RĠPD (GDPR)
>
Artikolu 33. Notifika ta' ksur ta' data personali lill-awtorità superviżorja
Artikolu 33 RĠPD (GDPR). Notifika ta' ksur ta' data personali lill-awtorità superviżorja
Article 33 GDPR. Notification of a personal data breach to the supervisory authority
1. Fil-każ ta’ ksur ta’ data personali, il-kontrollur għandu mingħajr dewmien bla bżonn u, fejn fattibbli, mhux aktar tard minn 72 siegħa wara li jkun sar jaf bih, jinnotifika l-ksur tad-data personali lill-awtorità superviżorja kompetenti f’konformità mal-Artikolu 55 ħlief jekk il-ksur ta’ data personali x’aktarx ma jirriżultax f’riskju għad-drittijiet u l-libertajiet tal-persuni fiżiċi. Fejn in-notifika lill-awtorità superviżorja ma ssirx fi żmien 72 siegħa, hija għandha tkun akkumpanjata minn raġunijiet għad-dewmien.
1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
2. Il-proċessur għandu jinnotifika lill-kontrollur mingħajr dewmien żejjed wara li jkun sar konxju ta’ ksur ta’ data personali.
2. The processor shall notify the controller without undue delay after becoming aware of a personal data breach.
3. In-notifika msemmija fil-paragrafu 1 għandha mill-inqas:
3. The notification referred to in paragraph 1 shall at least:
(a) tiddeskrivi n-natura tal-ksur ta’ data personali inklużi, fejn hu possibbli, il-kategoriji u n-numru approssimattiv tas-suġġetti tad-data kkonċernati u l-kategoriji u n-numru approssimattiv ta’ data personali rreġistrata kkonċernata;
(a) describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
(b) tagħti l-isem u d-dettalji tal-kuntatt tal-uffiċjal tal-protezzjoni tad-data jew ta’ punt ta’ kuntatt ieħor minn fejn tista’ tinkiseb aktar informazzjoni;
(b) communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;
(c) tiddeskrivi l-konsegwenzi mistennija tal-ksur ta’ data personali;
(c) describe the likely consequences of the personal data breach;
(d) tiddeskrivi l-miżuri mittieħda jew proposti li jridu jittieħdu mill-kontrollur sabiex jindirizza l-ksur ta’ data personali, inkluż, fejn xieraq, miżuri biex itaffi l-effetti ħżiena possibbli.
(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
4. Fejn, u sa fejn mhuwiex possibbli li tiġi pprovduta l-informazzjoni fl-istess ħin, l-informazzjoni tista’ tiġi pprovduta f’fażijiet mingħajr dewmien bla bżonn.
4. Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
5. Il-kontrollur għandu jiddokumenta kwalunkwe ksur ta’ data personali, inklużi l-fatti relattivi għall-ksur tad-data personali, l-effetti tiegħu u l-azzjoni ta’ rimedju meħuda. Dik id-dokumentazzjoni għandha tippermetti lill-awtorità superviżorja tivverifika l-konformità ma’ dan l-Artikolu.
5. The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.
Regolament Ġenerali dwar il-Protezzjoni tad-Data (RĠPD, GDPR)
General Data Protection Regulation (EU GDPR)
The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.
ISO 27701
Premessi
Linji ta 'Gwida & Ġurisprudenza
Ħalli kumment
(75) Ir-riskji għad-drittijiet u l-libertajiet tal-persuni fiżiċi, bi probabbiltà u gravità li jvarjaw, jistgħu jirriżultaw mill-ipproċessar ta’ data personali li tista’ twassal għal dannu fiżiku, materjali jew mhux materjali, b’mod partikolari fejn l-ipproċessar jista’ jagħti lok għal diskriminazzjoni, serq ta’ identità jew frodi, telf finanzjarju, dannu għar-reputazzjoni, telf ta’ kunfidenzjalità ta’ data personali protetta mis-segretezza professjonali, it-treġġigħ lura mhux awtorizzat tal-psewdonimizzazzjoni, jew kwalunkwe żvantaġġ ekonomiku jew soċjali sinifikanti ieħor; jew fejn is-suġġetti tad-data jistgħu jiġu mċaħħda mid-drittijiet u l-libertajiet tagħhom jew impediti milli jeżerċitaw kontroll fuq id-data personali tagħhom; fejn tiġi pproċessata data personali li tiżvela l-oriġini razzjali jew etnika, l-opinjonijiet politiċi, it-twemmin reliġjuż jew filosofiku, is-sħubija fi trade union, u l-ipproċessar ta’ data ġenetika, data dwar is-saħħa jew data dwar il-ħajja sesswali jew kundanni kriminali u reati jew miżuri ta’ sigurtà relatati; fejn l-aspetti personali jiġu evalwati, b’mod partikolari l-analiżi jew it-tbassir ta’ aspetti rigward il-prestazzjoni fuq ix-xogħol, is-sitwazzjoni ekonomika, is-saħħa, il-preferenzi jew l-interessi personali, l-affidabbiltà jew l-imġiba, il-lokalizzazzjoni jew il-movimenti, sabiex jinħolqu jew jintużaw profili personali; fejn tiġi proċessata data personali ta’ persuni fiżiċi vulnerabbli, b’mod partikolari ta’ tfal; jew fejn l-ipproċessar jinvolvi ammont kbir ta’ data personali u jaffettwa numru kbir ta’ suġġetti tad-data.
