degree to which it varies from one situation to another.

A notable example in recent years, coinciding paradoxically with the expanding deployment and strengthening of MSP initiatives, is the increased sensitivity surrounding submarine cables and pipelines. Regardless of their function —whether for telecommunications or energy— these infrastructures have become critical due to structural factors like the economic competitiveness and interdependence of nations, as well as cyclical factors such as military and hybrid conflicts. Given their importance, these infrastructures may be subject to removal or blurring in an SDI for MSP, depending on the spatial resolution and the sensitivity policy in place. Another example of data sensitivity can be found in the fishing sector, where information on fishing territories is often considered confidential, yet must be incorporated into MSP initiatives (Box 22).

Annex 2 provides a comprehensive table with examples of potentially sensitive data in MSP initiatives.

Case Study

Box 22: Fishing territories as an example of data privacy challenge for data integration in a Marine Spatial Plan (Northeast Atlantic sea basin – Yeu Island, France)

Contributed by Yannick Leroy

As part of a critical research project in geography carried out in 2018 (Leroy, 2018), the fishing territories of the Île d'Yeu fishing community (Bay of Biscay, France) were mapped on an experimental basis in the context of the implementation of the French MSP, here materialised by the two plans (or “Document Stratégique de Façade”) covering the mainland Atlantic seaboard. This mapping used an innovative methodological framework combining: (i) qualitative interviews with Yeu fishermen, (ii) on-board observations, and (iii) analysis of technical reports.

At a first level of analysis, this methodology has made it possible to provide alternative information on the spatialization of fishing seasons according to target species and relative socio-technical practices, and thus to establish a link between fishing communities on land and territories they use at sea. At a second level of analysis, this research has made it possible to address the issue of the missing layer (St Martin et Hall-Arber, 2008), i.e. the lack/gap of geographical information needed to integrate fishing activities into marine spatial plans. However, this research could only be carried out while respecting the confidential nature of the data produced in collaboration with the fishing community. It is this very question of data privacy and the issues it raises that is one of the blind spots for their full integration into MSP initiatives.

According to the literature, the integration of fishing activities into marine spatial plans suffers from two difficulties. The first relates to the technical dimension of this integration, because of the limitations associated with the methodologies used to produce the spatial data needed to geographically inform this activity, which has dynamic footprints in time and space. Here, the methodological framework deployed is limited to the timeframe of the research and is difficult to apply over the medium term by the authorities responsible for MSP in France, due to budgetary constraints. The confidential nature of the data produced also means that an effort has to be made for the corresponding SDI in order to establish a bond of trust between the subject of the data (fishing communities) and the SDI management, which could be different from the MSP authority.

The second difficulty relates to the political dimension of this integration, due in particular to the reduction of this activity to a characterization based mainly on the metric of fishing effort. While this is useful, it is not sufficient in itself. And reshuffling the deck with a characterization based on a different geographical reality (fishing grounds) makes it difficult to read for normative public policy frameworks, in this case MSP. Besides, the precision of the data and the boundaries of these territories are deliberately vague, in order to respect the discrete and sensitive dimension of the information transmitted. For that the SDI user interface must replicate this float level as a function of zoom scales for this particular type of data.

This case study therefore highlights the challenge of data confidentiality for the authorities responsible for MSP, in order to inform existing and future human activities at sea and produce holistic, up-to-date marine spatial plans. |

Figure 31: Map showing the study area in the Bay of Biscay and fishing territory data from 2010 to 2018.

For further information on this case study, please see the following resources:

LEROY Y., 2018. Cartographie critique de réalités géographiques. Cas de la planification de l’espace marin. Analyse comparée franco-canadienne. Thèse de doctorat, Université de Nantes, 346 p.
ST. MARTIN K. et HALL-ARBER M., 2008. . The missing layer: Geo-technologies, communities, and implications for marine spatial planning. Marine Policy, Vol. 32, pp. 779-786

5.2 Enable safe data sharing and trust building

Access control and data sharing agreements

Access control and data sharing agreements are fundamental components for enabling safe data sharing practices. Data sharing agreements formalise the terms and conditions under which data can be shared between parties. These agreements outline the purpose of data sharing, the types of data involved, security protocols, data ownership, confidentiality clauses, and any restrictions or limitations on data usage. By establishing clear guidelines and responsibilities, access control and data sharing agreements help mitigate risks associated with unauthorised access, data breaches, and misuse of sensitive information. The particular aspects of access control and data sharing in the context of Indigenous data sovereigntiy is outlined in Box 23.

