GDPR for Employees Course (EU): Personal data breaches

1. Vraag 1 van 18

   Which of these is a personal data breach?

   • AA customer's details are emailed to the wrong person
   • BA colleague forgets their own password and asks for a reset
   • CA hacker's attack is blocked before it reaches any data
   • DA planned software update is installed on time as expected
   Toon antwoord

   Antwoord: A. A customer's details are emailed to the wrong person

   A personal data breach includes unauthorised disclosure of personal data, even by accident (Article 4(12) GDPR).

2. Vraag 2 van 18

   Ransomware encrypts customer records so staff can no longer open them. What type of breach is this?

   • AAvailability breach
   • BConfidentiality breach
   • CIntegrity breach
   • DAccuracy breach
   Toon antwoord

   Antwoord: A. Availability breach

   An availability breach is the accidental or unauthorised loss of access to, or destruction of, personal data.

3. Vraag 3 van 18

   Someone without permission changes the bank details in several employee records. What type of breach is this?

   • AAvailability breach
   • BConfidentiality breach
   • CPortability breach
   • DIntegrity breach
   Toon antwoord

   Antwoord: D. Integrity breach

   An integrity breach is the unauthorised or accidental alteration of personal data.

4. Vraag 4 van 18

   You think you may have caused a data breach at work. What should you do first?

   • AContact the affected customers yourself
   • BFix it quietly so nobody needs to know
   • CReport it internally straight away, following your procedure
   • DWait a few days until you are sure
   Toon antwoord

   Antwoord: C. Report it internally straight away, following your procedure

   The controller has strict deadlines, so possible breaches must be reported internally at once to the right contact, following your procedure.

5. Vraag 5 van 18

   Where feasible, within how many hours of becoming aware must the controller notify the authority of a breach?

   • A72 hours
   • B168 hours (7 days)
   • C24 hours
   • D48 hours
   Toon antwoord

   Antwoord: A. 72 hours

   Article 33(1) GDPR: without undue delay and, where feasible, not later than 72 hours after becoming aware of it.

6. Vraag 6 van 18

   Who does the controller notify about a personal data breach under Article 33?

   • AThe organisation's own bank and insurer
   • BThe European Commission in Brussels
   • CThe local police station, in every case
   • DThe data protection authority
   Toon antwoord

   Antwoord: D. The data protection authority

   Article 33 GDPR requires notification to the competent supervisory authority, which is the national data protection authority.

7. Vraag 7 van 18

   In which case may a controller decide not to notify the authority of a breach?

   • AWhen fewer than ten people's data were affected
   • BWhen it happened during a weekend or public holiday
   • CWhen it is unlikely to result in a risk to people
   • DWhen it was caused by a mistake made by an employee
   Toon antwoord

   Antwoord: C. When it is unlikely to result in a risk to people

   Article 33(1) GDPR: notification is not needed if the breach is unlikely to result in a risk to people's rights and freedoms. It must still be documented.

8. Vraag 8 van 18

   When must the affected people themselves be told about a breach?

   • AWhen it is likely to result in a high risk to them
   • BOnly if they contact the organisation and ask about it
   • CIn every case, even when there is no risk to them at all
   • DOnly after the authority has fined the organisation
   Toon antwoord

   Antwoord: A. When it is likely to result in a high risk to them

   Article 34(1) GDPR: people must be told without undue delay when the breach is likely to result in a high risk to their rights and freedoms.

9. Vraag 9 van 18

   Which breaches must the controller document?

   • AOnly those caused by cyber attacks
   • BOnly those affecting 100 or more people
   • COnly those notified to the authority
   • DAll of them, even those not notified
   Toon antwoord

   Antwoord: D. All of them, even those not notified

   Article 33(5) GDPR requires the controller to document every personal data breach, its effects and the action taken, even if it is not notified.

10. Vraag 10 van 18

    A processor discovers a breach of data it handles for a controller. What must it do?

    • AWait until the controller asks about it
    • BTell the people affected before anyone else
    • CTell the controller without undue delay
    • DFix it and tell nobody if it was only small
    Toon antwoord

    Antwoord: C. Tell the controller without undue delay

    Article 33(2) GDPR: the processor notifies the controller without undue delay after becoming aware of a breach.

11. Vraag 11 van 18

    An encrypted tablet is stolen. The key was not stolen and there is a backup. What does the EDPB say?

