Examples of When To Notify Data Breaches

Situation

Notify to DPA

Inform data subject

Remarks (*)

1. 

Accidental e-mail with Excel file of customer data to a trusted third party (e.g. lawyer, accountant, insurance agent)

No*

No

* If the third party is bound to confidentiality as a professional secrecy holder, deletion or

return was ensured, and no sensitive data were transmitted.

2. 

Advertising e-mail with open distribution list (cc instead of

bcc)

Yes*

Yes**

* If there is a large number of recipients or

sensitive data, e.g. passwords or heath data.

** Information should be provided

in subsequent e-mail with apology and

deletion instructions. Exception only if few

affected persons and no sensible content.

3. 

Webshop sends orders and packing bills to wrong customer

No

No

The wrong recipient should be asked to delete all data of the correct recipient.

4. 

Sensitive personal data sent by e-mail by mistake

Yes

Yes

5. 

Postal dispatch

error of motor

insurance policy

Yes

No*

* If no sensitive data. The wrong recipient has to be asked to destroy or return the item and be informed that the data may not be misused.

Situation

Notify to DPA

Inform data subject

Remarks (*)

6. 

Former employee uses a company’s database to contact customers to entice them to her/his new business

Yes

No*

* The sensitivity and scope of the personal data concerned must be taken into account.

Situation

Notify to DPA

Inform data subject

Remarks (*)

7. 

Stolen device encrypted in accordance with the state of the art

No*

No*

Unless the data is not backed up in any other way and availability is therefore impaired.

8. 

Stolen device not encrypted with names, surnames, sex, addresses and date of birth of more than 100.000 customers, backup is available

Yes

Yes

9. 

Stolen paper files with sensitive data

Yes

Yes

Situation

Notify to DPA

Inform data subject

Remarks (*)

10.             

Ransomware with proper backup, only encrypted data, and without exfiltration

No*

No

* If quick recovery of the backup copy is possible, at least within the potential 72-hours reporting period and the hackers only had access to encrypted data

11.             

Ransomware without proper backup, and without exfiltration

Yes*

No**

* Revision of the technical and organisational measures should be encouraged.

** If the non-exfiltration has been verifiably determined.

12.             

Ransomware in a hospital with backup and without exfiltration

Yes

Yes*

* Even with existing backups, the recovery time poses a risk to patient care.

13.             

Ransomware without backup and with exfiltration of employee and customers data, i.a. identity documents and financial data

Yes

Yes*

* The information should be provided individually. If this is not possible, e.g. through an immediately accessible, comprehensive information / banner on the website.

Situation

Notify to DPA

Inform data subject

Remarks (*)

14.             

Exfiltration of job application form data from a website

Yes

Yes

15.             

Exfiltration of hashed passwords of users of a website

No

No*

*Notification of those affected is not mandatory but is recommended to give them the opportunity to change their passwords.

16.             

Attack on 100.000 accounts of an online banking website with logins to approx. 2.000 customer accounts due to a vulnerability in the website

Yes

Yes*

* Information for all 100.000 people affected, not just the 2.000 successful log-ins.

17.             

Hackers capture usernames, passwords and purchase histories of an online retailer’s customers

Yes

Yes

18.             

“Identity theft” / “social engineering”, e.g. unlawful request to change the e-mail address to which billing information has to be sent

Yes

Yes

* If the real customer has not been informed about the change of the e-mail address (e.g. via an e-mail to the original e-mail address)