CLVPartners

CLV-02
Menu

NAIH

Personal data breaches and tasks related to their management

Data protection, News / / , , ,

Alongside technological development, numerous tools and methods have emerged with the aim of gaining unauthorized access to personal data. Although the tools used for cyber-attacks are becoming increasingly sophisticated, personal data continues to be most at risk from human error and carelessness. Regulation (EU) 2016/679 of the European Parliament and of the Council (the “General Data Protection Regulation,” “GDPR“) sets out detailed requirements for businesses and organizations regarding the collection, storage, and processing of personal data, compliance with which is essential for the protection of personal data and the proper enforcement of data security. The GDPR also contains provisions on how data controllers should act in the event of a personal data breach. In this article, we summarize the most important facts about personal data breaches.

Definition of the personal data breach

During the course of processing personal data, data controllers must take the measures specified in the GDPR to ensure the security of data processing. Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

For an incident to be considered a personal data breach, the violation of data security must be of such a nature that it poses a substantial risk to the protection of personal data. Data controllers need to be aware that it is not only the loss of personal data that constitutes a personal data breach. Personal data breach include:

  • Breaches of confidentiality, which may occur through the unauthorized disclosure of personal data (e.g., an email sent to the wrong recipient, or if documents containing personal data are saved in the wrong place, they may be shared with persons who are not otherwise authorized to access them, including other employees of the company). However, confidentiality breaches may also result from intentional conduct (e.g., unauthorized access through phishing attacks).
  • Breaches of integrity, which occur when personal data that has been processed is altered (e.g., when a person with access to accounting records – whether authorized or unauthorized – rewrites payments or breaks into the database in such a way that personal data gets deleted).
  • Breaches of availability, which refer to the destruction of processed data (whether accidental deletion or temporary server failure) or loss of access to data (e.g., loss or theft of a laptop or data storage device containing a copy of the customer database).

In summary, a personal data breach occurs when personal data is accessed without authorization, transferred without permission, or becomes inaccessible due to, for example, encryption by ransomware, accidental loss, or destruction.

Consequences of a personal data breach

Personal data breaches, if not handled properly and in a timely manner, can cause serious physical, financial, or non-financial damage to the people involved. Such consequences may include financial loss, identity theft, damage to reputation, or disclosure of confidential information. Furthermore, data protection incidents may lead to a loss of trust in the company as a data controller, and their improper handling may result in sanctions by the authorities.

Procedure to follow in the event of personal data breaches

Given that personal data breaches can have serious consequences, the data controller is obliged to handle the situation in accordance with the GDPR upon becoming aware of the breach. However, this requires that anyone who notices such a breach immediately report it to the designated data protection officer. It is advisable to set out the procedure for this in internal regulations.

Record of the personal data breaches

Under the GDPR, the data controller must keep a record of personal data breaches, including the facts relating to the breach, its effects and the remedial action taken.

Reporting personal data breaches

Personal data breaches shall be reported to the National Authority for Data Protection and Freedom of Information (“NAIH“) without undue delay and, where feasible, no later than 72 hours after the personal data breach has come to the knowledge of the controller. If the notification is not made within 72 hours, the reasons for the delay must be attached to the notification.

For the notification, the NAIH also provides a form available on its website, which can be submitted electronically (e.g., via official storage space or e-Paper service) by data controllers who are required to conduct electronic administration or who voluntarily undertake to do so.

The report must include:

  • the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
  • the name and contact details of the data protection officer or other contact point where more information can be obtained;
  • the likely consequences of the personal data breach;
  • and the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
  • Last but not least, the report must include a copy of the relevant section of the report of the personal data breaches relating to the incident in question.

The report may be omitted only in the case of so-called ‘bagatelle’ incidents. Such incidents are those which are unlikely to pose a risk to the rights and freedoms of natural persons, but even in such cases, the incident must be recorded in the register.

Communication with the data subject

When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. The purpose of this measure is to enable the persons concerned to take the necessary precautions (e.g. reporting the theft of identity documents, blocking bank cards).

