8 ms·
It's worth noting that Article 33(1)[1] states that a breach must be reported to the local supervisory authority unless said breach is 'unlikely to result in a
by trampypizza 9y ago
It's worth noting that Article 33(1)[1] states that a breach must be reported to the local supervisory authority unless said breach is 'unlikely to result in a risk to the rights and freedoms of natural persons'. This call is made by the organisation which suffered from the breach, by the way (certainly in the absence of any case law).
It will be interesting to see the interpretation of that clause in action, specifically when looking at information such as IP address which is still considered a grey area.
[1] https://gdpr-info.eu/art-33-gdpr/ https://gdpr-info.eu/art-33-gdpr/
- consp 9y agoWhile the decision to do/not-do is up to the company; They still have to document it (in any case, even non-personal), mention the reason for not reporting (e.g. "it's only an IP address") and make that document available upon request. So if the breach turns out to be a bit more major than then want every one to think it is and it turns out that it was major in the end, there either is a paper trail or worst case for them no paper trail and probably a worse fine.