Incident Reporting: a lawyers perspective OECD Expert Workshop on - - PowerPoint PPT Presentation

Incident Reporting: a lawyer’s perspective

OECD Expert Workshop on Improving the Measurement

• f Security Incidents and Risk Management

Swiss Re Centre for Global Dialogue

Hans Allnutt

Partner hallnutt@dacbeachcroft.com (+44) 20 7894 6925 @legallnutt

Zurich, 13 May 2017 1

What contribution can disclosure obligations make? What contribution can disclosure obligations make? Why are/aren’t security incidents disclosed? The limitations of the GDPR and other laws

1

Do voluntary disclosure obligations work?

2 3 4

2

What contribution can disclosure obligations make?

“What you've reported to us” in Q3 2016 (published February 2017)

https://ico.org.uk/action-weve-taken/data-security-incident-trends/

3

What contribution can disclosure obligations make?

4

Do voluntary disclosure obligations work?

Current ICO guidance

“Although there is no legal obligation on data controllers to report breaches of security which result in loss, release or corruption of personal data, the Information Commissioner believes serious breaches should be brought to the attention of [her] Office.”

50 100 150 200 250

Data Security Incidents October-December 2016 5

Why are/aren’t security incidents voluntarily disclosed?

…or not to disclose

• We didn’t even know about the incident.
• We know about the incident but we don’t

know how it happened, it would cost a lot to find out (time and money), and we might still not know how it happened.

• We know about the incident but it does

not affect any third party (natural or corporate person) or of interest to a regulator.

• There is no legal obligation to tell anyone

about it.

• The costs of disclosing the incident
• utweighs the risks faced if someone

finds out later.

• We can’t afford the reputational impact.
• The security breach will disclose

something much more serious.

• What have we got to lose by not telling

anyone? Who will find out?

To disclose….

• There is a reasonable chance that they

will find out any way, or they already know.

• If we get found out, our exposure will be

worse than if we had not disclosed. 6

The limitations of the GDPR and other laws Art 5.1(f)

Personal Data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality'). No “availability” or “resilience” of systems. Defined by effect on data.

Art 32.1

Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate…. (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services Confidentiality, integrity, availability, and resilience.

Art 33

Notification of Personal data breaches” “Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or

• therwise processed

No reference to availability or resilience.

Art 83.4

Art 32 breach: 10,000,000 EUR / 2% Worldwide Turnover Wider requirements of Art 32.1 (availability, resilience) attract lower sanction but may never be notified in any event.

Art 83.5

Art 5 breach: 20,000,000 EUR / 4% Worldwide Turnover

Art 34

Express reference to systems and services. Cyber incidents such as ransomware and DDOS arguably not disclosable .

7

What contribution can disclosure obligations make?

Conclusions

• Disclosure obligations can provide actionable data.
• Voluntary and incentivised disclosure helps, but may produce

an incomplete or biased picture.

• If public policy is that data is to be effectively collected on

cyber incidents and data breaches, then a legal imperative is required supported by sanctions.

• Take care to understand the legal basis for disclosure which

may define the effect, rather than the cause.

8