出海歐洲 | 數據泄露應對——發生數據泄露後，你有72小時

並非所有數據泄露都需要通知監管機構。GDPR規定，只有當數據泄露“可能導致個人權利和自由面臨風險”時，才需要進行通知。如果泄露“不太可能導致個人權利和自由面臨風險”，則無需通知。判斷風險程度需要企業進行專業的風險評估，考慮泄露數據的性質、敏感性、數量、受影響數據主體的特征以及泄露可能造成的後果（如身份盜竊、財務損失、聲譽損害等）。

此外，如果數據泄露“可能導致個人權利和自由面臨高風險”，數據控制者還需要“在不無故拖延的情況下”通知受影響的數據主體。這意味著，除了通知監管機構，企業可能還需要直接告知受影響的個人。

向監管機構提交的通知應至少包含以下信息：

1. 泄露性質： 描述個人數據泄露的性質，包括受影響的個人數據類別和大致數量，以及受影響的數據主體類別和大致數量。

2. 數據保護官（DPO）或聯系人信息： 提供可以獲取更多信息的DPO或企業其他聯系人的姓名和聯系方式。

3. 可能的後果： 描述數據泄露可能造成的後果。

4. 已采取或擬采取的措施： 描述數據控制者為應對數據泄露而已經采取或擬采取的措施，包括（如適用）為減輕其可能的不利影響而采取的措施。

值得注意的是，如果企業是數據處理者（Data Processor）（即代表數據控制者處理個人數據），一旦發現數據泄露，必須“在不無故拖延的情況下”立即通知相關的數據控制者。數據處理者沒有直接通知監管機構的義務，但其及時通知數據控制者的行為，是數據控制者履行72小時通知義務的前提。

Responding to Data Breaches: You Have 72 Hours After a GDPR Data Breach

Article 33 of the GDPR explicitly states that in the event of a personal data breach, the Data Controller must notify the relevant Supervisory Authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it”. If notification is made after 72 hours, the reasons for the delay must be provided. This strict deadline aims to ensure that supervisory authorities can intervene promptly, assess risks, and guide data controllers in taking appropriate measures to minimize harm to Data Subjects.

Not all data breaches require notification to the supervisory authority. The GDPR stipulates that notification is only required if the data breach “is likely to result in a risk to the rights and freedoms of natural persons”. If the breach “is unlikely to result in a risk to the rights and freedoms of natural persons,” no notification is required. Assessing the level of risk requires enterprises to conduct a professional risk assessment, considering the nature, sensitivity, volume of the breached data, characteristics of the affected data subjects, and the potential consequences of the breach (e.g., identity theft, financial loss, reputational damage).

Furthermore, if the data breach “is likely to result in a high risk to the rights and freedoms of natural persons,” the data controller must also notify the affected data subjects “without undue delay”. This means that in addition to notifying the supervisory authority, enterprises may also need to directly inform the affected individuals.

The notification submitted to the supervisory authority should include at least the following information:

1. Nature of the Breach: A description of the nature of the personal data breach, including the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned.

2. Data Protection Officer (DPO) or Contact Information: The name and contact details of the DPO or other contact point where more information can be obtained.

3. Likely Consequences: A description of the likely consequences of the personal data breach.

4. Measures Taken or Proposed: A description of the measures taken or proposed to be taken by the data controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

It is important to note that if an enterprise is a Data Processor (i.e., processing personal data on behalf of a data controller), it must notify the relevant data controller “without undue delay” upon becoming aware of a data breach. Data processors do not have a direct obligation to notify the supervisory authority, but their timely notification to the data controller is a prerequisite for the data controller to fulfill its 72-hour notification obligation.

Understanding the practical impact of GDPR data breaches helps enterprises better grasp the importance of compliance.

In 2020, Swedish fashion retailer H&M was fined a massive €35.3 million by the Hamburg data protection authority in Germany due to an employee data breach at its German service center. The investigation revealed that H&M had collected extensive highly sensitive personal data about employees’ family lives, health conditions, religious beliefs, etc., without their consent, and stored it on a network drive accessible to over 100 managers. This data was used to evaluate employee performance and make management decisions. This breach exposed serious deficiencies in the company’s internal data management and access control. This case highlights that enterprises must not only guard against external attacks but also pay attention to internal data management norms and employee privacy protection.

In 2021, the Irish Data Protection Commission (DPC) fined WhatsApp €225 million for failing to adequately inform users how it processed personal data and shared data with its parent company, Facebook. Although this was not a “data breach” in the traditional sense, it underscored the GDPR’s strict requirements for data processing transparency. Enterprises must clearly and explicitly inform users about how their data is collected, used, and shared when processing user data; otherwise, they may also face substantial fines.

• Misdirected Email: An employee of a company mistakenly sends an email containing sensitive customer information to the wrong recipient. Although unintentional, if the information is sensitive and could cause risk, a breach notification process still needs to be initiated.

• Loss of Unencrypted Device: An employee loses an unencrypted laptop containing a large amount of customer personal data. Since the data is unencrypted, there is a risk of unauthorized access to the data, requiring assessment and potential notification.

These cases demonstrate that data breaches come in various forms and have serious consequences. Enterprises must establish a comprehensive data protection system to address various potential risks.

Facing the strict requirements of the GDPR, Chinese enterprises expanding into the EU should adopt a proactive strategy and build a robust data breach response mechanism.

A clear and actionable response plan is the cornerstone of responding to data breaches. This plan should include:

• Identification and Assessment: Clearly define the data breach identification process, responsible persons, and risk assessment criteria.

• Containment and Recovery: Develop measures to quickly contain the breach, minimize damage, and restore system and data integrity.

• Notification Procedures: Detail when and how to notify supervisory authorities and data subjects, as well as the information required for notification.

• Investigation and Documentation: Stipulate the investigation process for breach incidents, evidence collection, and detailed documentation requirements for subsequent review and improvement.

For enterprises that process large amounts of personal data or special categories of data, the GDPR mandates the appointment of a DPO. Even if not mandatory, appointing a DPO or a designated person with professional knowledge to be responsible for data protection affairs can effectively enhance the enterprise’s data compliance level and ensure a swift and professional response in the event of a data breach.

Many data breach incidents stem from human error. Regular data protection and cybersecurity training for employees, raising their awareness of data breach risks, and clarifying their responsibilities in data protection are crucial for preventing and responding to data breaches.

Deploy advanced security technologies (such as intrusion detection systems, data encryption, access control) and continuously monitor systems to promptly discover and fix security vulnerabilities. Regularly conduct security audits and penetration tests to ensure the effectiveness of technical protection measures.

供稿丨廣悅米蘭辦公室

編輯丨吳寶渲

審核丨黎麗娜

審定丨品牌宣傳與市場拓展委