Not every personal data breach needs to be reported to the President of the Personal Data Protection Office

In light of the recent personal data breaches affecting thousands of entities, the President of the Personal Data Protection Office reminds controllers that, pursuant to Article 33(1) of the GDPR, in the event of a personal data breach, the controller must notify the supervisory authority without undue delay, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

In light of recent incidents involving, in particular, unauthorised access to contractor databases and invoicing systems, the President of the Personal Data Protection Office emphasises the need for controllers to carry out a thorough risk assessment in each case, the outcome of which determines whether the breach must be reported.

When notification may not be required

A situation in which a personal data breach is unlikely to result in a risk to the rights and freedoms of individuals typically arises when information about sole traders is disclosed, provided that it consists of data publicly available in an open register (CEIDG), such as their first and last names, business name, tax identification number (NIP), or official business address. As a general rule, the loss of confidentiality of such data does not give unauthorised persons any new opportunities to cause harm to the data subject.

When notification is required

The obligation to notify the supervisory authority (the President of the Personal Data Protection Office, UODO) arises when a personal data breach is likely to result in a risk to the rights and freedoms of natural persons. This applies in particular where, alongside publicly available information, additional information has also been disclosed that could facilitate fraud, identity theft, profiling, or the use of personal data in social engineering attacks.

Such a risk is likely to arise, inter alia, where the following information is disclosed:

·       Personal Identification Number (risk of identity theft, fraud, or the incurrence of financial obligations in the individual’s name);

·       Details of purchases or services that reveal information about an individual’s health or other special categories of personal data (risk of privacy violations, discrimination, or unauthorised profiling);

·       Financial information (risk of financial fraud and the creation of fraudulent invoices or payment instructions).

If the assessment indicates a high risk to the rights and freedoms of natural persons, the controller should also notify the affected individuals, in accordance with Article 34 of the GDPR.

Important to remember

Even if the controller determines that a particular personal data breach does not need to be reported to the President of the Personal Data Protection Office, this does not exempt the controller from the obligation to:

·       carry out and document a risk assessment;

·       record in the internal register of personal data breaches the grounds justifying the decision not to report the breach.

The GDPR requires all personal data breaches to be documented, regardless of whether they have been reported to the supervisory authority.