PRIMA // BLOG

The danger of cyber risks is constantly increasing. In addition to the threat to IT security, IT security incidents are always relevant in terms of data protection law. Read here how to react correctly and what preparations you can make in the event of an emergency.

What is a data breach?

According to Art. 33 (1) GDPR, a data breach is "a personal data breach", i.e. an incident that violates the security of personal data so that unauthorised persons can access it. Classic cases are

• Accidentally sending the wrong emails or having too large an open mailing list
• Access to IT systems as a result of hacking or phishing attacks
• Theft or loss of data carriers, laptops, etc.
• Security gaps in IT systems
• Hidden but not deleted information in Excel documents

What needs to be considered for data breaches?

The top priority with data breaches is to quickly identify and eliminate the cause in order to minimise or eliminate the consequences for data subjects and prevent the data breach from spreading.

If the data breach results in risks to the rights and freedoms of the data subjects or if this cannot be ruled out, the data breach must be reported to the competent supervisory authority immediately and, if possible, within 72 hours. This happens relatively frequently.

If the data breach is also likely to result in a high risk to the rights and freedoms of the data subjects, the data subjects must also be informed immediately. This happens, but is less common than reporting to the competent supervisory authority.

Measures for internal detection and reporting

In order to be able to react appropriately to a data breach, it is particularly important that data breaches are quickly recognised internally and reported internally immediately. This requires that all employees know what a data breach is, to whom it must be reported internally and how it should be reported. It makes sense to create an instruction, guideline or similar document that describes the process. However, this process must also be communicated to employees so that they are aware of it and can follow it. The motto for this is: train, train, train.

Internal treatment - countermeasures and decision on the report

After the internal report, people should immediately come together and take action who can take technical countermeasures, evaluate the process and decide on further (legal) steps. The composition of the data breach team is made up of several or the following stakeholders:

• IT department
• IT securityInformation securit
• Cyyber insurance
• Data protection officer
• Legal department
• External legal and IT and IT security consultants
• senior management

The first priority of the data breach team should always be to take countermeasures, then clarify the extent of the incident and then decide on the next steps. Further steps are usually

• Deciding whether to notify the relevant data protection authority (mandatory for all companies if the requirements are met)
• Decision to report to the BSI (mandatory for KRITIS companies, voluntary for other companies)
• Decision on whether to file a criminal complaint with the cybercrime unit of the competent state criminal investigation office (not mandatory)
• Decision on informing the data subjects
• Implementation of the measures

Notification of data breaches to data protection authorities

If there is an obligation to report under Art. 33 GDPR, the report should be submitted within 72 hours of the incident being discovered. To be on the safe side, the first internal knowledge should be used to calculate the deadline. A later notification is possible and, in case of doubt, still makes sense after 72 hours; however, reasons must then generally be given as to why the 72-hour deadline was not met.

Art. 33 GDPR does not provide for a special form of notification. However, the supervisory authorities have online notification forms for this purpose and it is advisable to use these because the supervisory authorities receive the notification in a form that enables it to be processed quickly and, ideally, dealt with. This must be the aim of the notification.

Information of data subjects

Pursuant to Art. 34 (1) GDPR, data subjects must be informed if there is a high risk to the rights and freedoms of the data subjects. In this case, the data subjects must be informed about the incident in clear, simple language. The information should contain at least this information

• Description of the nature of the personal data breach
• where possible, the categories and approximate number of data subjects and data involved
• the name and contact details of the data protection officer or other contact point for further information
• Description of the likely consequences
• Description of the countermeasures taken or proposed

There are exceptions where personal information does not have to be provided. However, these should be treated with caution.

• You have taken appropriate technical and organisational security measures to prevent access to the data, in particular through encryption.
• You have taken measures to ensure that, in all probability, the risk to the rights and freedoms of the data subjects no longer exists.
• Notification would involve a disproportionate effort. In this case, a public announcement or similar measure must be made instead, through which data subjects are informed in a comparably effective manner.

Does reporting make you free and what are the consequences of failing to report?

