Acquisition, management, rewriting and storage of data should be based on decisions that take into account possible risks. This risk may be due to poor processing conditions, improper removal, loss, theft, uncontrolled modification, unauthorized access, or improper storage. It is important to identify possible scenarios for data loss - to determine the probability and frequency of their occurrence, the degree of harm and, in the next step, to plan actions to bring the crisis to a standstill. It should be noted that the May Regulation is not a set of ready-to-use solutions. It does not provide clear-cut methods for dealing with the problems that may arise in the protection of personal data, but allows the requirements of the Regulation to be adapted to the scale and validity of the data.

Measures to preserve data security

In the General Data Protection Regulation (GDPR), which will take effect on May 25, 2018, technical and organizational measures have been taken in order to ensure an adequate level of security of personal information. Organizational measures include impact assessments for data protection, security audits, policy reviews, incident logging, and, optionally, the appointment of a Data Protection Supervisor (DPO). The technical means are, among others: accountability, which consists on imposing on the Data Administrator the obligation to perform regular reviews and evaluations of the data processing, in order to maintain compliance with the standards; procedures taken at the time of the incident, so that the Administrator will be able to react more responsibly and report the incident. In addition, the Regulation introduces a pseudonymization and encryption of personal data; tools to preserve the confidentiality, integrity, accessibility and usability of data-driven systems; ability to formulate basic assumptions that will (at the time of the incident) restore the correct availability of stored data. The primary aim of matching adequate technical and organizational means is to keep personal data of different types and levels of confidentiality secure. It is worth analyzing the ways to implement them and the cost of such implementation in your business. These measures, in order to fulfill their protective function, should be tested and objectively assessed by the safety department.

Handling data breaches

When an irregularity is found in the data management systems, the Personal Data Administrator, the General Inspector for Personal Data Protection, or another person appointed to a similar position is obliged to report the disturbing situation to the competent supervisory authority within 72 hours. Such a declaration should first of all describe the nature of the infringement, that is the area covered by the infringement; specify the type of the captured/lost information along with its weight, and the number of people associated with it. In addition, all consequences of the occurrence (material and non-material) should be reported to both the data controller and the person who made it available. The General Inspector should apply the (pre-prepared) crisis strategy, taking remedial measures into account, and then take appropriate steps to minimize the negative effects of the resulting disruption. It is very important to document the steps taken in crisis situations, not only to allow the supervisory authority to verify it, but also to allow future General Inspectors to use it. The documentation should also contain information on whether the leaked personal data were somehow protected against various types of fraud. If so, the General Inspector or an external security partner must investigate the reason for the ineffectiveness of the protection measures and, after careful examination, introduce the necessary corrections.

Obligation to notify the affected environment about the incident.

There may be situations in which a data leak poses a particular threat and exposes a person to irreparable damage. The General Inspector must notify the affected person as soon as possible and explain, avoiding any specialized language, what the interference was about. He or she should also provide solutions to the situation and continually report on the corrective actions taken.The affected person must retain their mental comfort as his or her confidence is overstretched.

In summary, the actions taken at the time of the disruption are different. It all depends on the quality and number of activities involved in the illegal tampering with data management systems. Corrective actions (not guided by a well-thought-out security strategy) require a sudden dedication of time or financial resources, as well as quick decisions under the pressure of the environment. Therefore, it is advisable to be prepared for possible data breaches, to control your systems or resources, and to design a recovery program.