YTYK You think you know

Card 11 of 18 Personal data breaches ●●○ Working knowledge

Two thresholds, two audiences

The authority is notified when a breach is likely to result in a risk; the data subjects are told only when it is likely to result in a high risk — and then without undue delay, with no 72-hour figure attached.

Why it is like this

Telling everyone about everything would train people to ignore the notices. The higher bar for individuals reserves their attention for breaches they can act on.

Not to be confused with

One decision. A breach can be notifiable to the authority and not to the individuals; communication to individuals can also be avoided if the data was encrypted, or if you have since made the high risk unlikely to materialise.

In practice

An encrypted laptop lost with keys held elsewhere: often a risk (notify the authority), rarely a high risk to individuals (no communication required).

Source: Regulation (EU) 2016/679 (GDPR) — Article 33 and Article 34. Read on .

Odd one out Check yourself

Three of these let you skip telling the affected individuals. Which does not?

  1. The data was encrypted and the keys were not compromised
  2. Subsequent measures make the high risk no longer likely to materialise
  3. Communication would require disproportionate effort, so a public communication is used instead
  4. Fewer than 100 individuals are affected
Show the answer

Fewer than 100 individuals are affected

Article 34(3) lists exactly three exemptions, and scale is not one of them — a breach affecting ten people can be high risk to all ten.