    • ADocument it; people generally need not be told
    • BNothing at all needs to be done or recorded
    • CReport it to the police and to the national press
    • DWrite to every customer at once to tell them
    Toon antwoord

    Antwoord: A. Document it; people generally need not be told

    If strong encryption keeps the data unintelligible, telling people is generally not required, but every breach must be documented.

12. Vraag 12 van 18

    An unencrypted laptop with no password, holding the names, addresses and dates of birth of over 100,000 customers, is stolen. What does the EDPB say should happen?

    • AOnly tell customers if they complain about fraud later
    • BNotify the authority and tell the customers
    • COnly write it down in the internal breach log
    • DOnly buy a new laptop for the employee concerned
    Toon antwoord

    Antwoord: B. Notify the authority and tell the customers

    Without encryption or a password the data is easy to access, and customers could suffer identity fraud. The risk is high, so the authority must be notified and the customers told.

13. Vraag 13 van 18

    The controller does not yet have all the facts about a breach when the 72 hours run out. What should it do?

    • ADecide not to notify, because facts are still missing
    • BWait until every fact is known before notifying
    • CNotify anyway and add details in phases
    • DAsk the authority for a 30-day extension first
    Toon antwoord

    Antwoord: C. Notify anyway and add details in phases

    The EDPB says information may be given in phases if it is not all available within 72 hours.

14. Vraag 14 van 18

    A controller becomes aware of a breach on Tuesday at 10:00. Where feasible, what is the latest time to notify the authority?

    • AThursday 10:00
    • BFriday 10:00
    • CFriday 18:00
    • DSaturday 10:00
    Toon antwoord

    Antwoord: B. Friday 10:00

    72 hours after Tuesday 10:00 is Friday 10:00 (3 days x 24 hours).

15. Vraag 15 van 18

    A company's worldwide annual turnover is €900 million. What is the highest fine in the top band (€20 million or 4%, whichever is higher)?

    • A€9 million
    • B€20 million
    • C€36 million
    • D€18 million
    Toon antwoord

    Antwoord: C. €36 million

    4% of €900 million is €36 million, which is higher than €20 million, so €36 million is the maximum.

16. Vraag 16 van 18

    Read the description. What type of breach is this?

    Marek works at the reception of Linden Physiotherapy. On Monday at 11:20 he meant to send a supplier an order form. By mistake he attached a list of 120 patients with their names, phone numbers and treatment notes, and sent it to orders@supplyhouse.example.com. He noticed the mistake at 11:35.

    • AAvailability breach
    • BNo breach, because it was an accident
    • CConfidentiality breach
    • DIntegrity breach
    Toon antwoord

    Antwoord: C. Confidentiality breach

    Personal data was disclosed to someone not authorised to see it. That is a confidentiality breach, even if accidental.

17. Vraag 17 van 18

    Read the description. What should Marek do now?

    Marek works at the reception of Linden Physiotherapy. On Monday at 11:20 he meant to send a supplier an order form. By mistake he attached a list of 120 patients with their names, phone numbers and treatment notes, and sent it to orders@supplyhouse.example.com. He noticed the mistake at 11:35.

    • ATell his manager or data protection contact at once
    • BDelete the email from his Sent folder to hide it
    • CPhone each of the 120 patients himself to apologise
    • DWait to see whether the supplier replies about it
    Toon antwoord

    Antwoord: A. Tell his manager or data protection contact at once

    Staff should report a possible breach internally straight away so the controller can assess it and meet the 72-hour deadline.

18. Vraag 18 van 18

    Read the description. Why is this breach likely to be treated as more serious?

    Marek works at the reception of Linden Physiotherapy. On Monday at 11:20 he meant to send a supplier an order form. By mistake he attached a list of 120 patients with their names, phone numbers and treatment notes, and sent it to orders@supplyhouse.example.com. He noticed the mistake at 11:35.

    • AMarek noticed it within an hour
    • BThe email was sent before lunchtime
    • CThe treatment notes are health data, a special category
    • DThe supplier's address ends in .com
    Toon antwoord

    Antwoord: C. The treatment notes are health data, a special category

    Treatment notes are data concerning health, a special category, so the risk to patients is higher.

Toetsenbord: 1–4 om te antwoorden, Enter voor de volgende vraag.