To err is human – to admit it is another matter entirely. Under the General Data Protection Regulation (GDPR), which is to enter into force on the 25th May 2018, it is required that in the event of a breach of data security, a controller notifies its respective supervisory authority of the breach within seventy two hours after having become aware of it (although it is possible to notify after the seventy two hours if the delay can be justified). The GDPR devotes so much attention to this obligation that it also provides a list of information that ought to be included in each notification.
It should suffice to say that in an economic landscape which thrives upon the processing of data, breaches in security are costly because of the resources needed to rectify them, without even considering the controller having their public image potentially tarnished. Yet, under the GDPR, we are on the cusp of a paradigm shift where controllers are required to make haste to notify the authorities of such an occurrence. The truth is that no controller wants to make public the fact that the trust of its data subjects has been violated, even if this was due to a third party. Neither does any data subject relish the thought of their personal information, especially the financial variety, falling into the hands of unknown persons of clearly questionable intent. Regardless, the GDPR has adopted a pro data subject policy where the controller must prioritise the safety of data subject’s rights and interests before its own needs.
This is supplemented by a further obligation to actually notify the data subject directly in the case of such a breach in the event that such breach could stand to affect the rights and freedoms of the data subject. The wording of the regulation prescribes that this must be done with undue delay. Although the interpretation remains to be tested, it would likely stand to reason that once the controller is in a position to notify the supervisory authority, it would be prudent to notify the data subjects in parallel, if at least to avoid needing to justify this to the supervisory authority following its investigation into the matter.
Indeed, this obligation calls not only for greater awareness by controllers of the consequences of breaches its security, but also humility on the part of the controller to accept the situation and address it accordingly. If implemented honestly and maturely by all parties involved, this could see the beginning of an economy of data controllers who are ready to be more pro-active in the area of security.
Article provided by:
- Dr. Gege Gatt / Vice President, MITLA
- Dr. Matthew Galea Debono / Executive Member, MITLA