Risks should be assessed individually for each incident. During the process, aspects such as the type of personal data (e.g., special data) and the amount of data, the number of data subjects, and the possibility of identifying data subjects must be taken into account.

The data subjects do not need to be informed of a high-risk data protection incident if:

  • personal data is encrypted in such a way that it cannot be interpreted;
  • the data controller has since implemented appropriate protective measures;
  • or would require disproportionate effort on its part. (In such cases, the persons concerned shall be informed by means of public communication or similar measure whereby the data subjects are informed in an equally effective manner.)

 Summary

Personal data breaches represent a very broad definition of data security breaches. Such breaches can cause serious financial or non-financial damage to those involved, and if they are not handled properly, they can result in fines of up to several million forints. Data controllers are obliged to ensure the protection of personal data already during the processing of data. Therefore, prevention should be the primary focus. Properly implemented security measures (e.g., establishing authorization systems, adequate protection of passwords and devices) may be suitable for preventing breaches from occurring. In order to determine and comply with these, it is advisable to prepare internal procedures and action plans in advance and review them at regular intervals, as well as to provide data protection training to persons involved in data processing (e.g. employees) at appropriate intervals. In the event of a concrete personal data breach, it is also recommended to involve an expert, given the special rules of formalized official procedures and the need for individual assessment.

Image source: pixabay, pexels.com

Personal data breaches and tasks related to their management Read More »

President of HDPA tempers position on thermometers!

Company groups, Data protection, Employment, labour law, Medium-sized companies, News, Start-ups / / , , , ,

The Head of the Hungarian Data Protection Authority in his interview made an announcement contrary to the Authority’s previous official position.

Unlike in Spring, in the current epidemiological situation in Hungary it is no longer disproportionate to implement body temperature measurement as a general measure, however, recording the results is still considered unjustifiable, because as health related data it would be considered a special category of personal data which should be especially protected.

The Head of the Hungarian Data Protection Authority in his interview made an announcement contrary to the Authority’s previous official position, that unlike in Spring, in the current epidemiological situation in Hungary it is no longer disproportionate to implement body temperature measurement as a general measure, however, recording the results is still considered unjustifiable, because as health related data it would be considered a special category of personal data which should be especially protected.

As a reminder, the Authority’s guidelines issued on 11 March 2020 and its confirmatory official position issued on 28 April 2020 considered disproportionate the requirement of screening tests with any diagnostic device (in particular, but not exclusively, with a thermometer), as the epidemiological situation in Spring did not warrant such measures.

The HDPA president’s statement did not affect the rest of the previously issued guidelines and official position, therefore all data processing in connection with the novel coronavirus epidemic such as body temperature measurement may only be introduced in the legitimate interest of the employer, substantiated by a proportionality test and the measurement shall be conducted by healthcare professionals or under their professional supervision under Article 9 (3) of the GDPR.

The Authority invariably requires employers to prefer measures which do not require the processing of personal data (basic hygiene, provision of disinfectants, adequate cleaning, provision of protective equipment, distance between workers).

Should you have any questions regarding the above, feel free to contact us.

President of HDPA tempers position on thermometers! Read More »

Enormous data protection fine imposed by the HDPA

Company groups, Data protection, Medium-sized companies, News, Start-ups / / , , , ,

On 18 May 2020, the Hungarian Data Protection Authority („HDPA” or „Authority”) has imposed a fine of HUF 100 000 000 on DIGI Távközlési és Szolgáltató Korlátolt Felelősségű Társaság („Digi” or „Company”).
The decision has been published by the Authority today, which is by far the highest amount imposed since the GDPR’s entry into force and the existence of the HDPA. The facts leading to the fine and the subsequent decision of the Authority are summarized as follows:

Facts of the case

1. Due to a prior loss of data, Digi created a test database for the purposes of mitigating errors, which the Company filled with existing personal data. The test database was originally available on the Company’s website only with appropriate authorization.

