Personal data breaches can be defined as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. In essence, any breach which would result in personal data being destroyed, lost, altered or disclosed to another without express permission from the owners of the data would be an issue that must be addressed by the Employer or business. This section will consider what is necessary to identify breaches, what actions employers will need to take when breaches occur and the types of breaches that may come about.
Identifying Breaches
A breach may be either accidental or deliberate. Personal data breaches can be defined as a security incident, affecting confidentiality, integrity or availability of personal data – so if data has been lost, destroyed, corrupted, disclosed or has been accessed by someone without authorisation, there has been a breach of personal data.
Breaches may include:
- Access by an unauthorised third party;
- Deliberate or accidental action (or inaction) by a controller or processor;
- Sending personal data to an incorrect recipient;
- Computing devices containing personal data being lost or stolen;
- Alteration of personal data without permission; and
- Loss of availability of personal data.
Notifying the ICO
In the event of a data breach, General Data Protection Regulations (GDPR) impose guidelines on all organisations to report breaches to the relevant supervisory authority within 72 hours. Employers must consider whether the breach is likely to result in a high risk of negatively affecting an individual’s rights and freedoms.
If there’s likely to be a risk to the right and freedom of people, you must notify the ICO. If there’s an unlikely chance of risk you don’t have to report it. In any case, you should record the breach, noting: –
- A description of the nature of the personal data breach;
- Categories and approximate number of individuals concerned;
- Categories and approximate number of personal data records concerned;
- The names and contact details of the data protection officer where more information can be obtained;
- A description of the likely consequences of the personal data breach; and
- A description of the measures taken or proposed to be taken, to deal with the personal data breach and including measures taken to mitigate any possible adverse effects.
Time
A breach must be reported without delay, to the ICO, generally no later than 72 hours after becoming aware of the breach. If the business or the employer fails to notify the ICO of the breach within the time limit allotted and without proper reason for late notification, the business may be heavily fined.
Notifying an individual about a breach
If a breach is likely to cause a high risk to the rights and freedoms of individuals then you must inform them directly and without delay especially if there is the need to mitigate the risk or damage to the affected individual(s). When you notify them, you should describe in clear and plain language:
- The name and contact details of your data protection officer;
- A description of the consequences likely to arise from the breach of personal data; and
- A description of the measures taken to deal with the breach, and measures to mitigate any possible adverse effects.
7.53