Briefing Versus Data Incident
You lead a six-person team in an EU agency. At 16:00 on Tuesday, the head of unit asks for a two-page briefing by 10:00 Wednesday for a Commissioner's visit. One team member is on leave; one is newly recruited and cannot yet use the case-management system. At 16:20, a member-state liaison emails that a data extract sent last week contains a possible personal-data error affecting 40 records; she asks for urgent confirmation. Your deputy says the briefing is the priority and the data issue can wait until Thursday. Another colleague warns that waiting may breach the agency's incident-reporting rule.
1. What do you do in the first 30 minutes? State your priorities and assignments.
Read the worked answer
Priority order: contain and report the possible data incident, while protecting the briefing deadline by delegating it.
- Acknowledge the liaison within 15 minutes: say you are investigating and will confirm by a stated time. Do not confirm or deny the error yet.
- Open an incident log, preserve the extract and identify whether the 40 records include special-category data. Notify the data protection officer or security contact under the incident rule.
- Assign the briefing to the deputy plus the available analyst. Ask the new recruit to prepare a source list only, with no system access.
- Spend 45 minutes on the data issue, then rejoin the briefing.
Reasoning: irreversible data harm and legal reporting clocks outrank a drafting task that others can progress. The briefing is not dropped; it is redeployed.
2. How do you respond to your deputy's proposal to wait until Thursday?
Read the worked answer
Explain that the reporting clock may run from awareness, not from full verification, so waiting two days creates legal and reputational risk. Do not simply overrule the deputy: give a clear split. The deputy owns the Commissioner briefing and must deliver a draft by 08:30 Wednesday. You own the incident triage and will provide the deputy with three lines for the briefing by 09:00. Ask the colleague who raised the rule to send the exact reporting deadline and responsible contact by 17:00.
3. Draft a three-line update to the head of unit at 17:00.
Read the worked answer
'At 16:20 we received a report of a possible personal-data error in 40 records. We have acknowledged it, opened an incident log, preserved the extract and alerted the data protection contact. Verification is under way and the Commissioner briefing is proceeding in parallel; next update by 12:00 Wednesday.'
Reasoning: the update is factual, avoids premature conclusions, shows both workstreams are controlled and sets a next checkpoint.