Breach call center

A breach call center is the phone operation, often run by an outside vendor, that answers affected individuals once breach notices go out, working from a script approved by counsel. Article 34(2) of Regulation (EU) 2016/679: the communication to individuals carries the items listed in Article 33(3), including the name and contact details of the data protection officer or another contact point. When the notice goes to 300,000 people, that contact point is a call center, and it has to pick up the day the letters land. Sizing starts from the file and the expected call rate, which depends on the data lost: a card or Social Security number drives far more calls than an email address. Staffing opens heavy in the first week, when the press picks up the story, then scales down. Agents work from a script and FAQ approved by counsel, since every sentence said on the phone can end up in a class action: nothing on root cause, nothing that sounds like an admission, escalation to the legal team for journalists, plaintiffs' lawyers and threats. Languages follow the file. The vendor bills per call, per minute or per notified person, with a setup fee. A cyber policy files the call center under notification costs, less often under crisis management costs, and the insurer's panel often fixes the vendor. Friction points: a center kept open for months for reputational reasons, past the duration the wording or the carrier will accept; and calls from customers who never got a letter, when the insured chose to communicate broadly. Run well, the center cuts complaints to regulators: a person who got an answer writes less often to the CNIL (Commission nationale de l'informatique et des libertés) or the attorney general.