(Data Protection News & Services)
The Dutch Data Protection Authority (DPA) has imposed a €475,000 fine on Booking.com because the company reported a data breach to the DPA 22 days later instead of whithin the required 72 hours.
When the breach occurred, criminals accessed the personal data of over 4,000 customers including the payment card information of almost 300 people.
The European Data Protection Board (“EDPB”) has recently released new draft guidelines on personal data breach notification.
These new guidelines complement the previous and more general guidelines on the same subject that were issued by the EDPB, then the article 29 Working Party, in October 2017 (see here for more details)
Although quite comprehensive, the previous guidelines lacked practical details in certain regards as they were drafted at a time where the authorities and organisations did not have much experience of personal data breach notification. More than two years later, the EDPB has decided to provide guidelines made up of practical examples taken from their experiences.
By decision of 30 October 2020, the ICO (i.e., the UK data protection authority) issued an £18.4 million fine on Marriott International Inc for failing to comply with its GDPR security obligation.
This decision stems from a cyber attack on Starwood, a company acquired by Marriot in 2016, notified to the ICO in 2018. The ICO investigation traced the cyber-attack back to 2014. It concerned million of customers’ personal information, including among other their reservation details, payment card details, and passport number.
The Information Commissioner’s Office (ICO) imposed a fine of £20m on British Airways (BA) for failing to protect the personal and financial details (payment card details) of more than 400,000 customers.
The ICO investigation revealed that the BA had not implemented adequate security measures and as a result, could not detect a cyber-attack, which took place in 2018 until BA was made aware of the attack by a third party two months later.
Under the General Data Protection Regulation (GDPR), controllers mustnotify:
the competent authority of any personal data breach likely to result in a risk to the right and freedoms of the data subjects;
the individuals concerned of any personal data breach likely to result in a high risk to their rights and freedoms.
It is therefore important for a controller to understand what a personal data breach is and to be ready to react promptly and appropriately when it happens.