The Missing Encryption Key
HealthTech Solutions provides a patient management app to 200 clinics. The app stores patient records on a cloud server. On Monday morning, an IT administrator discovered that a backup tape containing 5,000 patient records was missing from a secure storage room. The tape was encrypted with AES-256, but the encryption key was stored on a separate server that was also accessed by the same administrator. The administrator's account had been compromised two weeks earlier via a phishing attack, but the breach was not detected until now. The tape has not been recovered. The company's incident response plan requires notification to the data protection authority within 72 hours of becoming aware of a breach. The IT team is unsure whether the missing tape constitutes a personal data breach and whether notification is required.
1. Is the missing encrypted backup tape a personal data breach? Justify your answer.
Read the worked answer
Yes, it is a personal data breach.
Under GDPR (and similar data protection laws), a personal data breach is defined as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data. The missing tape contains personal data (5,000 patient records). The loss of the tape-even if encrypted-is a 'loss of availability' and potentially a 'loss of confidentiality' if the encryption can be broken.
Key considerations:
- The tape is encrypted, which is a security measure. However, the encryption key was stored on a separate server that was accessible by the compromised administrator account. If the attacker also compromised that server, they may have obtained the key, rendering the encryption ineffective.
- The administrator's account was compromised two weeks prior, indicating a security incident. The attacker could have exfiltrated the key before the tape went missing.
- Therefore, the breach is not merely theoretical; there is a realistic possibility of unauthorized access to the data.
Conclusion: The loss of the encrypted tape, combined with the compromised admin account and potential key access, constitutes a personal data breach. It is not exempt simply because encryption was used; the effectiveness of encryption depends on key management.
2. What factors should HealthTech Solutions consider when deciding whether to notify the supervisory authority and the affected individuals?
Read the worked answer
Notification to the supervisory authority:
Risk assessment: Notification is required unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Consider:
- Nature of data: Patient records likely include sensitive health data (special category data), which increases risk.
- Volume: 5,000 individuals affected-significant scale.
- Encryption: While encrypted, the key may have been compromised. If the key is compromised, the data is effectively unprotected. Even if not, the risk of harm (e.g., identity theft, discrimination, distress) may still exist if the data is sensitive.
- Likelihood of access: The compromised admin account suggests a higher likelihood that the attacker obtained the key.
- Potential harm: Health data can cause significant harm (e.g., insurance discrimination, social stigma).
Conclusion on authority notification: Given the sensitivity and volume, it is likely that the breach poses a risk, so notification to the supervisory authority is required without undue delay and within 72 hours of awareness. The company became aware on Monday morning; the clock is ticking.
Notification to individuals:
High risk threshold: Individuals must be notified if the breach is likely to result in a high risk to their rights and freedoms. Factors:
- Sensitivity: Health data is highly sensitive.
- Identifiability: The data includes patient identifiers (names, etc.).
- Compromised encryption: If the key was stolen, the data is effectively exposed.
- Potential for harm: High risk of identity theft, medical fraud, or discrimination.
Conclusion on individual notification: If the investigation reveals that the encryption key was compromised or that the data is otherwise accessible, notification to individuals is required. Even if the key is not compromised, the loss of the tape may still warrant notification if the risk is high (e.g., if the encryption is weak or the data is particularly sensitive). The company should err on the side of caution and notify if there is any doubt.
Other considerations:
- Documentation: Record the breach, its effects, and remedial actions, even if notification is not required.
- Communication: Notify individuals in clear and plain language, describing the nature of the breach, likely consequences, and measures taken.
- Timing: Notify individuals without undue delay, but prioritize containing the breach and assessing risk.
- Regulatory guidance: Consult local laws; some jurisdictions require notification regardless of risk for certain data types.