Is the CrowdStrike IT outage truly a personal data breach under the GDPR?

My takeaways from the 100+ comment discussion following my post on whether the Crowdstrike incident is a “personal data breach” under the GDPR:
1. There are clearly two camps on this. I didn’t expect this level of opposition between two visions of what is a personal data breach.

2. One camp adheres to the views expressed by the EDPB + ICO, and highlights their guidance + a couple of cases that appear not to have been appealed; the other camp stresses that the legislator chose not to include unavailability in the legal definition of “personal data breach”.

3. Summary of the arguments of the “it’s a personal data breach” camp:
– The EDPB and ICO, plus some decisions of national supervisory authorities, say that “temporary” loss can be a “personal data breach”.
– This is necessary because it impacts data subjects.
– The temporary nature cannot be determined in advance.

4. Arguments of the “it’s not a personal data breach” camp:

– The EDPB/ICO/… can say what they want, in law the choice of words matters and while unauthorised access is mentioned, lack of access is not. “Loss” is not the same as temporarily inaccessible. This is a conscious choice by the legislator. [Unavailability due to a system being down (= this scenario) isn’t the same as loss of control of a USB key (where loss of personal data is more likely) or a database being corrupted.]

– The part about the impact on data subjects is irrelevant, as that is not in the statutory definition of “personal data breach”. [Plus, if it is relevant, does every single system glitch have to be seen as a personal data breach?]

– The obligation to notify only starts once you know something is a personal data breach – so if something is unavailable and you think it might be recoverable, why not be allowed to do your investigation first and then come to the conclusion that the data isn’t lost but was merely temporarily unavailable?

[Again, this is *entirely separate* from the discussion of what is a security incident and whether there are grounds to consider this a breach of Art. 32 GDPR. This discussion is purely focussed on what is a “personal data breach”.]

As you can tell, I’m not convinced by the first camp’s arguments, and the few national decisions on this are in my view insufficiently reasoned in that respect. I honestly think that the issue merits *proper clarification* at the level of the CJEU, but we will see if any case on such a topic goes all the way to there.

I’m pleased to say that I found support from an unlikely ally, Alexander Hanff, with whom I often disagree on other matters, and a shoutout also to Jon Baines for his insights. Thanks also to those from the first camp for their contributions to the discussion.

If you haven’t followed it, here is the link to the discussion: https://lnkd.in/dZHW3PUX

data protection cybersecurity privacy