2. The content management system (‘CMS’) applied by the Company had a vulnerability, which has been detected more than 9 years ago. This vulnerability can also be detected and amended automatically by adequate tools and applications. Through this vulnerability, anyone could view the test database without access authorization.

3. Exploiting this vulnerability, an ethical hacker gained access to the test database, where the personal data of a significant number of clients were stored in plain text without any encryption. These data included all personal identifying data, ID card numbers, and in some cases personal identification numbers, e-mail addresses, telephone numbers and bank account numbers were also included.

4. In addition to the above, data of newsletter subscribers and full access system administrators were also accessible through the vulnerability, which could have been used by an attacker to take over complete control of the website and access any personal data or trade secret available on the website.

Findings of the HDPA

• The categories of personal data involved made identity theft possible for a potential attacker.

• It is also an aggravating circumstance that the number of people affected by the data protection incident is significant, even in relation to the entire population of Hungary, the Company’s market position would have justified the application of more serious data security measures.

• The vulnerability in the open source content management system has been known for a long time, and a fix is available to fix this vulnerability for free.

• Lack of encryption increased the risk of the incident, even though the Company would also have had the opportunity to encrypt its data for an insignificant cost.

• Leaking access credentials for full system administrators severely increases security risk.

• The maintenance of the test database violated the principles of the GDPR, as the test database should have been permanently deleted once its purpose has been fulfilled.

• The Company has also violated the provisions of its own internal regulations.

In light of all of the above, the Authority considered that the warning would not have had sufficient deterrent effect and that a fine, the exceptionally high amount of which was explained by a number of aggravating circumstances, was justified.

Enormous data protection fine imposed by the HDPA Read More »

Statement of the EDPB on data processing during the coronavirus epidemic

Company groups, Data protection, Medium-sized companies, News, Start-ups / / , , , , , ,

The European Data Protection Board (“EDPB”) has issued a statement on its website on data processing during the coronavirus epidemic.Please find our summary of the statement below:
1. The conditions of processing health data, as special category of data shall be specified by the national law in accordance with the GDPR. In this regard, the GDPR requires that the lawmaker defines specific measures and the suitable safeguards of the rights of the data subjects.

2. As per the position of the Hungarian Data Protection Authority emphasized, in the event of medical examinations such as body temperature measurement, this safeguard is the presence of a healthcare professional, therefore it is still not possible to implement such measurement at the workplace without the presence of a professional.

3. According to the EDPB’s position, the employers should inform employees if a coronavirus infected person has been identified at the workplace (to take the necessary protective measures), without revealing the identity of said person. The concerned employees shall be informed in advance and their dignity and shall be protected. Information on the infection should be first and foremost disclosed to those entitled to process these data, such as authorities and treating physicians if requested.

As the GDPR allows for a wide range of derogations in national law, we can expect a more detailed regulation of the data processing in relation to the epidemic.

The content of this article is not exhaustive and does not constitute a legal advice. Should you have any specific questions regarding any issues investigated by our articles, please contact us and we will be happy to be at your disposal.

Statement of the EDPB on data processing during the coronavirus epidemic Read More »

HDPA issues statement on the monitoring of employee e-mails

Company groups, Data protection, Employment, labour law, Medium-sized companies, News, Start-ups / / , , , ,

At the end of last year, the Hungarian Data Protection Authority (HDPA) issued a statement, in which the HDPA commits itself to take all possible actions and use all available means – including adequate legal consequences to prevent further infringements – to stop the widespread practices of unlawful processing of employee e-mails. 
How does personal data enter the picture?

Even if an e-mail address was provided for the purposes of working, it might eventually be used by the employee for personal matters, or third parties might send personal e-mails to the address, which turns this into a question of data privacy. Although some advisable steps can be taken to prevent the personal use of work e-mail addresses (i.e. the prohibition of personal use of work assets), it is not seemingly possible to fully separate the two uses, since receiving a personal e-mail from a third party is generally outside the employer’s or employee’s control. It is also important to note that if an employee uses the work e-mail address for personal matters despite possible explicit prohibitions set in place, such an act will still be attributed to the employer’s data processing, thus the processing of personal data is unavoidable.