Box 23: Safe data sharing and access control in the context of Indigenous data sovereignty | When working with Indigenous communities, access control and data sharing agreements must incorporate culturally sensitive approaches that respect Indigenous data sovereignty. This involves recognizing Indigenous Peoples' rights to control, access, and govern their own data in alignment with their cultural protocols and customary laws. Data sharing agreements should prioritise meaningful engagement with Indigenous communities to co-develop protocols that reflect their values, priorities, and aspirations. Additionally, mechanisms for community consent and decision-making should be integrated into the agreement process, ensuring that Indigenous voices are heard and respected throughout the data sharing journey.

When developing a landing page as a centralised hub for accessing information, resources, and tools related to safe data sharing practices, it is essential to guarantee that it also reflects perspectives, priorities, and needs of Indigenous Peoples and local communities (IPLCs). This may involve incorporating Indigenous languages, local symbols, and imagery to create a welcoming and inclusive space for users. Content should be curated in collaboration with these communities, highlighting examples of successful community-led data initiatives and showcasing culturally relevant resources and tools. Interactive features should provide opportunities for local stakeholders and rights-holders to share their experiences, exchange knowledge, and contribute to ongoing discussions about data sovereignty and self-determination. By centring voices and perspectives of IPLCs, the landing page can serve as a platform for advancing Indigenous data sovereignty and supporting community-led approaches to data governance and sharing (UNESCO-IOC and UNESCO-LINKS, 2024 b).

Please see Chapters 3.3.1 and **6.4** for more details about CARE principles and data sharing agreements in the context of Indigenous data sovereignty. |

5.3 Strategies for managing sensitive data

Managing the curation, hosting, and sharing of data, especially sensitive data, requires implementing robust data security, privacy and safety measures. These measures protect data from unauthorised access on one hand and manage secure data sharing with authorised users on the other. The P-P-T framework, focusing on PEOPLE, PROCESS, and TECHNOLOGY, provides a comprehensive and balanced approach to addressing these challenges. This approach provides a comprehensive strategy by addressing the human, procedural, and technological aspects for handling sensitive data. By leveraging this framework, organisations can create a robust SDI that meets the evolving needs of users and stakeholders while protecting sensitive information and maintaining regulatory compliance.

Facilitating the reuse of sensitive data (R of the FAIR data principles) can benefit the creation of knowledge for the common good. Simply said, it is not because data is sensitive that it cannot be shared but it has to be, in the first place, protected and made accessible under specific regulatory conditions, for clear purposes and with monitored and recorded accesses. The curation, hosting, and sharing of sensitive data require the implementation of robust data security measures. These measures serve a dual purpose: first, to protect the data from unauthorised access, and second, to manage the secure sharing of sensitive data with authorised users.

These methods are implemented under the responsibilities of the PEOPLE managing the SDI. Again, it is about creating trust among all stakeholders. The PROCESS dimension of the Golden Triangle consists of establishing robust data security and privacy policies and incident response plans. The third dimension, TECHNOLOGY, is about implementing advanced security technologies, privacy-enhancing techniques, and safety mechanisms. It is a constantly evolving field in our rapidly advancing digital society, where AI agents are increasingly taking on a significant role.

Figure 32 summarises the Golden Triangle of the P-P-T framework, illustrating its key components and tasks for managing data safely and securely. Details about the components and tasks are outlined in the following text sections.

Figure 32: The Golden Triangle of PEOPLE - PROCESS - TECHNOLOGY under the P-P-T framework supporting the secure management of sensitive data.

5.3.1 PEOPLE: Human resources for data security

PEOPLE are at the heart of any effective security strategy. Establishing clear roles and responsibilities, promoting ongoing training and awareness, and fostering a culture of security is essential for empowering individuals to play their part in safeguarding data. Engaging with stakeholders and rights-holders while ensuring transparent communication further strengthens the overall security posture. The common roles of PEOPLE involved in data security, privacy and safety can be identified as follows: SDI governance team, Chief Information Security Officer (CISO), Data Protection Officer (DPO), IT security officer, data stewards and data users (internal and external of the SDI). They have all different responsibilities that interact with each other at different levels, as outlined in Table 8.

Table 8: The common roles involved in data security, privacy and safety as part of the PEOPLE component under the P-P-T framework.

