Is sending employee payslips to an unauthorized person a personal data breach?

ANSWER

The situation described constitutes a personal data breach as defined in Article 4(12) GDPR, i.e. the disclosure of personal data to an unauthorized person. As a rule, the data controller is responsible for this situation, i.e. the employer or the processor (external company). First, it is necessary to determine who made the mistake regarding the email address — the employer or the external company.

A request for explanation should be submitted to both entities. Under Article 82(1) GDPR, the data subject has the right to claim compensation for a breach of the GDPR if, as a result of that breach, they suffered material or non-material damage. The right to claim compensation under Article 82(1) GDPR applies against either the controller or the processor.