Individuals' Rights
Article 34 of the new Regulation states that Data Subjects should be notified without undue delay if the personal data breach is likely to result in a high risk to their rights and freedoms (e.g. fraud or identity theft), in order to allow them to take the necessary precautions. The notification will be similar to the one to the supervisory authority (discussed above) and should describe, in clear and plain language, the nature of the personal data breach as well as recommendations for the individuals concerned to mitigate potential adverse effects.
Notifications to individuals should be made as soon as reasonably feasible, and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities (e.g. law enforcement authorities). For example, the need to mitigate an immediate risk of damage would call for a prompt notification whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay.
There is no need to communicate a personal data breach to individuals if:
(a) the Data Controller has implemented appropriate technical and organisational protection ?measures, and that those measures were applied to the data affected by the personal data breach, in particular those that render the data unintelligible to any person who is not authorised to access it, such as encryption; or
(b) the controller has taken subsequent measures which ensure that the high risk for the rights and freedoms of Data Subjects is no longer likely to materialise; or ?
(c) it would involve disproportionate effort. In such case, there will instead have to be a public communication (e.g. press release) or similar measure whereby the Data Subjects are informed in an equally effective manner.
Even where a Data Controller has chosen not to information Data Subjects, the supervisory authority can instruct it to do so. No doubt there will be more detailed rules setting out what kinds of breaches require notification and to whom.
Compensation
Currently the ICO can issue fines (Monetary Penalty Notices) of up to £500,000 for serious breaches of the DPA. When the Regulation comes into force, this will be increased to 4% of global annual turnover for the preceding year (for businesses) or 20 million Euros.
The Regulation contains a right to civil damages just like under S.13 of the DPA. Article 77 of the Regulation states:
“Any person who has suffered material or immaterial damage as a result of an infringement of the Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.”
This may see more in Data Subjects taking legal action against Data Controllers for data breaches. There may even be more class actions like the one against the London Borough of Islington in 2013 when 14 individuals settled for £43,000 in compensation after their personal data was disclosed without their authority. This action followed an ICO investigation, which resulted in the council being fined £70,000 under the DPA.
The Network and Information Security (NIS) Directive will also have a big impact on some UK business. It will impose new network and information security requirements on operators of essential services and digital service providers (DSPs). This includes banks, energy companies, health care providers and digital service providers (e.g. cloud services). Their obligations will include a requirement to report certain security incidents to competent authorities or Computer Security Incident Response Teams (to be established by each member state). The Directive will be formally adopted in spring 2016 leaving the UK and other member states two years to bring in national laws to implement it.
All organisations should be examining their approach to data breaches now and be putting into place processes to comply with the new rules.
Ibrahim Hasan is a solicitor and director of Act Now Training (www.actnow.org.uk)