Why an IT system outage does not automatically equal a GDPR data breach

Some seem to suggest that “unavailability of IT system = security incident = personal data breach”. While data protection *authorities* regularly suggest unavailability is a breach, the main EU *law* on data protection, the GDPR, doesn’t say so.

Definition of “personal data breach” in Art. 4(12) GDPR: “breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”. Unavailability of a system – even managed by a processor – is not explicitly covered by the categories “accidental/unlawful destruction”, “accidental/unlawful loss”, “accidental/unlawful alteration”, “unauthorised disclosure” or “unauthorised access”.

Sure, availability is one of the core tenets of security – so even temporary unavailability could be argued to be a breach of security. But a personal data breach? For that to be the case, a breach of security would normally have to lead to… something other than unavailability.

Might some regulators disagree? Of course (and some even did at one point, suggesting that temporary unavailability was a personal data breach)! Part of their job is to encourage maximal compliance and broad interpretations. Better to have false positives than false negatives, they might argue.

But if your company is faced with an issue like this, don’t forget to check:

1. If you notify, are you creating a dangerous precedent for yourself? Would you have to notify every single DDoS attack or temporary system glitch? Or will you justify it based on specific circumstances linked to this particular situation?

[This is not hypothetical – I have had to help some clients document the (very good) reasons for which they choose *not* to notify some incidents of a kind that had been considered as (notifiable) personal data breaches in the past, and I have had cases where authorities asked pointed questions to companies based on data breach registers.]

2. If you don’t notify, do you run the risk of being the only one not to? If so, do you *want* to be that one? Are you confident enough of your position? If pressed by a regulator, would you die on a hill for it?

In my experience, some companies actually *need* to take the position that unavailability as such is not a personal data breach, in particular IT service providers (SLAs are there for a reason), because otherwise their entire business model can be at significant risk.

So, what will you do?

[Plus, don’t forget that the GDPR isn’t the *only* cybersecurity and security incident notification law. In the EU, you have many other to take into account – so even if a security incident isn’t a personal data breach, you might have to notify it anyway based on e.g. NIS2. If you don’t know your obligations, maybe it’s time we had a chat.]

EDIT: summary of the discussion: https://lnkd.in/deBjymtz