Summary
Yes: no channel is prohibited by the GDPR. The regulation asks for the document to be lightened to the strict necessary, for protection to be proportionate to the risk, and for the response to be planned in case of error. The fax line not being encrypted, vigilance bears first on the accuracy of the number and on the room where the correspondent's machine sits.
The GDPR reasons in terms of risks
No list of permitted channels in the European regulation. Sending a document that identifies someone is a processing of data, by post, email or fax without distinction. Three requirements then apply: share only what is useful, adjust security to the sensitivity of the information, plan the course to follow if an incident occurs.
The particularities of faxing
On Faxeroo, the PDF climbs encrypted in HTTPS then erases itself once the send has passed; the telephone line leading to the arrival machine, for its part, is not encrypted, as with any fax. The effective measures therefore belong mostly to organisation.
Health data constitutes a category apart. Before sending, ask the correspondent whether they offer an exchange space reserved for carers or a secure portal: the page devoted to faxes and medical data takes stock.
Before sending: the checklist
Mask or remove whatever the step does not call for. Copy the number from a recent document, then re-read it before activating the confirmation link. Write the recipient's name, followed by "confidential", in the message of your cover sheet. Warn them by telephone, and ask them to confirm the good receipt.
Fax fallen on a wrong number? Contact the person who received it, demand the destruction of the pages and note the incident in writing. Depending on the seriousness, the data protection authority will have to be alerted, within 72 hours at the latest.
Key points
- Faxing possible in the sense of the GDPR, provided minimisation and security.
- Line in the clear: the precautions are above all organisational.
- Number checked, "confidential" mention, correspondent warned.
- Wrong number: destruction demanded, incident recorded and, if needed, notification.