{"id":638,"date":"2019-09-14T13:55:45","date_gmt":"2019-09-14T13:55:45","guid":{"rendered":"http:\/\/www.dataprotectionconsultant.it\/EN\/?p=638"},"modified":"2020-06-02T14:00:18","modified_gmt":"2020-06-02T14:00:18","slug":"data-breach-full","status":"publish","type":"post","link":"https:\/\/www.dataprotectionconsultant.it\/EN\/data-breach-full\/","title":{"rendered":"Data breach – learn more"},"content":{"rendered":"

\"\"<\/a>\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

Personal data breach (data breach)<\/strong><\/span><\/p>\n

Personal data breach<\/strong><\/span><\/p>\n

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed<\/span>. One of the requirements of the GDPR is that, by using appropriate technical and organisational measures,<\/span> personal data shall be processed in a manner to ensure the appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage<\/span>.<\/strong><\/span><\/p>\n

Accordingly, both controllers and processors<\/a><\/span><\/span> are required to implement technical and organisational measures to ensure a level of security appropriate to the risk<\/a><\/span> posed to the personal data being processed<\/span>.<\/strong><\/span><\/p>\n

A key element of any data security policy is being able, where possible, to prevent a data breach <\/span>and, where it nevertheless occurs, to react in a timely manner<\/span>. To take the appropriate steps to address a data breach, the controller should be able to recognise it<\/span>.<\/strong><\/span><\/p>\n

The meaning of destruction<\/span>\u00a0should be quite clear: it occurs when personal data no longer exist or no longer exist in a form which is of any use to the controller<\/span>. The meaning of damage<\/span> should also be quite clear: a damage occurs when personal data have been modified, altered or are no longer complete<\/span>. In the case of loss<\/span>, personal data may still exist, but the controller may have\u00a0lost their control or may not be able to access to data, or, otherwise, data are no longer in the controller\u2019s possession. Unauthorised and unlawful\u00a0processing may include the disclosure of personal data to (or the access by) recipients<\/a> <\/span>not authorised to receive (or to access to) personal data or any other form of processing infringing the GDPR<\/span>.<\/strong><\/span><\/p>\n

There are three types of data breach:<\/strong><\/span><\/p>\n

1. confidentiality breach, where there is an unauthorised or accidental disclosure of or access to personal data <\/strong><\/span><\/p>\n

2. integrity breach, where there is an unauthorised or accidental alteration of personal data <\/strong><\/span><\/p>\n

3. availability breach, where there is loss, or accidental or unauthorised destruction of or access to personal data.<\/strong><\/span><\/p>\n

A data breach may concern confidentiality, integrity and availability at the same time, as well as a combination of these<\/span>.<\/span><\/strong><\/p>\n

Whereas determining if there has been a breach of confidentiality and integrity of data is quite clear, whether there has been an availability breach may be less obvious<\/span>. A breach should always be regarded as an availability breach when there has been a permanent loss of, or destruction of, data<\/span>. For instance, it occurs when data have been deleted either accidentally or by unauthorised persons, or in the example of securely encrypted data, the decryption key has been lost. If the controller cannot restore access to data, for example from a backup, this is regarded as a permanent loss of availability. It may occur a loss of availability also when there has been a meaningful<\/span> disruption of a normal service, such as an energy power failure.<\/span><\/strong><\/p>\n

A security incident which results in a lack of availability of personal data for a period of time is also a type of breach<\/span>, since the lack of access to data may have a meaningful<\/span> impact on the rights and freedoms of individuals. On the contrary, the lack of availability of data due to planned system maintenance being carried out is not a breach of security<\/span>. A temporary disruption of energy power<\/span> is not a breach of security as well.<\/span><\/strong><\/p>\n

As with the permanent loss or destruction of personal data (or any other type of breach), a temporary loss of availability of personal data should be recorded, in accordance with the principle of accountability<\/a><\/span><\/span>.<\/span><\/strong><\/p>\n

Therefore, a record of all data breaches<\/span> shall be maintained, regardless of the obligation of the notification to the supervisory authority and, if the case, of the communication to the affected data subjects.\u00a0 <\/span><\/strong><\/p>\n

