Background of Breach Notifications in the GDPR
In 2016, the GDPR passed into law, and its purpose was to award rights to individuals over their personal data through a uniform standard of protection across the EU. In this spirit, the GDPR has very strict personal data breach notification requirements with very tight deadlines.
What is a Personal Data Breach?
The GDPR defines a personal data breach as a security incident leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed by an organization.
A personal data breach can be of three types:
Confidentiality Breach:
A confidentiality breach happens when there is unauthorized or accidental disclosure of, or access to, personal data. An example of this kind of data breach can be an email with the personal data of an organization's employees, including name, address, salary, national insurance number, and date of birth, which is inadvertently sent to the wrong recipient.
Integrity Breach:
An Integrity breach happens when there is an unauthorized or accidental alteration of personal data. An example of this kind of data breach can be when incorrect contact details are updated by accident or a wrong individual was contacted with details relating to another individual.
Availability Breach:
An availability breach happens when there is an unauthorized or accidental loss of, access to, or destruction of personal data. This will include both the permanent and temporary loss of personal data—for example, a cybersecurity breach in which an individual's data is accidentally deleted from the database.
A personal data breach leads to significant harm to the data subject and may result in physical, material, or non-material damage to him/her, including emotional distress.
The GDPR requires organizations to report personal data breaches to supervisory authorities and impacted data subjects. However, not every personal data breach needs notification.
Let's explore the circumstances under which a personal data breach warrants notification along with other breach notification requirements.
Which personal data breaches must be reported under the GDPR?
As per Articles 33 and 34 of the GDPR, only those personal data breaches that are likely to result in a risk to the rights and freedoms of data subjects require notification. The organization must notify all such breaches to the supervisory authority. Where the risk to the rights and freedoms of data subjects is high, organizations must also notify the impacted data subjects without undue delay.
Which parties are required to be notified and what are notification timelines?
As per Articles 33 and 34 of the GDPR, three parties are required to be notified:
- Supervisory authority: Notification to the supervisory authority must be made without undue delay and not later than 72 hours after having become aware of the breach.
- Impacted data subjects: Notification to impacted data subjects must be made without undue delay.
- Data controller: Processors must notify data controllers of any personal data breaches to help them fulfill their breach notification requirements on time.
Can a notification be delayed?
Where the notification to the supervisory authority is not made within 72 hours, the notification must be accompanied by reasons for the delay. The information relating to a personal data breach may also be provided in phases to the supervisory authority if it is not possible to provide the information at the same time. However, all available information must be provided without unneeded delays.
What should a personal data breach notification consist of?
The personal data breach notification should, in clear and plain language, consist of the following:
- Description of the nature of the personal data breach, including the categories and an approximate number of data subjects and data records involved.
- Name and contact details of the DPO or other contact points from which more information can be obtained.
- Likely consequences of the personal data breach.
- Measures taken or proposed to be taken to address the personal data breach, including any measures to mitigate its possible adverse effects.
Are there any exceptions to the breach notification requirement?
There are no exceptions as far as the breach notification to the regulatory authority is concerned. The notification to impacted data subjects may not be required under any of the following conditions:
- The controller has implemented appropriate technical and organizational measures such as encryption that render the personal data useless to any unauthorized person.
- The controller has taken subsequent measures that ensure that the high risk to the rights and freedoms of data subjects is no longer likely to materialize.
- It would involve a disproportionate effort to notify data subjects. In such a case, the data controller shall issue a public communication or similar announcement whereby the data subjects are informed in an equally effective manner.
Are there any breach documentation requirements?
Under Article 33(5) of the GDPR, data controllers must document any personal data breaches. Such documentation must consist of at least the facts relating to the breach, its effects, and the remedial actions taken. Organizations must also document the steps and actions they have taken after a security incident into one breach report even if they are not required to notify the regulatory authority or data subjects. Such breach reports will help them demonstrate compliance with the regulatory authority.
Can a supervisory authority require the controller to notify the personal data breach?
Under Article 34(4) of the GDPR, the supervisory authority may require the data controller to notify a personal data breach to data subjects if it has not done so. In that case, the supervisory authority shall take into consideration whether the personal data breach is likely to result in a high risk to data subjects.
How can you prevent a Personal Data Breach?
To prevent personal data breaches, organizations must implement appropriate security controls relevant to the circumstances of data processing. Such security controls may be preventative (security measures to limit the personal data breaches) and remedial (mitigation measures to limit the impact of a personal data breach that has happened) in nature.
