Series
Blogs
Data breaches under the GDPR: Five key questions
Data breaches under the GDPR: Five key questions
28 June 2018
Series
Blogs
28 June 2018
This summary provides a very brief overview of the legal and commercial issues you should consider if you suffer a personal data breach under the EU General Data Protection Regulation (the “GDPR”). It just considers the position in the UK. However, similar obligations apply in other EU Member States.
Where a controller1; suffers a personal data breach, that controller must:
A personal data breach is one that affects the confidentiality, integrity or availability of personal data. Importantly, the breach does not have to involve a third party acquiring the information. Accidental deletion of personal data or ransomware attacks are also caught. In addition, the GDPR is only relevant if the breach involves personal data (e.g. information about employees or consumers). If the breach only involves corporate information (e.g. financial results), these obligations will not be triggered.
Whether the personal data breach creates “risk” or “high risk” is a question of fact. For example, if a confidentiality breach involves information such as names, dates of birth and bank account information, the individuals might be vulnerable to identity theft and so the breach should be treated as high risk.
The information received in the early stages of a serious data breach is not always accurate or complete. However, if you are aware of a personal data breach that creates risk, you should normally report it to the Information Commissioner even if you will need to provide further information when it becomes available. Only in limited circumstances will it be possible to argue that notification within 72 hours is not “feasible”.
A controller can suffer a personal data breach in respect of personal data held by its processor. The contract with the processor should include an obligation on the processor to inform their controller when a personal data breach has occurred.
The Information Commissioner’s current practice is to ask that breaches are reported by telephone (though in some cases they may ask for confirmation in writing).3
Notification can also be made by completing a pro-forma word document and emailing it to the Information Commissioner. This can be used if you are confident you have dealt with the breach appropriately or you want to report the breach outside normal opening hours. In practice, if you are going to report the breach by telephone, it would be sensible to complete the online form beforehand to ensure you have the relevant information to hand.
Reporting the personal data breach to the Information Commissioner is only part of your response to the data breach. Other measures to consider include:
There are two potential areas of liability under the GDPR:
The GDPR is not the only area of law or potential liability to consider if you suffer a personal data breach. Other issues to consider include:
A checklist for dealing with personal data breaches is available on request from your usual contact at Linklaters.
1.Under the GDPR, the controller is the person who decides how personal data is used. It contrasts with a processor, who simply acts on the instructions of the controller.