The obligations of the processor<\/a><\/span><\/span> as regards data breach<\/strong><\/span><\/p>\n

The GDPR requires that both the controller and the processor<\/a><\/span><\/span> should implement technical and organisational measures to ensure a level of security to the risk<\/a><\/span><\/span> posed to the personal data being processed. Therefore, both controllers and processors<\/a><\/span><\/span> are required to have protection procedures appropriate to establish immediately whether a data breach has occurred<\/span>, which then determines whether there is the obligation of notification.<\/strong><\/span><\/p>\n

Even though the controller retains overall responsibility for the protection of personal data, the processor<\/a><\/span><\/span> plays an important role to enable the controller to comply with its obligations, including the obligation of notification to the supervisory authority and, in certain cases, of communication to the affected data subjects.<\/strong><\/span><\/p>\n

Processing carried out by a processor<\/a><\/span> shall be governed by a contract and the GDPR provides that the processor<\/a><\/span> shall assist the controller in ensuring compliance with all the obligations of the GDPR, which means also the obligations concerning data breach. If the processor<\/a><\/span><\/span> becomes aware of a breach concerning personal data processed on behalf of the controller, it must notify it to the controller \u00abwithout undue delay<\/em>\u00bb. It should be pointed out that the processor<\/a><\/span> does not need to first assess the likelihood of risk<\/a><\/span> arising from a breach before notifying the controller<\/span>; this assessment must be made by the controller \u00abon becoming aware<\/em>\u00bb of the breach<\/span>. The processor<\/a><\/span> just needs to establish whether a breach has taken place and then notify it to the controller. The controller engages a processor<\/a><\/span><\/span> to achieve its purposes, therefore, in principle, the controller is \u00abaware<\/em>\u00bb of the breach once the processor<\/a><\/span><\/span> has informed it of the breach.<\/strong><\/span><\/p>\n

The obligation of the processor<\/a><\/span> to notify the breach allows the controller to address the breach and establish whether or not it is required to notify the supervisory authority and communicate to the affected persons. The controller might also investigate the breach, since the processor<\/a><\/span> might not have knowledge of all the facts relating to the matter<\/span>: for instance whether the controller has a copy, or a backup of data destroyed or lost. This may affect whether the controller would need to notify the breach to the supervisory authority and communicate it to persons involved.<\/strong><\/span><\/p>\n

The GDPR does not provide for a specific limit within which the processor<\/a><\/span><\/span> is required to notify the controller. It only requires that the processor<\/a><\/span><\/span> informs the controller \u00abwithout undue delay<\/em>\u00bb. Therefore, the processor<\/a><\/span><\/span> needs to promptly notify the controller, providing further information in phases when more details become available<\/span>. This is quite important to help the controller to meet the requirement of the obligation of the notification to the supervisory authority \u00abwithout undue delay<\/em>\u00bb and, anyway, \u00abwithin 72 hours<\/em>\u00bb.<\/strong><\/span><\/p>\n

Where the processor<\/a><\/span> provides the service to multiple controllers affected by the same incident<\/span>, the processor<\/a><\/span><\/span> will have to report the details of the incident to each controller<\/span>.<\/strong><\/span><\/p>\n

The processor<\/a><\/span><\/span> can make the notification on behalf of the controller only if it has been given a proper authorisation by the controller and this is part of the contractual agreements<\/span> between the controller and the processor<\/a><\/span><\/span>.<\/span> Anyway, the legal responsibility to notify remains with the controller<\/span>.<\/strong><\/span><\/p>\n

When to notify a personal data breach to the supervisory authority<\/span><\/strong><\/p>\n

The GDPR requires to notify the data breach to the supervisory authority when the breach is likely to result in a risk<\/a><\/span>\u00a0to the rights and freedoms of individuals. Not necessarily the risk<\/a><\/span> needs to be high<\/span>.<\/span><\/strong><\/p>\n