Organizations must consider the following factors while choosing an appropriate security control for the protection of personal data:
- Nature, scope, context, and purposes of personal data processing:
The nature, scope, context, and purposes of data processing may affect the risks to the rights and freedoms of data subjects. For example, the more sensitive the data is, the higher the risk of harm will be. Even a small amount of highly sensitive personal data can have a high impact on an individual. Therefore, such factors must be taken into account while implementing a security control.
- Industry best practices around security controls:
Data security is a domain of professional expertise. Therefore, organizations must consider industry best practices in choosing an appropriate security control. For example, encryption is one of the industry-acceptable security measures.
- Costs of implementation of security controls:
A security control does not need to be exorbitantly expensive, and organizations must consider the cost of implementing the security controls. Companies must financially invest in security measures and implement cost-determinative security controls.
In addition to the considerations above, an ideal security control must have the following abilities:
- Ability to restore the availability and access to personal data promptly in the event of a security incident.
- Ability to render the data unintelligible for any person who is not authorized to access it.
- Ability to ensure confidentiality and integrity of data processing systems and services.
Despite security controls, security incidents will inevitably take place. However, not every security incident qualifies as a personal data breach, and not every personal data breach requires notification to the regulatory authority and impacted data subjects. Therefore, every organization must have an effective and robust breach response management process. It must have a mechanism in place to determine when a security incident is considered a personal data breach when a personal data breach needs to be notified, identify areas of improvement, and implement necessary remediation measures to reduce consequences to data subjects.
Responding to a personal data breach under GDPR compliance
Once a security incident has taken place, an organization must immediately respond to it. An effective breach response mechanism has the following steps:
Containment of the security incident:
The first step is to contain the security incident immediately by trying to get lost information back, disabling the breached system, canceling or changing computer access code, or trying to fix any weakness in the organization's physical or technical security. The containment of the security incident enables organizations to mitigate the risks posed to data subjects.
Data Breach Assessment:
The second step is to determine whether the security incident qualifies as a personal data breach. The definition of a personal data breach differs from one privacy law to another, and therefore, the organization must conduct the data breach assessment relevant to its jurisdiction.
Data Breach Risk Severity Assessment:
Once a personal data breach has been determined, the next step is to evaluate the severity of the potential or actual impact on data subjects as a result of the breach and the likelihood of this occurrence. This should be done by taking into consideration the nature of the harm that may be caused to data subjects, whether the breached personal data was sensitive, whether the breached personal data was protected by a security control and any other relevant factors. The data breach risk severity assessment enables organizations to determine their breach notification requirements.
Breach notification:
After the data breach risk severity assessment is conducted, the results inform the organization whether it is required to notify the breach to a regulatory authority or impacted data subjects or both. It must fulfill its breach notification obligations within stipulated time frames to avoid any penalties and sanctions. These requirements have been discussed in detail above.
Reviewing security controls:
After the occurrence of every security incident and personal data breach, the organization must review and update its data breach response mechanism. It must assess the effectiveness of security controls to prevent security incidents and data breaches in the future.
GDPR Personal Data Breach Fines
Failure to notify a personal data breach as per the requirements of the GDPR may expose your organization to a regulatory fine of up to 10,000,000 euros or 2% of the total worldwide annual turnover of the preceding financial year (whichever is higher) and other penalties.
Recent examples of fines and penalties imposed on organizations that failed to comply with privacy regulations:
As far as the imposition of fines is concerned, there have been several cases where organizations had to pay vast amounts of money for failing to comply with applicable data privacy regulations. For example:
- British Airways (BA) was fined a record £183 million [~$230 million] after the airline was fined by the UK's data protection authority, the ICO. (Source: CSO Online)
- Marriott International was initially fined £99 million [~$124 million] after payment information, names, addresses, phone numbers, email addresses, and passport numbers of up to 500 million customers were compromised. The source of the breach was Marriott's Starwood subsidiary; attackers were thought to be on the Starwood network for up to four years after it was bought by Marriott in 2015. (Source: CSO Online)
- Twitter was fined €450,000 in Ireland, on 2020-12-15, for Insufficient fulfillment of data breach notification obligations. (Source: Twitter Final Decision)
- Booking.com was fined €475,000 in the Netherlands, on 2020-12-10, for Insufficient fulfillment of data breach notification obligations. (Source: Booking.com Final Decision)
How does Securiti help automate Data Breach Management?
Securiti's Data Breach Management provides a comprehensive workflow to manage the entire breach management lifecycle. It comes integrated with other product modules to provide out-of-the-box automation for various aspects of breach management.
Securiti offers an automated and integrated approach that has three components.