What is expected of the employers?

First and foremost, employers should determine the lawful ground of the processing. The HDPA highlighted storing, archiving and searching/ indexing as the most common processing actions performed on employee e-mails. Naturally, employers have a vested interest in the monitoring of employee e-mails, as it is necessary to control and maintain the work flow, therefore the lawful ground must be substantiated by a thorough balancing test prior to the processing. Once the lawful ground is established, it is advisable to prepare an SOP on the monitoring process.

The employer must duly inform the employees about the monitoring of work e-mails, the data processing and whether or not personal use of work e-mails is permitted or prohibited at the workplace.

Before or during the monitoring, the employer must take all reasonable steps to separate work related and private e-mails. In accordance with the principle of accountability, the employer should maintain a record of the steps taken during monitoring.

Considering the fact that almost every employer provides its employees with an e-mail address for work purposes, this statement is important to all employers who wish to be compliant with the GDPR and employees interested in the protection of their private lives.

HDPA issues statement on the monitoring of employee e-mails Read More »

NAIH imposed a fine of one million forints

Company groups, Data protection, Medium-sized companies, News, Start-ups / / , , , , ,

The Hungarian Data Protection Authority (NAIH) imposed a fine of one million forints on a company with a turnover of 15 million forints, which the Authority considered to be a symbolic amount of money, for not restricting and issuing copies of camera recordings, despite a request from the data subject.

The data subject wanted to use the recordings as evidence in legal proceedings, as he/she also stated in the request. The company justified its decision of not restricting and giving out a copy of the recordings because the data subject did not indicate how deleting of the camera recording would infringe his/her legitimate interest, and in connection with what legal proceedings he/she requests the restriction of processing data of the camera recordings, although it is required to do so according to the Act CXXXIII of 2005 on the private security services and the activity of private detectives (Szvmt).

According to NAIH, the company violated the data subject’s right to restrict data processing. According to Article 18 (1) (c) of the GDPR, it is sufficient for the data subject to argue that the restriction of the processing is necessary for the submission and enforcement of his legal claims. In this regard, Szvmt. is expected to be amended soon.

According to the opinion of NAIH, the company should have complied with the request of the data subject without consideration, since the reason stated by the data subject shall be sufficient to fulfill the request.

In imposing the fine, the Authority assessed the nature of the infringement as an aggravating circumstance, as it violated the applicant’s rights, furthermore, the refusal of the request has led to the deletion of the recordings, which cannot be restored. It was a mitigating circumstance that the company committed the infringement for the first time, and also that the provision referred from the Szvmt. is still in force, which could have misled the company in its decision to deny the data subject’s request.

NAIH imposed a fine of one million forints Read More »

Google fined €50 million for infringing the GDPR

Company groups, Data protection, Medium-sized companies, News, Start-ups / / , , , , , ,

On 21 January 2019, the French Data Protection Authority (the ‘CNIL’) fined Google EUR 50 million for infringement of the GDPR. Though this decision only concerned user data, given the unprecedented amount of the fine, it should be considered a warning to all companies to ensure that their personal data management practices, including on HR matters, are GDPR compliant.
The Authority based the investigation on two complaints that arrived immediately after the entry into force of GDPR on May 25, 2018.

The CNIL has examined the complained data processing operations and found two types of infringement.

• Violation of the obligation to have a legal basis for advert personalization processing:

The CNIL observed that the information on the data processing activities provided to users was neither easily accessible nor always clear or comprehensive. Essential information required to sufficiently inform data subjects of storage purposes, periods or categories of personal data used for ads personalization was spread across various documents.

• Violation of the obligation to have a legal basis for advert personalization processing:

Google relied on data subjects’ consent to process data for ad personalization purposes. However, the Authority found that this agreement did not constitute specific, informed and unambiguous consent for the data subjects, because they had to ‘agree’ to Google’s entire privacy policy and terms and conditions in order to access the its products. The CNIL concluded that the data subjects’ consent was not freely given, because they had not been sufficiently informed due to the use of multiple documents and the unclear depiction of the services and websites that would be involved in the ad personalization section.