In fact, the controller should notify the data breach to the supervisory authority \u00abwithout undue delay<\/em>\u00bb and, where feasible, \u00abwithin 72 hours<\/em>\u00bb after having become \u00abaware<\/em>\u00bb of the breach<\/span>, \u00abunless it is unlikely to result in a risk to the rights and freedoms of data subjects<\/em><\/span>\u00bb.<\/strong><\/span><\/p>\n

It should be ascertained whether all appropriate technological protection and organisational measures have been implemented to establish immediately whether a personal data breach has taken place and to inform promptly the supervisory authority and data subjects concerned. In addition, it should be ascertained that the notification has been made \u00abwithout undue delay<\/em>\u00bb, taking into account the nature and the severity of the personal data breach<\/span> and the consequences and its adverse effects for the data subject<\/span>.<\/strong><\/span><\/p>\n

It is quite important to clarify when the controller should be regarded as \u00abbecoming aware<\/em>\u00bb of a data breach. It can be considered that the controller should be regarded as \u00abaware<\/em>\u00bb when it has reasonable certainty<\/span> that a security incident has taken place and has led to the personal data being compromised. Therefore, the controller is required to put in place all the necessary measures to ensure that it can becomes \u00abaware<\/em>\u00bb of any breach in a timely manner so that it can take appropriate action. The exact moment depends on the circumstances of the breach. In some cases, it will be relatively evident from the outset that there has been a breach, whereas in others, it would take time to establish whether personal data have been compromised. Anyway, the emphasis should be on the prompt action to investigate the incident in order to establish whether personal data have indeed been compromised and, if so, to take remedial action and notify, if required. It may take the controller a short period of investigation to determine whether the breach has indeed occurred. During this period, the controller should not be regarded as being \u00abaware<\/em>\u00bb<\/span>.\u00a0The investigation should begin as soon as possible in order to determine with reasonable certainty where a breach has occurred; a more detailed investigation may then be carried out.\u00a0Once the controller has become \u00abaware<\/em>\u00bb of a breach which requires notification, the notification should be made \u00abwithout undue delay<\/em>\u00bb, and where feasible, \u00abnot later than 72 hours<\/em>\u00bb. The GDPR recognises that the controller may not always have all necessary information<\/span> concerning a breach within 72 hours from\u00a0becoming \u00abaware<\/em>\u00bb of the breach, since full and comprehensive details of the incident may not always be available during this period. Therefore, the GDPR allows for a \u00abnotification in phases<\/em>\u00bb. If there is certainty that there has been a notifiable breach, it is recommended notifying it within 72 hours, explaining that further details will be provided later.<\/strong><\/span><\/p>\n

The supervisory authority should agree how and when further information should be provided. This does not prevent the controller from providing other relevant information at any time, once it has knowledge of further relevant details of the breach which need to be reported to the supervisory authority.<\/strong><\/span><\/p>\n

Information to be provided to the supervisory authority<\/strong><\/span><\/p>\n

The GDPR prescribes that the notification should contain, at least<\/span>:<\/strong><\/span><\/p>\n

1. description of the nature of the breach including, where feasible, the categories and the approximate number of data subjects concerned, and the categories and the approximate number of personal data records concerned<\/strong><\/span><\/p>\n

2. name and contact details of the DPO<\/a><\/span><\/span> or of another contact point where more information can be obtained<\/strong><\/span><\/p>\n

3. description of the likely consequences of the data breach<\/strong><\/span><\/p>\n

4. description of the measures taken or proposed to be taken by the controller to address the data breach, including, where appropriate, to mitigate its possible adverse effects.<\/strong><\/span><\/p>\n

The GDPR does not define the categories of data subjects or personal data records. The categories of data subjects<\/span> should refer to the various types of individuals whose data have been compromised (e.g.: employees, vulnerable people, patients, customers, children). The categories of personal data records<\/span> refer to the various type of records which the controller may process (e.g.: health data, educational data, social care information, financial details, bank account numbers, credit cards details).<\/strong><\/span><\/p>\n

