EUGDPRBreach NotificationEASYFree question
When must a controller communicate a personal data breach to data subjects under Article 34?
- A.Only if the data subjects request it, citing Article 17(3), which removes the exemption for freedom of expression and information entirely
- B.When the breach is likely to result in a high risk to the rights and freedoms of natural persons
- C.For every breach, regardless of risk
- D.Only if the media has reported on the breach
Why B is correct
Article 34(1) requires communication to data subjects when the breach is likely to result in a high risk to their rights and freedoms, a higher threshold than the notification to the supervisory authority which requires only a 'risk'.
Know someone studying for GDPR? Send them this one.