(75) The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage; where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures; where personal aspects are evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing involves a large amount of personal data and affects a large number of data subjects.
(85) Il-vjolazzjoni ta' data personali tista', jekk ma tiġix indirizzata b'mod adegwat u fil-ħin, tirriżulta f'dannu fiżiku, materjali jew mhux materjali lill-persuni fiżiċi bħat-telf ta' kontroll tad-data personali tagħhom jew limitazzjoni tad-drittijiet tagħhom, diskriminazzjoni, serq tal-identità jew frodi, telf finanzjarju, it-treġġigħ lura mhux awtorizzat tal-psewdonimizzazzjoni, dannu għar-reputazzjoni, telf ta' kunfidenzjalità tad-data personali protetta mis-segretezza professjonali jew kwalunkwe żvantaġġ ekonomiku jew soċjali ieħor għall-persuna fiżika kkonċernata. Għalhekk, malli l-kontrollur jinduna li sar ksur ta' data personali, il-kontrollur għandu jinnotifika l-ksur tad-data personali lill-awtorità superviżorja mingħajr dewmien bla bżonn u, fejn fattibbli, mhux aktar tard minn 72 siegħa wara li jkun sar jaf bih, sakemm il-kontrollur ma jkunx kapaċi juri, f'konformità mal-prinċipju tar-responsabbiltà, li l-ksur ta' data personali x'aktarx ma jirriżultax f'riskju għad-drittijiet u l-libertajiet tal-persuni fiżiċi. Fejn tali notifika ma tkunx tista' tinkiseb fi żmien 72 siegħa, in-notifika għandha tkun akkumpanjata mir-raġunijiet tad-dewmien u tista' tingħata informazzjoni f'fażijiet mingħajr aktar dewmien bla bżonn.
(85) A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the controller is able to demonstrate, in accordance with the accountability principle, that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where such notification cannot be achieved within 72 hours, the reasons for the delay should accompany the notification and information may be provided in phases without undue further delay.
(87) Għandu jiġi vverifikat jekk kull protezzjoni teknoloġika xierqa u miżuri organizzattivi ġewx implimentati biex jiġi stabbilit immedjatament jekk seħħitx vjolazzjoni ta' data personali u biex jiġu informati minnufih l-awtorità superviżorja u s-suġġett tad-data. Il-fatt li n-notifika saret mingħajr dewmien żejjed għandu jiġi stabbilit filwaqt li jitqiesu b'mod partikolari n-natura u l-gravità tal-vjolazzjoni tad-data personali u l-konsegwenzi u l-effetti negattivi tagħha għas-suġġett tad-data. Notifika bħal din tista' tirriżulta f'intervent mill-awtorità superviżorja f'konformità mal-kompiti u s-setgħat tagħha stabbiliti f'dan ir-Regolament.
(87) It should be ascertained whether all appropriate technological protection and organisational measures have been implemented to establish immediately whether a personal data breach has taken place and to inform promptly the supervisory authority and the data subject. The fact that the notification was made without undue delay should be established taking into account in particular the nature and gravity of the personal data breach and its consequences and adverse effects for the data subject. Such notification may result in an intervention of the supervisory authority in accordance with its tasks and powers laid down in this Regulation.
(88) Waqt l-istabbiliment ta' regoli dettaljati dwar il-format u l-proċeduri applikabbli għan-notifika ta' vjolazzjoni ta' data personali, għandha tingħata konsiderazzjoni xierqa liċ-ċirkostanzi ta' dik il-vjolazzjoni, inkluż jekk id-data personali kinitx protetta b'miżuri adatti ta' protezzjoni teknika, li jnaqqsu b'mod effettiv il-possibbiltà ta' frodi tal-identità jew forom oħra ta' użu ħażin. Barra minn hekk, dawn ir-regoli u l-proċeduri għandhom jikkunsidraw l-interessi leġittimi tal-awtoritajiet tal-infurzar tal-liġi fejn l-iżvelar bikri jista' jxekkel mingħajr bżonn l-investigazzjoni taċ-ċirkostanzi ta' vjolazzjoni ta' data personali.
(88) In setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches, due consideration should be given to the circumstances of that breach, including whether or not personal data had been protected by appropriate technical protection measures, effectively limiting the likelihood of identity fraud or other forms of misuse. Moreover, such rules and procedures should take into account the legitimate interests of law-enforcement authorities where early disclosure could unnecessarily hamper the investigation of the circumstances of a personal data breach.
(EN)
Documents
Article 29 Working Party, Opinion 03/2014 on «Personal Data Breach Notification (2014).
Article 29 Working Party, Guidelines on Personal Data Breach Notification Under Regulation 2016/679 (2018).
EDPB, Guidelines 1/2021 on Examples regarding Data Breach Notification (2021).
DPC (Ireland), Guidance for Individuals who Accidentally Receive Personal data (2020).
[js-disqus]
(EN) Url-link to highlighted text was copied to the clipboard!
(EN) Preparing download...
(EN) ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 16.1.1.
Here is the relevant paragraph to article 33 GDPR:
6.13.1.1 Responsibilities and procedures
Implementation guidance
As part of the overall information security incident management process, the organization should establish responsibilities and procedures for the identification and recording of breaches of PII. Additionally, the organization should establish responsibilities and procedures related to notification to required parties of PII breaches (including the timing of such notifications) and the disclosure to authorities, taking into account the applicable legislation and/or regulation.
(EN) […]
(EN) Sign in
to read the full text