Position	Responsibilities
SDI governance team	The SDI governance team is responsible for defining and overseeing the implementation and adherence to data security, privacy, and safety policies. They verify that data management practices align with organisational goals and regulatory requirements. The team is comprised of data stewards, security experts, compliance officers, and representatives from key departments of the MSP supporting agency managing the SDI.
Chief Information Security Officer	The Chief Information Security Officer develops security policies, conducts risk assessments, oversees the incident response, and maintains compliance with security standards. He is responsible for the overall security strategy and implementation within the SDI.
Data protection officer (DPO)	Organisations processing personal data might have to appoint a Data Protection Officer according to the applicable legislation. The DPOs make sure that the organisation complies with data protection regulations. The management of personal data may not directly apply to an SDI for MSP, nevertheless as DPOs are responsible for managing access to sensitive data and monitoring data processing activities, a number of tools that have been developed for DPOs can be reused in the context of an SDI for MSP.
IT security officer	The IT security officer is tasked with implementing and maintaining security measures and responding to security incidents. Their team is responsible for managing firewalls, intrusion detection systems, encryption tools, and conducting regular security audits and vulnerability assessments.
Data stewards	Data stewards are responsible for data quality and integrity. They verify that data is accurate, consistent, and accessible, and implement data governance policies within their departments. Data stewards create processes and procedures that monitor and enforce data governance policies. They establish guidelines for data handling, quality assessments, and data security. Data stewards track quality, resolve data-related issues, and enforce compliance with regulatory requirements.

5.3.2 PROCESS: Framework, processes and policy for data security

The PROCESS component of the P-P-T framework plays a crucial role in providing the structure and consistency required for secure data management. Developing and enforcing comprehensive security and privacy policies, implementing robust incident response plans, and conducting regular audits and risk assessments verify that the SDI operates within a well-defined framework. These processes help identify and mitigate risks, maintain data integrity, and monitor compliance with relevant regulations and standards. All processes have to be documented and kept updated. This section outlines the key processes necessary to maintain data security, privacy, and safety within an SDI.

Risk mitigation measures

The purpose of risk mitigation measures is to safeguard sensitive information from potential threats and vulnerabilities. These measures aim to reduce the likelihood and mitigate the impact of threats such as data breaches and system failures.

(i) Policy framework for all aspects of data handling

Policy development is about developing a comprehensive data security policy framework that covers all aspects of data handling, including collection, storage, processing, sharing, and disposal of spatial data. Engage key stakeholders, including data providers, data users, and security experts, in the policy development process to assure that all perspectives are considered.

About data sharing, it is important to develop protocols for secure data sharing, including:

Data sharing agreements: Formalise agreements that define the terms and conditions of data sharing between entities. The terms and conditions of data sharing should be publicly accessible, for instance, from the metadata record of the sensitive dataset.
Secure transfer methods: if data must be transferred, use secure methods for data transfer, such as secure file transfer protocols (SFTP) or virtual private networks (VPN).
Data use restrictions: Guarantee shared data is used only for the agreed purposes and is not further shared without consent. When data is made available and processed within a Secure Processing Environment under the governance verify that the analysed output does not retain any sensitive information and that it complies to the agreed sharing purposes.

About data disposal, establish procedures for the secure disposal of data that is no longer needed, including:

Data Destruction: Confirm data is irretrievably destroyed using methods such as shredding, degaussing, or secure deletion.
Retention Policies: Develop and enforce comprehensive data retention policies that comply with all relevant legal and organisational requirements. These policies should assure that sensitive data has a clearly defined and verifiable retention period.

(ii) Compliance and audits

Regulatory compliance: Verify that all data security policies comply with relevant regulations and standards, such as the GDPR in the EU, ISO/IEC 27001⁷⁰, and other applicable laws.
Audits: Conduct regular internal or external audits to verify compliance with established policies and to identify areas for improvement, identifying and addressing potential vulnerabilities of the systems such as data processing systems, servers and security tools.
Logs audits: Regularly review system logs, including access logs, to detect any deviations in system behaviour. Monitoring and tracking access logs should be an integral part of data sharing policies. In particular, implement the following practices to facilitate effective log auditing:
- Access monitoring: Continuously monitor access logs to track who accessed the data, when, and what actions were performed. This process supports accountability in regard to the data owners.
- Automated alerts: Set up automated alerts for any suspicious or abnormal activities detected in the logs. AI agents might be useful to identify in real time any deviations in system behaviour. This enables prompt response to potential security threats.

(iii) Risk management

Incident response plan: Establish a clear incident management framework to detect, respond and recover to data breaches and security incidents effectively. This should include procedures for detection, reporting, containment, investigation, and remediation. As part of the data strategy, a comprehensive incident response plan outlining the steps to be taken in the event of a data breach or security incident has to be developed. This plan defines clearly the roles and responsibilities of team members during an incident, including communication protocols and escalation procedure.
Impact assessment: Evaluate the potential impacts of security incidents. Specifically, identify critical systems and develop mitigation measures to verify compliance with obligations outlined in the Service Level Agreement (SLA).

