{"id":6917,"date":"2018-08-02T14:56:41","date_gmt":"2018-08-02T18:56:41","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=6917"},"modified":"2019-05-08T11:40:25","modified_gmt":"2019-05-08T15:40:25","slug":"gdpr-report-personal-data-breach","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/gdpr-report-personal-data-breach\/","title":{"rendered":"GDPR: When to report a Personal Data Breach"},"content":{"rendered":"\n

In the first month since the GDPR became enforceable, data breach self-reporting is up 500%<\/h2>\n\n\n\n

Even before the European Union’s General Data Protection Regulation (GDPR) became enforceable on May 25th, the words “personal data breach” were enough to send shivers down to the spines of CIOs and CISOs the world over. While the public seems to be growing numb to the torrent of data breach news and notifications that have been coming their way (5,027 breaches compromising over 7.8 billion records in 2017<\/a>), security professionals – especially corporate ones – are more sensitive than ever to the dangers of a personal data breach.<\/p>\n\n\n\n

\"Personal<\/figure><\/div>\n\n\n\n

And now with the GDPR enforceable, in addition to the potential loss of business and damage to reputation that could occur, there is also potential for steep fines, potentially up to \u20ac20,000,000 or 4% of total international revenue.<\/p>\n\n\n\n

That in turn has led to a major spike in self-reporting in the first month of GDPR enforcement, with 1,792 breaches self-reported to the UK Information Comissioner’s Office<\/a> (the UK’s Data Protection Authority) in June of 2018. That’s compared to just 367 breaches reported in April, the last full month before the GDPR went into effect.<\/p>\n\n\n\n

However, in a recent webinar, the ICO’s head of Data Breach Reporting, Laura Middleton, cautioned that: “not every personal data breach needs to be reported<\/strong>. So controllers should assess the likelihood and severity of risk to individuals before making that decision to report.”<\/p>\n\n\n\n

So that’s what we’re going to cover today: under the GDPR, what constitutes a personal data breach and when should you report one?<\/p>\n\n\n\n

Let’s hash it out.<\/span><\/p>\n\n\n\n

Under the GDPR, what is a Data Breach?<\/h2>\n\n\n\n

In many ways, the term “Data Breach” is probably not a broad enough descriptor. Just like with many American laws, the legal definition and the popular definition differ. For the sake of the GDPR, Personal Data Breach covers a range of data incidents, everything from accidental disclosure to deletion to an actual breach of security where information is stolen. Here’s the official GDPR definition in Article 4(12):<\/p>\n\n\n\n

\u2018personal data breach\u2019 means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;<\/p><\/blockquote>\n\n\n\n

Let’s break that down a little bit. A breach of security in this sense doesn’t have to be an attacker fighting through your defenses. A breach of security can occur as a result of something as simple as an employee’s mistake or a database error. The more important portion of this definition is the back half, which is fairly broad. And that’s likely led to some over-reporting, where incidents that didn’t rise to the level of needing to be reported were still documented with the ICO out of a sense of caution.<\/p>\n\n\n\n

But for the sake of clarity, let’s define a GDPR personal data breach in our own laymen’s terms.<\/p>\n\n\n\n

A personal data breach occurs anytime, whether by accident or an act of malice by an attacker, a customer’s data is inadvertently destroyed, lost, altered or disclosed to the wrong party.<\/p>\n\n\n\n

Now, let’s talk about what your responsibilities are for reporting a data breach under the GDPR.<\/p>\n\n\n\n

You have 72 hours to report a personal data breach after it’s discovered<\/h2>\n\n\n\n

This is the biggest thing that you need to be aware of as you investigate any data incident and make a determination on reporting: you have 72 hours from the time you discover the issue. Now, with a true breach the average time it takes a company to detect it usually around 190 days. Some of the other data incidents that roll up under the GDPR’s “Personal Data Breach” definition may take considerably less time to diagnose. Regardless of how long it takes for the problem to present itself, once it’s been discovered you need to document that down to the minute<\/strong> and from there you have three days to decide what you need to do.<\/p>\n\n\n\n

Here’s how the GDPR lays out your responsibility in Article 33(1):<\/p>\n\n\n\n

1<\/sup>In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55<\/a>, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. 2<\/sup>Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.<\/p><\/blockquote>\n\n\n\n

As you can see from the definition, your company or organization is faced with a decision regarding the severity of the incident. And much like with determining your “legitimate interests,” the GDPR is essentially asking you to perform an analysis that weighs the risk to the rights of the data subject.<\/p>\n\n\n\n

To figure that out you’re going to need to answer some questions, and it would be a good idea to document these as part of your investigation.<\/p>\n\n\n\n