EUGDPRBreach NotificationEASYFree question
Communication to data subjects is NOT required when:
- A.The controller has fewer than 250 employees, citing Article 34(3)(a), which removes the exemption from notifying data subjects even when the data was properly encrypted
- B.Appropriate technical measures (like encryption) were applied making the data unintelligible to unauthorized persons
- C.The breach involves special category data
- D.The breach occurred on a weekend, and member state law restricts portability to data collected after twenty eighteen
Why B is correct
Article 34(3)(a) exempts data subject notification when appropriate measures (like encryption) have rendered the data unintelligible to unauthorized recipients.
Know someone studying for GDPR? Send them this one.