Notification Of Data Breach

One of the distinct changes made to the way we handle and perceive personal data relates to responding to a breach of personal data. A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data. This may include data breaches that are the result of both accidental and deliberate causes, and also means that a breach is more than just about losing personal data. The Data Protection Act, 2019 (the DPA) touches on this, requiring the notification or communication of breach where personal data has been accessed or acquired by an unauthorized person, and there is a real risk of harm to the data subject whose personal data has been a subject of the unauthorized access. This means that a data collector and/or data processor on becoming aware of a breach, should contain it and assess the potential adverse consequences for individuals, based on how serious or substantial these are, and how likely they are to happen. Some personal data breaches may only lead to possible inconvenience to those who need the data, while others can significantly affect individuals whose personal data has been compromised. It is therefore necessary to assess the potential adverse consequences of the breach based on how serious or substantial they may be, and how likely they are to happen. The Office of the Data Protection Commissioner recently published the proposed Data Protection (General) Regulations, 2021, which attempt to provide further clarity to the DPA including providing for the nature of a data breach that would amount to notifiable data breach. This would assist in assessing the risk involved in notifying the Data Protection Commissioner of a personal data breach detected. However, the proposed regulations are yet to be in force. Timelines for notification? Where such a personal data breach with is a real risk of harm to the data subject has been detected, a data controller shall:

• notify the Data Commissioner without delay, within seventy-two (72) hours of becoming aware of such breach; and
• communicate to the data subject in writing within a reasonably practical period, unless the identity of the data subject cannot be established.

Where the notification to the Data Commissioner is not made within seventy-two (72) hours, such notification shall be accompanied by reasons for the delay above the specified duration.