Data Privacy Compliance in the Cloud
Made Easy

Understand Cloud and Data Protection Law in only 4 easy steps. Plus highly relevant legal information for 33 countries. Provided by EuroCloud and 53 European lawyers.

Notification of Personal Data Breaches: Promoting joint pro-activity in data security

25.09.2017

A brief discussion regarding the obligation of Controllers to notify the data subject and supervisory authority in the event of a data breach.

To err is human – to admit it is another matter entirely. Under the General Data Protection Regulation (GDPR), which is to enter into force on the 25th May 2018, it is required that in the event of a breach of data security, a controller notifies its respective supervisory authority of the breach within seventy two hours after having become aware of it (although it is possible to notify after the seventy two hours if the delay can be justified). The GDPR devotes so much attention to this obligation that it also provides a list of information that ought to be included in each notification.

It should suffice to say that in an economic landscape which thrives upon the processing of data, breaches in security are costly because of the resources needed to rectify them, without even considering the controller having their public image potentially tarnished. Yet, under the GDPR, we are on the cusp of a paradigm shift where controllers are required to make haste to notify the authorities of such an occurrence. The truth is that no controller wants to make public the fact that the trust of its data subjects has been violated, even if this was due to a third party. Neither does any data subject relish the thought of their personal information, especially the financial variety, falling into the hands of unknown persons of clearly questionable intent. Regardless, the GDPR has adopted a pro data subject policy where the controller must prioritise the safety of data subject’s rights and interests before its own needs.

This is supplemented by a further obligation to actually notify the data subject directly in the case of such a breach in the event that such breach could stand to affect the rights and freedoms of the data subject. The wording of the regulation prescribes that this must be done with undue delay. Although the interpretation remains to be tested, it would likely stand to reason that once the controller is in a position to notify the supervisory authority, it would be prudent to notify the data subjects in parallel, if at least to avoid needing to justify this to the supervisory authority following its investigation into the matter.

Indeed, this obligation calls not only for greater awareness by controllers of the consequences of breaches its security, but also humility on the part of the controller to accept the situation and address it accordingly. If implemented honestly and maturely by all parties involved, this could see the beginning of an economy of data controllers who are ready to be more pro-active in the area of security.

Article provided by:

  • Dr. Gege Gatt / Vice President, MITLA
  • Dr. Matthew Galea Debono / Executive Member, MITLA

 

Discover more about the Cloud Privacy Check(CPC) / Data Privacy Compliance(DPC) project

Director CPC project: Dr. Tobias Höllwarthtobias.hoellwarth@eurocloud.org

VIEW PROJECT

 

WHAT IS THE DPC/CPC PROJECT?

53 lawyers from 33 countries are contributing to the project “Data Privacy Compliance (DPC)/Cloud Privacy Check (CPC)” in 26 different languages.

Understanding the complexity of current European data protection laws and regulations is already difficult enough for an IT engineer, buyer, or business user. In combination with the often small but nevertheless significant differences between various EU member states, however, it can become an almost insurmountable challenge without proper juristic accompaniment from the very start... Read More

 

CPC MISSION & VISION STATEMENT, 2018

The CPC is a trusted, not-for-profit international network of qualified professionals who deliver simplified and straight-forward guidance to help navigate the legal and regulatory environment relating to privacy and the cloud. This is done through collective know-how, research and market analysis gained from pan-European industry activity, collaboration and experience. Our mission is to provide authoritative views, information and practical solutions to two principal stakeholders: industry professionals and public authorities.