Toolkit for the EU GDPR – 8) Data Breaches and Enforcement

published on Mai 15, 2018

This note is an overview of the key considerations regarding data breaches and enforcement of the GDPR. This note considers data breaches and enforcement from the point of view of a data controller and will not consider employer/employee relationships or individual data subjects rights. 
 
For more information as to a data controllers obligations under the GDPR and individual rights please see our other toolkits.

Personal Data Breach

Data controllers are required to notify their supervisory authority of a personal data breach where the breach is likely to result in a risk to the rights and freedoms of the individual(s).
 
In the UK the supervisory authority is the ICO.
 
In the event of a breach, the data controller should notify their supervisory authority as soon as they become aware of the breach and in any event within 72 hours.
 
If the breach in question represents a high risk to the individual’s rights than the data controller must in most cases also notify the individual. This is naturally a sensitive matter and it is important that it is dealt with appropriately.
 
It is advisable that a data controller has appropriate policies or procedures in place to be able to firstly prevent any personal data breaches and secondly to effectively deal with any personal data breaches quickly and effectively, if they do occur.
 
This note will focus on the duty to notify individuals of a personal data breach.

Notifying the Supervisory Authority of a Personal Data Breach

• Describe the nature of the personal data breach;
• Include the name and contact details of the DPO (if there is one) or an alternative contact;
• Provide details of the likely consequences of the breach; and
• Outline measures taken by the data controller (or proposed measures to be taken) to address the breach and, if possible, mitigate any damage caused.

 
However, it is accepted that it may be difficult to provide a lot of information within the initial 72 hour window as investigations may still be on-going. If investigations are still on-going than the data controller should provide as much information as possible within the 72 hour window. Any outstanding information should be provided to the supervisory authority without undue delay.

 
If the data controller does not notify the supervisory authority within the 72 hour window (or provide all of the information) they must provide reasoned justification for this delay.
 

Supervisory Authority Enforcement

The GDPR provides supervisory authorities with the power to enforce the GDPR within their territory and to issue penalties for any breach.

• Investigative powers;
• Power to impose administrative fines;
• Ability to serve an “information notice” requiring data controller to provide certain information;
• Issue “Penalty Notices”;
• Issue “Assessment Notices”; and
• Issue “Enforcement Notices”.
   

It is expected that the Data Protection Bill will require the ICO to publish guidance on how it will exercise Penalty notices, Enforcement Notices and Assessment Notices.
 

Penalties

It is expected that the Data Protection Bill will require the ICO to publish guidance on the penalties which may be imposed.
 

The GDPR specifies that the penalty for a breach of the basic principles of data processing or of a data subjects rights will be up to 20 million EURO or 4% of the organisations total annual worldwide turnover in the proceeding financial year, whichever is higher.

Expected Criminal Offences under the Data Protection Bill

• Obtain or disclose personal data without the consent of the data controller;
• To procure the disclosure of personal data to another person without the consent of the data controller;
• To retain personal data without the consent of the data controller who controlled the personal data at the time which it was obtained; and
• To sell any personal data (which was obtained in one or more of the above circumstances).