Further, the CNIL noted that before creating a Google account, each user was asked to agree to the company’s terms of service and privacy policy, which he or she could only amend at a later time by going into ‘more options’ and de-selecting ad personalization.

This is the first time that the CNIL has applied the new sanction limits provided by the GDPR since its entry into force on 25 May 2018. In imposing the fine, the Authority took into account the serious breach of the main principles of the GDPR, according to which the maximum amount to be imposed could be EUR 20 million or 4 % of the company’s global annual turnover. The factors taken into consideration in the Authority’s decision whether to impose a fine or its amount, were the fact that Google’s violations were not one-off incidents or limited in time, but rather continuous breaches of the GDPR, and that their data process cover a wide range of data subjects. Lastly, the CNIL pointed out that as the company’s business model was partly based on ad personalization, Google had all the more reason to ensure that it complied with its GDPR obligations.

The fines serve as a lesson for employers that they need to ensure that the information provided to applicants and employees on the processing of their personal data is clear, unambiguous and easily accessible.

Google fined €50 million for infringing the GDPR Read More »

Blacklist on Data Protection Impact Assessment (DPIA)

Company groups, Data protection, Medium-sized companies, News, Start-ups / / , , , , , , ,

Under Article 35 (4) of regulation (EU) 2016/679 of the European Parliament and of the Council („GDPR”), the National Authority for Data Protection and Freedom of Information
(„NAIH”) established a list of the kind of processing operations which
are subject to the requirement for a data protection impact assessment („black list”).
According to article 35 of the GDPR: Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.

The GDPR defines some circumstances when a DPIA is to be carried out:
• a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and upon which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;
• processing on a large scale of special categories of data, or of personal data relating to criminal convictions and offences; or
• a systematic monitoring of a publicly accessible area on a large scale.

The black list contains the following processing activities when a DPIA is to be carried out:
• processing of biometric or genetic data;
• scoring;
• credit or solvency rating;
• further use of data collected from third persons;
• the use of the personal data of pupils and students for assessment;
• profiling;
• anti-fraud activity;
• smart meters;
• automated decision making producing legal effects or similarly significant effects;
• systematic surveillance;
• location data;
• monitoring employee work;
• processing of considerable amounts of special categories of personal data;
• processing of considerable amounts of personal data for law enforcement purposes;
• the processing of the personal data of children for profiling;
• the use of new technologies for data processing;
• the processing of health data;
• an application, tool, or platform for use by an entire sector;
• combine data from various sources.

Blacklist on Data Protection Impact Assessment (DPIA) Read More »

Resolution on criteria for setting administrative fines

Company groups, Data protection, Medium-sized companies, News, Start-ups / / , , , ,

In its resolution published on 19 September 2018, the National Authority for Data Protection and Freedom of Information (NAIH) assessed the criteria to take into consideration during the process of setting a fine, especially the level of the fine that NAIH may impose in case of the first infringement of the data protection regulations.

The Authority is being guided by the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council (“Regulation”) and the Act CXII of 2011 on Informational Self-determination and Freedom of Information (“Info Act”) with regard to the determination of the fine.

Article 83 (1) of the Regulation states, that the administrative fines shall be effective, proportionate and dissuasive. Pursuant to Preamble (148) in a case of a minor infringement or if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine.

This provision was completed by Section 75/A of the Info Act according to which the Authority shall exercise its competence provided for in Article 83 (2)-(6) of the Regulation in due consideration of the principle of proportionality, in particular with the provision that in the event of any non-compliance with the Regulation for the first time, the Authority shall in principle issue warning to the data controller or data processor in order to arrange the remedy of the infringement.

The Authority shall take into account the Data Protection Working Party (WP29) guidelines on the application and setting of administrative fines for the purposes of the Regulation 2016/679, available at the following link: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611237

Resolution on criteria for setting administrative fines Read More »

CLVPartners
Powered by  GDPR Cookie Compliance
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.