The question of whether to report an incident is often discussed intensively in the data breach team. The concern that management, legal department and IT controllers in particular often have is that they could bring the data protection supervisory authority and thus many problems into the company or possibly provoke conditions and sanctions. Attempts are then often made to minimise the incident or the consequences in order to avoid a report.

These concerns are generally unfounded. Section 43 (4) BDSG contains a prohibition on the utilisation of evidence for the contents of the report, which we believe is observed by the data protection authorities despite criticism of the provision under European law. In this respect, the following applies: What is reported cannot be used against the controller.

In addition, the reactions of the data protection authorities to reports are generally much more harmless than is often feared. You often receive an acknowledgement of receipt, occasionally queries, and also occasionally the notification that the process has been checked and finalised. It is possible that a report will be followed by a supervisory process, but this is rather rare in relation to the number of reports submitted.

Data subjects have a number of rights in relation to data controllers. When you receive requests from data subjects, it is important to handle them correctly to prevent them from becoming a major problem for your company and your data protection organisation. Read here about the points to bear in mind.

How must the request for information be submitted?

There are virtually no formal requirements for data subject requests. Data subjects can submit them in writing, electronically or verbally. It is important for the handling of the request to understand what the data subject is concerned about. This sounds logical, but in practice can be the first challenge. You should ask yourself what the data subjects really want. If requests from data subjects are not clear, you need to be able to interpret them. The following requests regarding data subjects' rights are particularly suitable for this purpose

·       Access in line with Art. 15 (1) GDPR

·       Provision of a copy of the data in line with Art. 15 (3) GDPR

·       Rectification pursuant to Art. 16 GDPR

·       Erasure pursuant to Art. 17 GDPR

·       Restriction of processing or blocking of their personal data (Art. 18 GDPR) or

·       Data portability (Art. 20 GDPR)

It is also possible, and in practice a frequent case, that data subjects request the restriction of their email or telephone number for web emails or calls.

The right interpretation of the data subject's request is the first step towards a good response. In order to avoid misunderstandings, it makes sense to inform the data subject of the result of the interpretation when replying. One possible phrasing could be:

"Thank you for your email. We understand your request as a request for information in accordance with Art. 15 (1) GDPR."

Let's take a closer look at the highly relevant cases of access pursuant to Art. 15 (1) GDPR and the provision of a copy of data pursuant to Art. 15 (3) GDPR.

Identity check

To ensure that the response to the access request does not itself become a compliance boomerang, it is important to only provide the information to the data subject. This is also required by Art. 12 (6) GDPR. In practice, it happens from time to time that divorced spouses, the ex, other family members or complete strangers make requests for information. Answering these without verifying your identity can easily lead to a disaster.

You should always check who you are dealing with on the other side. This is not a problem for requests from your own employees, customers you know personally or other people you know personally. If you do not know the requesting party personally, you must ask yourself whether there are reasonable doubts about their identity. This may be the case, for example, if an enquiry is sent from an email that you do not know, or if an email suggests that it is a different person because, for example, a data subject enquiry is sent from the email account sue.miller @ for the data subject Jack Russel Brown.

If there are reasonable doubts, the identity must be verified. The principle here is that the more sensitive the information to be disclosed, the higher the requirements for identification. In particular, the following can be considered

·       Requesting additional information (birthday, adress etc.)

·       Registration and confirmation via a verified account or

·       Post-/Video-Ident and sending identification documents for particularly sensitive information.

Power of attorney for access requests handled by lawyers

In practice, it is relatively common for requests for information to be made by lawyers. This is permissible. The data controller should then ensure that a power of attorney exists for making the request for information and for receiving the information. If no original power of attorney is submitted, but only a fax or similar, the information can be rejected "immediately" in accordance with Section 174 BGB (see Regional Court Stuttgart judgement of 31.03.2021 - 9 U 34/21). The information period (see below) then only begins with the submission of an original power of attorney.

If the power of attorney does not contain a clear indication that the information may also be provided to the lawyer, in case of doubt the information should not be sent to the lawyer, but directly to the person concerned.

Information to be provided

When requesting information, the first question to be answered is always whether the data subject's personal data is being processed. This must either be confirmed or denied.