(iv) Data privacy policies

Data minimisation: Collect only the data necessary for specific, legitimate purposes and confirm that it is used solely for those purposes. Data minimisation principles are equally crucial when sharing data.
Purpose limitation: Share only the data necessary for specific, legitimate purposes and secure that it is used solely for the purposes declared by the data users.
Data anonymisation and pseudonymisation: Implement data anonymisation and pseudonymisation techniques to protect sensitive data while maintaining its utility for analysis. Pseudonymisation replaces identifiable information with pseudonyms, while anonymisation removes all identifiable information altogether.

A large ship in the water AI-generated content may be incorrect.

5.3.3 TECHNOLOGY: Technology solutions for data security

Implementing security technologies, such as network encryption, firewalls, and intrusion detection systems, protects data from unauthorised access and cyber threats. Privacy-enhancing technologies, such as data masking and data encryption, safeguard sensitive information. Additionally, robust safety mechanisms, including backup and recovery solutions and redundancy are typical IT practices that provide for data availability and reliability.

This section outlines the key technological solutions and good practices necessary to enhance security, privacy and safety advocating the use of Secure Processing Environments for sharing sensitive data. By implementing and managing Secure Processing Environments (SPEs), SDIs verify that data remains in their jurisdictional boundaries. The SDI keeps control over its sensitive data and reduces the risk of breaches by forbidding the copy or move of its sensitive data. Only authorised data users have access to minimised datasets keeping control over the execution of the MSP initiative.

Access control

Access Control verifies that only authorised data users can access sensitive data. This involves implementing robust authentication mechanisms and access control policies

Role-Based Access Control (RBAC): Implement RBAC to control that individuals have access only to the data and systems necessary for their roles.
Authentication and authorisation: Implement Multi-Factor Authentication (MFA) for all users to enhance security by requiring multiple forms of verification.
Single Sign-On (SSO): Use SSO solutions to simplify access management and improve security by reducing the number of passwords users need to manage.

Data encryption

Data encryption enhances security across all phases of data processing. Encryption of data should be carried out both in transit and at rest to safeguard against unauthorised access. This practice assures that intercepted data remains unreadable without the appropriate decryption key. Data leakage risks are present at all stages of data processing (collection, storage, transfer, and computation). Encrypting data throughout these stages is crucial for maintaining the confidentiality and integrity of sensitive information. Two encryption techniques can be distinguished by their use case:

Symmetric key encryption: Often used for encrypting large volumes of data due to its speed and efficiency. The symmetric key encryption relies on a single key for both encryption and decryption. If the advantage is the fast bulk encryption of a large amount of data, its disadvantage lies in the challenge of managing and sharing securely the same key between parties.
Asymmetric key encryption: Commonly used for secure data transmission and digital signatures, the use of a public key for encryption and a private key for decryption enhances security as only the public key is shared openly without compromising security. For example, in the context of accessing, via SSH, virtual machines that would be managed by the SDI, the data user will generate a public key and a private key. Only the public key will be shared openly, while the private key is kept secret by the data user, owner of the keys.

Secure processing environments

Establishing secure processing environments (SPEs) for processing sensitive data prevents data transfer outside the premises of the SDI and mitigates associated risks of transferring sensitive data. These environments should be project-specific and adhere to high technical and security standards to provide for the safety of data processing activities. Some key aspects of Secure Processing Environments are:

Controlled access: SPEs should be accessible only per data-sharing project, ensuring that data is available solely to authorised users involved in the MSP initiative. Implement a Role-Based Access Control to restrict access based on user roles, ensuring that users can access only the data and functions necessary for their role. Monitor and record all accesses and processing activities within the SPE.
Technical and security standards: Verify SPEs comply with relevant regulations and standards such as GDPR, ISO 27001, and other security-specific guidelines.
Technical implementations: Rely on a virtualisation technology to create isolated environments for each project. It offers a flexible and efficient alternative to building ad-hoc infrastructure for sharing sensitive data. Virtualisation enhances security by isolating each environment, preventing unauthorised access and data leaks. A variety of virtualisation technologies, such as virtual machines, virtual labs, and containers, can be tailored to meet specific project needs, providing both flexibility and security. These customised execution environments can include all necessary tools and resources for each project, ensuring compliance with data sharing requirements and regulatory standards. The choice of virtualisation technology largely depends on the financial and human resources available within the SDI. Cloud services, if they comply with regulatory obligations, offer further cost benefits by providing scalable resources on demand.

Data throughput refers to the amount of data that can be transmitted, processed or accessed within a given time, usually measured in units like bits, bytes or megabytes per second. It reflects how efficiently the SDI handles data flow between servers, services and users.↩︎