Blog » MAYDAY, MAYDAY – DATA BREACH INCIDENT
MAYDAY, MAYDAY – DATA BREACH INCIDENT
26 March 2018
You may think that a data breach incident can only be a consequence of a cybercriminal attack like malware or ransomware. However, among particular circumstances a simple human error, like losing a company laptop can be considered as a data breach. In this short article we explain you what exactly a data breach is and how to handle such an unwanted situation to be GDPR proof.
1. What is a personal data breach?
To understand what a data breach incident is you may remember the acronym ‘CIA’. And here I do not mean the US Central Intelligence Agency, but it stands for confidentiality, integrity and availability. Indeed, personal data breach is when the confidentiality, the integrity and / or the availability of personal data is concerned.
Confidentiality is infringed when the data is disclosed to or accessed by an unauthorised person, for example if due to a hacker attack your customer list is published on a publicly available website.
An integrity breach happens if the personal data is unauthorizedly or accidently altered, like in the case when a patient’s blood type is changed in a medical record which of course may have serious consequences.
In case of an availability breach, access to personal data is lost or the data is destroyed. This is the case when you lose or crush a USB stick which contained the only copy of your contact list.
2. Be able to detect a data breach
The basis of handling a data breach correctly is that you are able to recognize one. In order to do so, you need to have internal processes in place.
Your processes shall include technical measures for example a firewall which can filter traffic or a log analyser that may filter unauthorised access.
Organizational measures are as important as technical ones. For instance, if your employees are not aware that they immediately need to report the loss of a company laptop, you will not be in a situation to decide whether this is an incident and make further steps if necessary.
3. Notify the supervisory authority
Once you have detected a data breach, you must decide whether you shall notify the supervisory authority or not. This should be a very quick decision as in default you need to notify the supervisory authority within 72 hours after you became aware of the breach.
As a controller you can only avoid notifying the supervisory authority if the data breach is unlikely to result in a risk to data subjects’ rights and freedoms. This is the case for example when a USB stick was stolen on which you stored a copy of employee records in an encrypted folder.
In case there is a risk that data subjects’ rights can be infringed due to the data breach you have to notify the supervisory authority without undue delay. For instance, if login names and passwords of your customers are put to a public website by a hacker, there is no doubt that you must report it to the supervisory authority.
4. Notify the data subjects
In certain cases, you not only need to notify the supervisory authority but also the data subjects affected by the data breach.
This is the case when the data breach is likely to result in a high risk to the individuals’ rights and freedoms. To remain at the previous example if the login names and passwords of your customers are put to a public website due to a hacker attack, you must inform them so that they would be able to change their password.
The method of informing the data subjects depends on the particular circumstances of the case. Direct communication to the affected person (eg. e-mail or SMS) is preferred unless it would cause a disproportionate effort, for example because of the huge number of the data subsects. In the latter case public communication, like a statement on the company webpage may be applied.
5. Document the data breaches
Controllers need to record all data breaches and the documentation may be examined by the supervisory authority.
Your data breach incident records must contain at least the description of the breach, the affected personal data, the effects of the breach and the remedial actions.
It is advised to include a short justification in case the breach was not reported to the supervisory authority or if you decided not to inform the data subjects. In case you notified the supervisory authority (or also the affected individuals) it is a good practice to add when and how the notification happened.
To sum up the above, even an unintended human mistake can have serious consequences to personal data and thus lead to a data breach incident. To handle those situations correctly, a sufficient incident response plan will be a must in the future in order to be GDPR-ready.
Hungary: Steps Towards Differentiating Between Domestic and International Procedural Public Policy
Drawing a well-defined line of demarcation between domestic and international public policy when enforcing foreign arbitral awards sends a clear pro-arbitration message from national courts in any jurisdiction. Does Hungarian case law come close to this level of sophistication? This post analyses this question in the context of procedural public policy, and it does so based on two recent appellate court decisions rendered in the context of enforcement of arbitral awards in accordance with the New York Convention.Read more »
EU ISSUED NEW GDPR STANDARD CONTRACTUAL CLAUSES – WHEN AND HOW TO USE THEM?
During summer 2021, the European Commission published two new "standard contractual clauses" on data protection regulation, which can be applied on the one hand, to the legal relationship between data controllers and data processors covered by the GDPR , and to the transfers of personal data to third countries, on the other. In this article, we answer the questions: what these SCCs regulate, how do they differ from the previous SCCs and how can your company use the new SCCs?Read more »
CAN THE NON-COMPETITION AGREEMENT BE VALID WITHOUT A PRECISE COMPENSATION IN HUNGARY?
The non-compete agreement may provide protection of the legitimate economic interests of the employer even after the termination of employment relationship. However, the Hungarian Labour Code lays down strict requirements for the agreement. In our article we analyse a recent decision of the Supreme Court about the importance of the precise determination of the compensation, so you as an employer can conclude a valid non-compete agreement.Read more »