If personal data is processed, the content of the information depends on what the data subject requests. Information in accordance with Art. 15 (1) GDPR, handing over copies of data in accordance with Art. 15 (3) GDPR or specially specified information. Data controllers can request/ask data subjects to specify which information is to be provided or to which processing operations the request relates. This can help to ensure that information is provided quickly and in accordance with the wishes of the data subject. However, it does not mean that data subjects are entitled to less information than originally requested.

If information is requested in accordance with Art. 15 (1) GDPR, information must be provided in accordance with the catalogue of Art. 15 (1) GDPR on

·       purposes of the processing,

·       categories of personal data being processed,

·       recipients or categories of recipients of the personal data (in doubt, at the choice of the data subjects)

·       planned retention or the criteria for determining retention

·       data subject rights and the right to lodge a complaint with a supervisory authority

·       the origin of the data,

·       the existence of automated decision-making, including profiling.

If copies of data are requested in accordance with Art. 15 (3) GDPR, copies of the data must be provided. If the request relates to documents, a copy of the document itself must also be provided in accordance with ECJ case law, insofar as this is necessary for the control of data processing.

If less than the content of Art. 15 (1) GDPR or Art. 15 (3) GDPR is requested, correspondingly less information must be provided.

Timeline and form of the information

Pursuant to Art. 12 (3) GDPR, the time limit for providing information is one month from receipt of the request for information. The deadline can be extended to up to three months in the event of particular complexity or a high number of requests. In practice, it is advisable to send a confirmation of receipt immediately after receiving a request and to announce that you will get back to us within one month in order to manage expectations and avoid complaints to data protection authorities. Of course, this is especially true if data subjects themselves set shorter deadlines.

It is important to choose a secure channel for the transmission of the information so that the content of the information is protected. The more sensitive the content, the higher the requirements. In the frequent case of transmission by email, appropriate encryption should be provided in case of doubt.

Depending on the type of communication with the data subject, the information must be provided in writing, electronically or verbally. In case of doubt, the channel chosen by the data subject or the channel that is recognisably desired should be used. As a rule, copies of data must be provided in a commonly used electronic format.

Is it possible to reject access requests?

There are cases in which access may be rejected or made subject to paying a fee. These are

·       obviously unfounded requests and

·       excessive requests.

These exceptions are rare and are applied very cautiously in case law. It is therefore a very blunt sword to defend yourself against requests for information.

What happens if you do not provide information?

Unanswered requests for information are the breaking point of any data protection organisation and should be avoided. Especially if there is already a conflict with data subjects, unanswered requests for information often end up with the data protection authorities. You should then have a good justification - or excuse - ready, otherwise you could face fines of up to EUR 20 million or 4% of the company's turnover. Those affected can also claim material and immaterial damages. The first judgements have been handed down in which claims for damages for late information have been awarded, e.g. EUR 10,000 by the Oldenburg Labour Court in its judgement of 9 February 2023 - Ref. 3 Ca 150/21.

"We don't process any personal data ourselves" or "Our customers know what we do with their data - so we don't have any special data protection requirements" Do statements like these sound familiar? Then you need to be extremely careful. Data protection law applies to every company - including you. If you have contact details from customers, have employees or a website and you must comply with the strict requirements of the General Data Protection Regulation. Here are 12 typical mistakes you should avoid when it comes to data protection.

