GDPR IT Notification Rule SOURCE VARONIS HTTPS BLOG

GDPR – IT Notification Rule SOURCE – VARONIS - HTTPS: //BLOG. VARONIS. COM/GUIDE-EU-GDPRBREACH-NOTIFICATION-RULE/

GDPR – 72 hour window for breachs The GDPR’s 72 -hour breach notification requirement is not in the current EU Directive, the law of the land since the mid-1990 s. For many companies, meeting this tight reporting window will involve their IT departments stepping up their game. .

GDPR - Personal Data Breach versus Reportable Breach In short: not every data security breach requires an external notification! In the case of the GDPR, breaches can only involve personal data, which is EUspeak for personally identifiable information or PII. If your company is under the GDPR and it experiences an exposure of top-secret diagrams involving a new invention, then it would not be considered a personal data breach and therefore not reportable. You can say the same for stolen proprietary software or other confidential documents.

GDPR - Notifying the Regulators Under the GPDR, when does a company or data controller have to report a personal data breach to the local supervising authority – what we used to call the local data protection authority or DPA in the old Directive? This is spelled out in article 33, but it’s a little confusing if you don’t know the full context. In essence, a data controller reports a personal data breach — exposure, destruction, or loss of access—if this breach poses a risk to EU citizens “rights and freedoms”. These rights and freedoms refer to more explicit property and privacy rights spelled out in the EU Charter of Fundamental Rights exposure of sensitive personal data, theft of a device containing personal data, unauthorized access to personal data — would be reportable to regulators. The only exception here is if the personal data is encrypted with state of the art algorithms, and the key itself is not compromised, then the controller would not have to report it. And a security breach that involves personal data, as defined by the EU GDPR, but that doesn’t reach the threshold of “risks to rights and freedoms”? There’s still some paperwork you have to do!

GDPR - Notifying the Regulators Under the GDPR, every personal data breach must be recorded internally: “The controller shall document any personal data breaches, comprising the facts relating to the personal data breach”— see Article 33(5). So the lost or stolen laptop that had encrypted personal data or perhaps an unauthorized access made by an employee — she saw some customer account numbers by accident because of a file permission glitch — doesn’t pose risks to rights and freedoms but it would still have to be documented.

GDPR - Notifying the Regulators

GDPR - Examples Say EU personal data becomes unavailable due to a DDo. S attack on part of a network or perhaps it’s deleted by malware but there is a backup, so that in both cases you have a loss albeit temporary — it’s still a personal data breach by the GDPR’s definition. Is this reportable to the supervising authority? It depends. If users can’t gain access to say their records for more than a brief period, maybe a day or two, then this would impact their rights and freedoms. This incident would have to be reported to the supervising authority. Based on the notes in the guidance, there’s some room for interpreting what this brief period would be. You’ll still need, though, to document the incident and the decision making involved.

GDPR - Breach Notification in Phases While the 72 -hour GDPR breach notification rule was somewhat controversial, it’s actually more flexible once you read the fine print. The first key point is that the clock starts ticking after the controller becomes aware of the personal data breach. For example, suppose an organization detect a network intrusion from an attacker. That 72 -hour window does not start at this point. And then there’s an investigation to see if personal data was breach. The clock still doesn’t start. When the IT security team discovers with reasonable certainty that there has been a personal data breach, then the clock starts! When notifying the supervising authority, the data controller can do this in phases. It is perfectly acceptable to notify the supervising initially when there has been discovery (or the likelihood) of a personal data breach and to tell them that more investigation is required to obtain details — see Article 33(4). This process can take more than 72 -hours, and is allowed under the GDPR. And if turns out to be a false alarm, they can ask the supervising authority to cancel the notification. For personal data breaches in which it is discovered there is a high risk to individual, the notification to affected “data subjects” must be made without “undue delay”— see Article 34(1). The objective is to inform consumers about how they’ve been affected and what they need to take to protect themselves.

GDPR - Notification Details What do you tell the supervising authority and individuals? For supervising, here’s the actual language in Article 33: Describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; Communicate the name and contact details of the data protection officer or other contact point where more information can be obtained; Describe the likely consequences of the personal data breach; Describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. When notifying individuals (see Article 34), the controller also has to offer the following: a description of the nature of the breach; the name and contact details of the data protection officer or other contact point; a description of the likely consequences of the breach; and a description of the measures taken or proposed to be taken by the controller to address the breach, including, where appropriate, measures to mitigate its possible adverse effects. The GDPR prefers that the controller contact affected individuals directly – rather than through a media broadcast. This can include email, SMS text, and snail mail. For indirect mass communication, prominent banners on web sites, blog posts, or press releases will do fine.

GDPR – This is not legal advice The GDPR breach notification guidelines that were released last month is about 30 pages. As an IT person, you will not be able to appreciate fully all the subtleties. You will need an attorney—your corporate counsel, CPO, CLO, etc. —to understand what’s going with this GDPR breach guideline and other related rules. That leads nicely to this last thought: incident response to a breach requires combined efforts of IT, legal, communications, operations, and PR, usually at the C-level. IT can’t do it alone. The first step is to have an incident response plan. A great resource for data security and privacy compliance is the International Association of Privacy Professionals (IAPP) website: https: //iapp. org/. The IAPP also have a incident response toolkit put together by our attorney friends at Hogan Lovells. Check it out here.