Communication of a personal data breach to data subjects (GDPR Article 34)
The duty, set by Article 34 of the GDPR (General Data Protection Regulation), to tell affected individuals directly and without undue delay when a breach is likely to result in a high risk to their rights and freedoms. The duty falls away when one of the three Article 34(3) exemptions applies.
Communication to data subjects is the message a controller sends directly to the people whose data a breach has affected when the breach creates a high risk for them. Article 34 of the GDPR (General Data Protection Regulation) requires it. On December 28, 2021, the restricted committee of the CNIL (Commission nationale de l'informatique et des libertés) fined Slimpay, a French payment institution, 180,000 euros. A server left online without protection after an internal research project exposed data on some 12 million people, banking details included, and none of them had been told. The CNIL found a breach of Article 34, alongside Articles 28 and 32. The mechanism fits in four paragraphs. Article 33 of Regulation (EU) 2016/679 is about the authority. Article 34 is about the people, and only when the risk is high, through a message in clear and plain language that describes the nature of the breach and gives the contact of the DPO (data protection officer), the likely consequences and the measures taken. Paragraph 3 waives the duty in three cases: the data were rendered unintelligible, encryption first among the methods; subsequent measures make the high risk no longer likely; individual notice would involve disproportionate effort, and an equally effective public communication takes its place. Paragraph 4 gives the authority the last word: it can order the communication or find that an exemption applies. For the underwriter, this is the article that writes the bill. Letters, call center, free credit monitoring: notification costs scale with the number of people notified, and that number is decided here. The wording to read is notification “required by law.” Some policies stop there; others also pay for voluntary notice given on the breach coach's advice. An insured that notifies 400,000 customers out of caution when encryption opened the exemption may find the narrower wording held against it. Staying silent to save money costs in a different way, as Slimpay shows: the silence itself is sanctioned, which sends the matter to regulatory investigation cover.
Textbook case: a fictional retailer loses 200,000 customer records, names, addresses and card numbers in clear text. The risk is high and no exemption applies. Letters at 0.80 euro each: 160,000 euros. Call center for six weeks: 90,000 euros. Credit monitoring taken up by 10% of recipients, 20,000 subscriptions at 15 euros: 300,000 euros. Total: 550,000 euros, before the breach coach's fees. Had the card numbers been encrypted with the key out of reach, Article 34(3)(a) could have waived every letter.
GDPR Article 34, Data subject notification, Breach communication to individuals, Individual breach notification, Notifying affected individuals, Article 34(3) exemptions
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.