Among others, the purpose of notification is limiting damage to persons<\/span>. Therefore, if the types of data subjects or the types of personal data indicate a particular risk<\/a><\/span><\/span> of damage arising from a breach (e.g.: identity theft, fraud, financial loss), it is important that the notification indicates these categories. By doing so, the obligation of describing the categories is linked to the obligation of describing the likely consequences of the breach. The fact that there is no precise information available (such as the exact number of data subjects concerned) should not prevent from making a prompt breach notification. The GDPR allows for approximations to be made in the number of persons affected and the personal data records concerned<\/span>. Therefore, the controller should focus on addressing the adverse effects of the breach rather than providing exact figures. When it is clear that a data breach has occurred, but the extent of it is not yet known, a \u00abnotification in phases<\/em>\u00bb is a safe way to meet the notification obligation. The different types of breaches (confidentiality, integrity and availability) may require further information to comprehensively explain the circumstances of each case. The supervisory authority may request other details in order to investigate the breach. \u00a0<\/strong><\/span><\/p>\n

In August 2019, the Italian supervisory authority issued a format<\/a><\/span><\/span>\u00a0(Italian version) to notify a data breach. The notification shall be sent to the supervisory authority to the certified e-mail protocollo@pec.gpdp.it<\/a><\/span><\/span> or to the e-mail protocollo@gpdp.it<\/a><\/span><\/span>, signed digitally or by autograph signature. In the latter case, a copy of an identity document<\/span> shall be attached to the notification. The message must contain the subject \u00abNotification of data breach<\/em>\u00bb and, on an optional basis, the controller’s identity<\/span>.<\/strong><\/span><\/p>\n

When to communicate a personal data breach to data subjects<\/strong><\/span><\/p>\n

In certain cases, the controller is required to communicate the breach to the persons concerned. The GDPR prescribes that the controller shall communicate the breach to data subjects, \u00abwithout undue delay<\/em>\u00bb, when it is likely to result in a high risk<\/a><\/span><\/span> to the rights and freedoms of persons. The controller should bear in mind that the notification is required if the breach is likely to result in a risk<\/a><\/span> to the rights and freedoms of data subjects, whereas the communication to data subjects is required only if the breach is likely to result in a high <\/span>risk<\/a><\/span>. <\/span>The communication should be made \u00abwithout undue delay<\/em>\u00bb, which means as soon as possible. The aim of the communication is to provide specific information about steps which persons affected should take to protect themselves from any adverse effects arising from the breach.<\/strong><\/span><\/p>\n

Information to be provided to data subjects<\/strong><\/span><\/p>\n

The communication to data subjects should contain, at least<\/span>:<\/strong><\/span><\/p>\n

1. description of the nature of the breach<\/strong><\/span><\/p>\n

2. name and contact details of the DPO<\/a><\/span><\/span> or other contact point<\/strong><\/span><\/p>\n

3. description of the likely consequences of the breach<\/strong><\/span><\/p>\n

4. description of the measures taken or proposed by the controller to address the breach including, where appropriate, to mitigate its possible adverse effects.<\/strong><\/span><\/p>\n

The controller may provide additional information.<\/strong><\/span><\/p>\n

The communication should describe in a clear and plain language the nature of the breach.<\/strong><\/span><\/p>\n

As a rule of thumb, the data breach shall be communicated to data subjects directly, unless doing so would involve a disproportionate effort<\/span>. In this case, the controller shall instead make a public communication or take a similar measure which allows to inform data subjects in an equally effective manner<\/span>.<\/strong><\/span><\/p>\n

Flowchart showing notification and communication requirements<\/strong><\/span><\/p>\n

\"\"<\/p>\n

 <\/p>\n

To learn more, read FAQs<\/a><\/span><\/span> or contact me<\/a><\/span><\/span>.<\/strong><\/span><\/p>\n

 <\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

    Personal data breach (data breach) Personal data breach A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. One of the requirements of the GDPR is that, by using appropriate technical and … <\/p>\n

Continue reading “Data breach – learn more”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts\/638"}],"collection":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/comments?post=638"}],"version-history":[{"count":29,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts\/638\/revisions"}],"predecessor-version":[{"id":1085,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts\/638\/revisions\/1085"}],"wp:attachment":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/media?parent=638"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/categories?post=638"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/tags?post=638"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}