The EU General Data Protection Regulation (GDPR) will introduce mandatory personal data breach notification obligations across all sectors, in all EU countries, for the first time.

The GDPR will come into effect from 25 May 2018. Its extraterritorial reach means that the new data breach notification obligations will apply to any organisation located anywhere in the world that processes personal data in relation tothe offering of goods or services in theEuropean Union, or is involved in monitoring the behaviour of data subjects within theEuropean Union. This will be the caseregardless of whether or not the organisation has any physical presence or formal establishment in the European Union.

The stakes for compliance with the notification obligations are high, as failures can lead to fines of up to €10 million or 2 per cent of a company's worldwide annual turnover for the preceding financial year, whichever is higher. Individual data subjects will also have the right to bring legal claims against controllers that fail to comply.

It is therefore important for all organisations to understand the extent to which (and when) data breach notification obligations will arise under the GDPR.

HAS A PERSONAL DATA BREACH OCCURRED?

The GDPR defines a personal data breach as "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed". In practice, this threshold is likely to be met in most cases, including instances where data is encrypted or deleted in a ransomware attack and where data is exfiltrated as part of a hack.

WHAT NOTIFICATION OBLIGATIONS ARISE IN A PERSONAL DATA BREACH?

The extent of an organisation's notification obligations in the event of a personal data breach will depend on whether, in the particular circumstances, the organisation is acting as a data controller, i.e., determining the purpose and means of the data processing, or a data processor, i.e., processing data on behalf and at the direction of a data controller.

Data Controller Notification Obligations

For data controllers, the default position is that personal data breaches must be reported to the relevant supervisory authority by a data controller unless the breach is "unlikely to result in a risk to the rights and freedoms of natural persons" (authors' emphasis). A data controller will need to assess whether or not a breach, if not dealt with, is likely to have a detrimental effect on the individuals concerned; for example, is the breach likely to result in discrimination, loss of confidentiality, financial loss or damage to reputation?

Whether or not a risk exists will vary depending on the nature of the data involved in the breach and the nature of the breach itself. For instance, a breach resulting in the disclosure of sensitive or financial data is likely to pose a greater risk to the rights and freedoms of an individual than a disclosure of the staff telephone list. The recitals to the GDPR suggest that a relatively low threshold will apply, however, in determining whether or not there is such a risk to people. In practice, therefore, it is anticipated that notification will be required in most cases.

Where the duty to report a breach does arise, care will need to be taken to ensure that the report is made to the correct supervisory authority. Where the personal data breach concerns cross-border processing activities, notification ought to be made to the organisation's lead supervisory authority under the GDPR's "one-stop shop" mechanism. This will be the supervisory authority of the EU Member State in which the relevant controller has its sole or main establishment, i.e., where the decisions about the purposes and means of the processing are taken.

Data controllers that do not have an establishment in the European Union need to appoint a representative in one of the Member States where the data subjects, whose personal data is processed, are located. The GDPR does not place separate breach notification obligations on these representatives or expressly enable them to assume the data controller's responsibilities for breach notification in the alternative.

In contrast, data controllers will only be required to report a personal data breach to data subjects where it is "likely to result in a high risk to the rights and freedoms of natural persons" (authors' emphasis).

Whilst the GDPR does not provide specific guidance on the circumstances in which this obligation will be triggered, the text clearly suggests a higher threshold. The GDPR enables supervisory authorities to assess matters for themselves and, where appropriate, order an organisation to notify data subjects of a breach.

Notification to data subjects will not be required in the event that the data controller has "implemented appropriate technical and organisational protection measures... in particular those that render the personal data unintelligible ...such as encryption" or has taken"subsequent measures which ensure that the high risk to the rights and freedoms of data subjects... is no longer likely to materialise".

Data Processor Notification Obligations

For data processors, any personal data breach will be reportable to the data controller. Data processors will not, however, be obliged to notify a supervisory authority and/or any data subject.

WHAT TIME LIMITS APPLY?

Where breach notification obligations arise under the GDPR, the time limits for reporting are potentially onerous, adding further pressure to what is often already a crisis situation.

Data Controllers

Where a data controller concludes that the personal data breach in question is a notifiable event, the relevant supervisory authority will need to be notified "without undue delay and, where feasible, not later than 72 hours" after the controller has become aware of it.

What constitutes "undue delay" is not defined in the GDPR. For larger and more complex data breaches, where it is not possible to provide full information at the same time, the GDPR advocates providing it "in phases without undue further delay". Where notification is made outside the 72 hour window, reasons for the delay will need to be provided.

Any notifications to data subjects must also be made "without undue delay", although not necessarily within 72 hours.

Data Processors

Similarly, the obligation imposed by the GDPR on data processors is to inform the data controller "without undue delay".

WHAT INFORMATION NEEDS TO BE PROVIDED IN A REQUIRED NOTIFICATION?

Data Controllers

A report must contain the following information:

  • The nature of the personal data breach.
  • The name and contact details of the data protection officer (if an organisation has one) or other contact point where more information can be obtained.
  • A description of the likely consequences of the personal data breach.
  • A description of the measures taken, or proposed to be taken, to deal with the personal data breach and, where appropriate, of the measures taken to mitigate any possible adverse effects of the breach.

Notifications by data controllers to data subjects require the same content, except no information about the nature of the personal data breach needs to be included. Each data subject should be notified individually, except where this would involve "a disproportionate effort". In such circumstances, communication to the affected data subjects can be carried out via "public communication or similar measure whereby the data subjects are informed in an equally effective manner".

Data Processors

There is no prescribed form which a data processor's notification to a data controller ought to take.

WHAT STEPS SHOULD ORGANISATIONS TAKE TO PREPARE?

Preparatory actions may include

  • Establishing a breach response team that includes both appropriate internal staff members and relevant external advisers such as lawyers and forensic IT experts. This will aid a more rapid response in the event of a breach incident and make it easier to comply with notification obligations.
  • Preparing a data breach response plan and allocating responsibilities amongst the response team.
  • Developing internal data breach notification procedures.
  • Training personnel to ensure prompt escalation of and responses to breach incidents.
  • Running mock response exercises to identify faults and areas for improvement.
  • Implementing appropriate technical security measures appropriate to the nature of the organisation's data processing activities.

Dennis Brunner also contributed to this article.

New European Personal Data Breach Obligations On The Horizon

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.