EDPB Guidelines 9/2022 on personal data breach notification
The EDPB (European Data Protection Board) text that sets the European reading of Articles 33 and 34 of the GDPR (General Data Protection Regulation): when the 72-hour clock starts, which authority to notify, and when risk becomes high. A separate collection of worked cases supplements it.
Guidelines 9/2022 are the text in which the EDPB (European Data Protection Board) sets the European reading of Articles 33 and 34 of the GDPR (General Data Protection Regulation) on personal data breach notification; version 2.0 was adopted on March 28, 2023. The only substantive change sits in paragraph 73: appointing an EU representative under GDPR Article 27 does not open the one-stop-shop. A controller established outside the European Economic Area therefore notifies the authority of every Member State where affected individuals reside. Version 1.0, dated October 10, 2022, carried forward the Article 29 Working Party's WP250 guidelines. The text clarifies Regulation (EU) 2016/679 on the point that drives disputes: awareness. A controller becomes aware of a breach when it has a reasonable degree of certainty that a security incident has compromised personal data. A short investigation period is allowed before that point, and it starts with the first alert; it is no device for pushing back the clock. Guidelines 01/2021, version 2.0 adopted December 14, 2021, supply the cases: ransomware with or without backup, exfiltration, misdirected mail, each with what must be notified and to whom. For the underwriter, two consequences follow. A US insured serving customers in ten Member States will pay for ten notifications, ten counterparts and a breach coach coordinating local counsel. Incident response costs therefore rise with the geography of the customer base, regardless of the insured's size. And the awareness date the authority settles on does not always match the policy's discovery date. Late notification invites an investigation whose defense falls under regulatory investigation cover, even where the fine itself is uninsurable.
Textbook case: a fictional software vendor based in Boston, with no EU establishment, discovers the exfiltration of 150,000 customer accounts spread across 9 Member States. It has a representative in Dublin, which changes nothing: 9 notifications. Local counsel at 12,000 euros per country: 108,000 euros, plus the breach coach's coordination, 40,000 euros, for 148,000 euros before a single letter goes to individuals. Notifying Dublin alone would have left eight authorities uninformed.
Guidelines 9/2022, EDPB breach notification guidelines, WP250, Guidelines 01/2021, Examples regarding personal data breach notification, Becoming aware of a breach, EDPB breach guidance
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.