1. Unclear privacy policy on the online presence: A website without a comprehensive and understandable privacy policy is a privacy violation. Is your privacy policy secure and does it include information about analysis tools? Make sure that you provide transparent information and have a contact person for privacy-related questions.
2. Carelessness with documents: Documents or notes often end up in the trash without being checked for content. However, personal data does not simply belong in the trash, but must be destroyed in compliance with data protection regulations.
3. Errors in the cloud: SaaS Services such as Google Drive are practical and, when used correctly, can even provide added security. However, an unmanaged cloud service can also be a gateway for data breaches.
4. Poor communication: Unintentional disclosure of personal data, whether on the phone or in an e-mail, but should not happen, but still happens quickly. Awareness on the part of employees is required here. Data protection training provides a remedy here.
5. Carelessness in the workplace: An unlocked office or a computer without a screen lock can lead to data loss and data breaches. This is especially true for areas where visitors also have access.
6. Sloppy password practices: Using too simple or identical passwords across different platforms and applications can be a gateway for cyberattacks. Good password management is therefore mandatory.
7. Capacity issues: Data protection issues are complex and constantly changing. A reactive approach is not enough. Companies must be proactive and constantly adapt. This requires that there are people who have enough resources and appropriate know-how.
8. Ignorance of the requirements of the GDPR: Do not trust that the GDPR does not apply to you. This is certainly wrong. Get an overview of the legal requirements and make a plan on how you will deal with these risks.
9. Risks in communication: E-mail addresses are personal data. When sending e-mails to large distribution lists, use the "BCC" function so that your mailing does not become a data breach.
10. Video surveillance without labeling: If you use video surveillance, strict requirements apply. In any case, video surveillance must be clearly marked and you must provide detailed information about it. Simple signs with pictograms are not sufficient for this.
11. Lack of employee training: In data privacy, too, people are often the greatest risk factor. Training is essential to educate employees about data protection risks and correct behavior. Among other things, this can help prevent accidental data leaks or phishing attacks.
12. Mixing private and business: The use of apps such as WhatsApp on company devices is problematic. This is especially true if such apps have access to the address book.
    
    

It is your responsibility to take the necessary steps to ensure that they comply with and implement data protection in your company. The good news: efficient data protection is easier than you think: PLANIT // PRIMA is a data protection software that not only stands out with its browser-based and intuitive user interface, but also combines all the essential building blocks for a seamless data protection organization.

Equip your company for the data protection challenges! Book your free, personal tour of the tool now.                                                                                                 

        Irina Diz shows you the world of PLANIT // PRIMA.

                  Book a tour now or start directly.

At times when data is being called the "new gold", data protection has become enormously important. The use of new technologies and the constant flow of information makes gap and risk analysis an indispensable tool for companies to ensure that they not only meet legal requirements but also maintain the trust of their customers.

What is a gap and risk analysis?

The gap analysis helps companies to identify where they currently stand with regard to data protection and what gaps there are in comparison with the legal requirements. They are the prerequisite for identifying deficits and managing risks.

Once identified, gaps become a manageable task. That is already half the battle. The risk analysis assesses the risk potential of identified gaps to harm the company itself. The focus is on potential data breaches and their consequences.

Risk assessment: What are the consequences?

Every gap entails a risk. In order to assess the risk and decide on measures, it is necessary to assess how likely it is that the risk will materialize and become, for example, a data protection incident, and what impact this may have.

With this risk assessment in hand, targeted measures can then be planned. Possible measures can be of a technical, legal or organizational nature.

The benefits of a thorough gap and risk analysis

Active risk management offers more than just legal certainty. Companies that invest here benefit from an improved image, trust-building among customers, and ultimately an optimized, data-based business strategy. In the digital era, a careless approach to data protection is not an option. A proactive approach, supported by thorough gap and risk analyses, positions companies as trustworthy and responsible players in the market - that's a valuable competitive advantage in today's business world.

Train employees - reduce risks in the long term

Many data protection breaches result from human error. Regular training can significantly reduce these risks. This is also required by data protection law. According to this, companies must take appropriate measures to ensure the protection of personal data. Proper training of personnel is an essential prerequisite for meeting these requirements.

Additionally, training is useful for several reasons:

• Employees who are trained in data protection handle data more responsibly.
• Employees who understand privacy basics can make processes and procedures more efficient by incorporating privacy-friendly practices from the start.
• Trained employees can respond more quickly and effectively when data privacy incidents occur and take the necessary steps to remediate and report them.

Online training courses are therefore an integral part of PRIMA: entertaining tutorials provide information on phishing, password security, and much more. Including quiz and certificate for participants.

--> Learn more about online training here.

Gap and risk analysis: the bottom line

Regular gap and risk analysis is a central pillar for the responsible handling of personal data. However, it is at least as important to ensure that all employees are trained in data protection and that processes run efficiently during ongoing operations. For example, with data protection management software such as PRIMA.