EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
cessibility) and integrity breaches (unauthorised alteration). Controllers and processors must implement appropri - ate technical and organisational measures to ensure a level of security appropriate to risk (Articles 5 (1)(f) and 32, GDPR), adopting a risk-management approach rather than guaranteeing absolute security (eg, CJEU, Natsionalna agentsia za prihodite , Case C-340/21). When a breach occurs, controllers must promptly assess whether it is likely to result in a risk to individu- als’ rights and freedoms, and comply with the GDPR’s notification and documentation obligations. Where the breach is likely to result in a risk, the con - troller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it (Article 33 (1), GDPR); any delay must be justified. Processors must notify the controller without undue delay after becoming aware of a breach (Article 33 (2), GDPR). The notification must include, at minimum, a description of the breach, the categories and approxi - mate number of data subjects and records concerned, contact details for the DPO or other point of contact, likely consequences and measures taken or proposed to address and mitigate the breach (Article 33 (3), GDPR); information may be provided in phases (Arti - cle 33 (4), GDPR). Controllers must document all breaches (facts, effects, remedial action) to enable regulatory verification (Arti - cle 33 (5), GDPR). Where the breach is likely to result in a high risk, the controller must communicate it to affected individuals without undue delay, using clear and plain language and providing equivalent core information and mitigation steps (Article 34 (1)–(2), GDPR). Communication to individuals may be avoided in lim - ited cases, including where robust technical measures (eg, effective encryption) render the data unintelligible, or where subsequent measures eliminate the high risk, or where individual notification would involve dispro - portionate effort (in which case a public communica - tion may be used) (GDPR, Article 34 (3)).
Operationally, organisations should have a breach response plan that enables rapid detection, contain - ment and documentation; an initial legal and technical qualification of the event; a structured risk assess - ment; timely regulator and (if required) individual noti - fications; and remediation steps (containment, patch - ing, credential resets, access reviews, restoration and enhanced monitoring), followed by a post-incident review (Articles 24, 25 and 32, GDPR). Supervisory authorities have extensive investigative and corrective powers, including requiring informa - tion, conducting audits, ordering notifications, restrict - ing processing and imposing administrative fines (Articles 57, 58 and 83, GDPR). However, corrective measures are not automatic and must be necessary and proportionate (see judgment of 26 September 2024 C-768/21). Data breaches also create civil liability exposure and potential mass claims. Data subjects may lodge com - plaints with supervisory authorities (Article 77, GDPR) and seek judicial remedies and compensation for material or non-material damage (Articles 79 and 82, GDPR). The Court of Justice has confirmed that fear of potential misuse of data following a breach may itself constitute compensable non-material damage ( Natsionalna agentsia za prihodite ). 1.7 Regulators At EU level, privacy and data protection oversight is organised around national supervisory authorities, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS), with additional roles for sectoral regulators under specific Under Article 51, GDPR, each member state must designate at least one independent authority respon - sible for monitoring and enforcing the GDPR. NSAs are vested with investigative, corrective and sanction - ing powers under Articles 57 and 58, GDPR, including the power to conduct audits and inspections, require information, order compliance, impose processing bans and administrative fines. instruments (eg, the ePrivacy Directive). National Supervisory Authorities (NSAs)
92 CHAMBERS.COM
Powered by FlippingBook