What is a personal data breach
A personal data breach is a security incident that leads to:
- the accidental or unlawful destruction, loss of personal data (breach of availability),
- the accidental or unlawful alteration of personal data (breach of integrity),
- the unauthorized disclosure or unauthorized access to personal data (breach of confidentiality).
A breach may arise from causes attributable to the data controller as well as from reasons beyond their control.
It is important for the data controller to adequately secure the data by anticipating various scenarios.
Example
An employee sends an attachment containing a client's personal data to another person. As a result, that person may have accessed the client's personal data.
Here, it is essential to emphasize the word “adequately,” as the data controller should adjust the level of security to:
- the state of technical knowledge,
- the cost of implementation, and
- the nature, scope, context, and purposes of processing as well as the risk of infringement of the rights or freedoms of natural persons with varying probabilities of occurrence and severity of the threat.
This means that different obligations apply to a bank that processes a wide range of personal data of hundreds of thousands of individuals, and different obligations apply to a small local company that manufactures furniture and processes customer data necessary to fulfill orders.
How you will learn about a breach of your personal data
Most often, the sources of information about a breach will be:
- the data controller where the breach occurred,
- the media,
- an individual or entity that obtained your personal data as a result of the breach.
However, it may also happen that you do not learn about a breach of your personal data. Moreover, in some cases, the data controller is not obliged to notify you of the breach. This depends on the significance of the risk posed by the breach.
Important
The data controller must verify and assess the severity of each breach. If it determines that the breach poses a high risk to the rights and freedoms of natural persons, it should notify you of it.
Sometimes, data controllers notify individuals about less significant breaches, thereby giving them the opportunity to take steps that will help protect their interests, despite the limited risk.
Do you need to report the breach to the data protection officer of the data controller or to the Polish DPA?
No, you do not have such an obligation. However, if you have information about the breach, the data protection officer may be a source of additional information for you. They can also help clarify your doubts.
As for informing the Polish DPA - that is, the President of the Polish Data Protection Authority - you can certainly do so. However, it is not excluded that the data controller has reported the breach themselves, although it should be noted that they are not required to do so if the severity of the breach is low.
Do you need to take additional actions?
In principle, you do not have such an obligation. However, sometimes taking additional steps may protect you from potential consequences of breaches. The data controller will take (or at least should take) steps that should reduce the risk of infringing upon your rights and freedoms, but they cannot prevent all consequences of a data protection breach. They may, however, suggest appropriate actions to you by notifying you of the breach.
Example
The data controller has notified you that hackers gained access to the data stored by them, which is included in contracts, including yours. Among them are: names and surnames, residential address, PESEL number, and ID card number. With such a set of disclosed data, one should primarily consider promptly blocking the PESEL number and ID card.
The scope of actions you can take primarily depends on:
- what you know about the breach,
- how significant the scope of data that was disclosed, altered, or lost is,
- how many people gained access to your data,
- what the consequences of the event are for you (e.g., inability to use certain services),
- whether the individuals responsible for the breach acted intentionally.
You must also keep in mind that the data controller may inform you about a range of potential consequences of the breach. However, be aware that not all of them necessarily have to occur.
The worst thing you can do is panic and make decisions based on emotions.
What actions can you take - examples
The catalog of actions you can take depends on the type of breach. Below are examples of actions that may help you minimize the consequences of a breach when your sensitive data, such as:
Your ID card number:
- you can block your ID card at any bank or by using the Credit Information Bureau service;
Your PESEL:
- you can block your PESEL in the mCitizen app or at the municipal office;
Your payment card number and CVV code:
- you can block your card using online banking or by calling your bank's hotline. This way, you can block your card at any time, 24 hours a day, 7 days a week. You can also use the universal interbank Card Blocking System by calling (+48) 828 828 828.
Are you entitled to compensation for a GDPR breach?
Many people believe that a data breach easily results in the possibility of obtaining compensation from the data controller. Unfortunately, the reality is quite different. We discuss compensation in more detail here: Compensation for a GDPR breach – is it possible?
However, the general conclusion is that the harm suffered by individuals who are victims of data breaches is assessed by courts relatively low. While expectations generally hover around several tens of thousands, the compensation ultimately awarded rarely exceeds the amount of 1-2 thousand zlotys.
Summary
When you receive information about a breach, it may be useful to ask yourself the following questions:
- How might I feel the effects of the breach?
- What does the person who received the data know about me?
- What can they do with that information?
- How does the lack of access to the data make my life more difficult?
- What methods do I know to prevent this?
- Do I need the assistance of a specialist?
