Processor breach notification duty (GDPR Article 33(2))

The processor's breach duty is the rule of Article 33(2) of the GDPR (General Data Protection Regulation) that applies to a provider processing data for a client. If it discovers a breach, it must inform that client, the controller, without undue delay. On May 31, 2023, Progress Software warned customers of a SQL (Structured Query Language) injection flaw in MOVEit Transfer, CVE-2023-34362 (an identifier in the Common Vulnerabilities and Exposures catalog), which the Cl0p group had been exploiting for several days. Among the victims was Zellis, a UK payroll provider, and then its clients: British Airways, the BBC and Boots learned from Zellis that their employees' data had been taken. Under Regulation (EU) 2016/679, the delay runs from the moment the processor becomes aware of the breach. It notifies the authority only if the client has authorized it to do so on its behalf, and it has no risk assessment to make. Article 28(3)(f) requires it to assist the controller with Articles 32 to 36. The contract puts a number on “without undue delay”: often 24 or 48 hours in negotiated data processing agreements, sometimes nothing beyond the statutory words. The EDPB (European Data Protection Board) treats the controller as aware once its processor has informed it; the 72 hours run from there, not from the intrusion. For the underwriter, MOVEit showed aggregation through the vendor: hundreds of insureds hit by a single flaw without any of their own systems being compromised. The first thing to read is the definition of the insured's computer system, and whether it extends to data entrusted to a service provider. Notification costs for employees stay with the client, as controller. Recourse against the processor exists, but it often runs into a liability cap of a few months of fees. And an insured told on day nine by its vendor has little chance of pleading that delay before the authority.