Coordinating Breach Notification When Law Enforcement Asks for Delay
A retail company discovers on Friday at 16:00 that a payment-page skimmer has captured card data for 120,000 customers. Approximately 2,000 affected customers are in the EU; the rest are spread across 38 US states. The payment card brands require notification within 24 hours under the company's acquiring agreement. GDPR requires notification to the supervisory authority within 72 hours of awareness unless the breach is unlikely to result in risk. The FBI asks the company to delay public disclosure for 48 hours to avoid tipping off a suspect. The marketing director wants to issue a press release immediately to protect the brand. The company has outside counsel, a privacy officer, and a communications team, but no pre-approved breach notification template.
1. Build a notification decision timeline from the moment of awareness and justify the sequencing.
Read the worked answer
Start the clock at 16:00 Friday, because awareness triggers the regulatory deadlines. Within the first hours, convene the incident commander, counsel, privacy officer, and communications lead; preserve logs and the skimmer code; and confirm which card data elements were captured. Notify the acquiring bank and card brands within 24 hours, by Saturday 16:00, because the contract requires it and because card brands can assist with fraud monitoring. Begin the GDPR assessment immediately: if the data includes card numbers and names, risk to EU customers is likely, so the supervisory authority notification is due by Monday 16:00. Do not wait for the FBI's 48-hour request to decide the GDPR position. For US state laws, counsel should map each state's deadline and content requirements, which vary; prepare a single factual template that can be adapted. Customer notice should follow legal review and, where required, regulator coordination. The reasoning is that deadlines run from awareness, not from confirmation of every fact; regulators generally prefer a timely initial notice with unknowns flagged and a follow-up over a late complete notice.
2. How should the company handle the FBI request to delay disclosure, and what should be documented?
Read the worked answer
Treat the FBI request as a factor, not a command. The company owns its legal notification obligations. Counsel should ask the FBI to articulate in writing why delay is necessary, what specific disclosure would jeopardize the investigation, and for how long. If delay is granted, it should be limited and documented, and the company should assess whether any regulator allows delayed notice for law enforcement purposes. GDPR does not automatically excuse a delay because the FBI asks; the controller must still notify within 72 hours unless a specific exemption applies, and may explain the delay in the notification. The card brand deadline is contractual and unlikely to be waived by an FBI request. Document the request, the company's analysis, who approved any delay, and the revised timeline. The reasoning is that cooperation with law enforcement is important but does not transfer the company's regulatory accountability. A documented, reasoned decision protects the company if it later must explain why notice was delayed or not delayed.
3. Draft the core messages for customer notification and explain what should be avoided.
Read the worked answer
The customer message should state what happened in plain language, what data was involved, when it happened, what the company has done, what customers should do, and where to get help. For example: 'We discovered unauthorized code on our payment page that may have captured payment card details for transactions between [dates]. We removed the code, are working with law enforcement and card networks, and are offering [credit monitoring or replacement cards]. Please review your card statements and contact [number] with questions.' Avoid speculation about the attacker, definitive statements that no other data was affected unless verified, and language that minimizes or obscures the incident. Do not blame customers or imply they are responsible. Avoid promising outcomes the company cannot control, such as 'your data is safe now.' Coordinate the message with counsel, card brands, and regulators where required, and prepare call-center scripts and an FAQ. The reasoning is that notification is judged on accuracy, timeliness, and usefulness. Overpromising or concealing creates legal and reputational risk; clear, actionable guidance helps customers protect themselves and supports regulatory good faith.