Skip to main content

Notification of Personal Data Breaches: Promoting joint pro-activity in data security

Dr. Gege Gatt & Dr. Matthew Galea Debono, Partners of EuroCloud CPC Network

A brief discussion regarding the obligation of Controllers to notify the data subject and supervisory authority in the event of a data breach.

To err is human – to admit it is another matter entirely. Under the General Data Protection Regulation (GDPR), which is to enter into force on the 25th May 2018, it is required that in the event of a breach of data security, a controller notifies its respective supervisory authority of the breach within seventy two hours after having become aware of it (although it is possible to notify after the seventy two hours if the delay can be justified). The GDPR devotes so much attention to this obligation that it also provides a list of information that ought to be included in each notification.

It should suffice to say that in an economic landscape which thrives upon the processing of data, breaches in security are costly because of the resources needed to rectify them, without even considering the controller having their public image potentially tarnished. Yet, under the GDPR, we are on the cusp of a paradigm shift where controllers are required to make haste to notify the authorities of such an occurrence. The truth is that no controller wants to make public the fact that the trust of its data subjects has been violated, even if this was due to a third party. Neither does any data subject relish the thought of their personal information, especially the financial variety, falling into the hands of unknown persons of clearly questionable intent. Regardless, the GDPR has adopted a pro data subject policy where the controller must prioritise the safety of data subject’s rights and interests before its own needs.

This is supplemented by a further obligation to actually notify the data subject directly in the case of such a breach in the event that such breach could stand to affect the rights and freedoms of the data subject. The wording of the regulation prescribes that this must be done with undue delay. Although the interpretation remains to be tested, it would likely stand to reason that once the controller is in a position to notify the supervisory authority, it would be prudent to notify the data subjects in parallel, if at least to avoid needing to justify this to the supervisory authority following its investigation into the matter.

Indeed, this obligation calls not only for greater awareness by controllers of the consequences of breaches its security, but also humility on the part of the controller to accept the situation and address it accordingly. If implemented honestly and maturely by all parties involved, this could see the beginning of an economy of data controllers who are ready to be more pro-active in the area of security.

Article provided by:

  • Dr. Gege Gatt / Vice President, MITLA
  • Dr. Matthew Galea Debono / Executive Member, MITLA

Cloud Privacy Check (CPC). Data Privacy Compliance in the Cloud Made Easy

Understand Cloud and Data Protection Law in only 4 easy steps. Plus highly relevant legal information for 33 countries. Provided by EuroCloud and 53 European lawyers.


About Us

EuroCloud is an independent non-profit organization and consists of a two-tier setup where organisations form all European countries can apply to participate in as long as they respect the EuroCloud Statutes.

To act as a true European player, all programs that are developed are intended to be European activities. These European programs are the strength of EuroCloud as a whole. Respect to local cultures along with the will to promote a real European spirit.