A personal data breach means an event leading to the destruction, loss, alteration or unauthorised disclosure of, or access to, personal data.
mailing a bank statement to the wrong person.
A personal data breach can have consequences such as loss of control over personal data, identity theft or fraud, damage to reputation, or the reversal of pseudonymisation or loss of confidentiality of personal data.
Both the controller and processor of personal data must protect the data with security measures corresponding to the risk related to the processing of personal data. The controller must also prepare for possible personal data breaches by drawing up guidelines for the eventuality of personal data breaches and be able to react to personal data breaches as quickly as possible.
notification to the data subjects.
Document all personal data breaches, their effects and the remedial actions taken, regardless of the measures eventually required by the personal data breach. Neglect of the documentation obligations or notifications constitutes an infringement of the General Data Protection Regulation (GDPR) and may result in the sanctions specified therein.
Personal data breaches must be reported to the Office of the Data Protection Ombudsman without undue delay and, where feasible, not later than 72 hours after the controller has become aware of the personal data breach. The processor shall first notify the controller of the personal data breach, unless it has been specifically agreed that the controller can notify the Office of the Data Protection Ombudsman directly of personal data breaches. However, the responsibility for making the notification remains with the controller.
The controller must deliver a justified explanation to the Office of the Data Protection Ombudsman if the notification was not made within 72 hours.
When should data subjects be notified of personal data breaches?
Data subjects must be notified of personal data breaches if they are likely to cause a high risk to their rights and freedoms. The controller shall then communicate the personal data breach to the data subject without undue delay, so that the data subject can take measures such as blocking their credit cards.
measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
it would involve disproportionate effort, for example, if it is not known who the affected data subjects are. The matter shall be assessed in light of the risks. If the data subjects cannot be contacted personally, a public communication or similar measure whereby the data subjects are informed in an equally effective manner must be used.
If the controller has not already communicated the personal data breach to the data subject, the supervisory authority may require it to do so.
What should you take into account in the risk assessment?
The controller must assess the risk posed by the personal data breach to the persons concerned. The assessment will determine the measures required by the personal data breach.
The consequences of, for example, sensitive data leaking to the internet can be very different to those of not being able to access your personal data due to an information system malfunction.
The more sensitive the data affected by the personal data breach, the greater the risk to the persons concerned. A combination of different data types on the data subject is frequently more sensitive than a single data item. When a personal data breach affects a large group, so will the consequences.
It is important to assess how easily the data subjects can be identified from the materials affected by the personal data breach, either directly or indirectly in combination with other data. Identifiability can be influenced by how well the data has been encrypted or pseudonymised, among other things.
Personal data breaches can have more serious consequences when they involve children or others in a vulnerable position.
The sector and role of the controller can have an impact on the severity of the risk caused by the personal data breach. For example, if the personal data breach occurs in the patient record system of a hospital, the threat to the data subjects will probably be greater than if it had taken place in a newspaper's subscriber register.
The consequences of a personal data breach can be considered particularly severe if it can result in identity theft, fraud, anxiety, humiliation or loss of reputation.
The party that gained access to the information can also affect the consequences that can be expected. The likelihood of misuse can be greater if it is known that the data fell into the hands of a criminal, for example.
When assessing the risk involved in a personal data breach, take the severity and probability of the possible consequences into account. The risk related to a personal data breach is the greater, the more severe and probable the consequences for individuals.