Breach Notification Clock Across a Franchise Network
A UK fitness franchise has 60 independently owned gyms using a shared member management platform hosted by a central franchisor. A misconfigured cloud storage bucket exposed 180,000 member records, including names, addresses, and 4,000 records containing health screening questionnaires. The franchisor's security team discovered the exposure on Tuesday at 09:00 and closed it by 14:00. The franchisor's incident policy says 'notify the ICO within 72 hours of confirmation of a breach' and 'notify members only if there is a high risk'. Franchisees argue they are separate controllers and will handle their own notifications. The platform logs show the bucket was public for 11 days. The franchisor's press team wants to issue a statement naming the affected gyms before notifying the ICO.
1. Advise on who must notify the ICO, the timing, and whether the 72-hour clock has already started.
Read the worked answer
Controller analysis first. The franchisor and franchisees may be joint controllers or separate controllers depending on the contract and decision-making over the platform. The shared platform and central configuration suggest joint controllership for the platform processing; franchisees may be controllers for their own member relationships. This must be documented, not assumed.
Timing: The 72-hour clock starts when the controller becomes aware of the breach with a reasonable degree of certainty, not when it is 'confirmed' by an internal policy step. Discovery at 09:00 Tuesday starts the clock; the policy wording 'confirmation' cannot extend it. The deadline is Friday 09:00.
Who notifies: At least one controller must notify; joint controllers should coordinate a single notification identifying the joint controllers. Franchisees cannot simply opt out if they are controllers; they must assess and notify where the threshold is met. The franchisor should notify for its own processing and coordinate.
Content: Nature of breach, categories and approximate numbers (180,000; 4,000 health), DPO contact, likely consequences, measures taken. The 11-day exposure is relevant to risk.
2. Assess whether affected members must be notified and how the press statement should be sequenced.
Read the worked answer
Individual notification: Required without undue delay where there is a high risk to rights and freedoms. The 4,000 health screening records are special category data and elevate risk substantially; those individuals should be notified. For the remaining 176,000, assess risk: names and addresses alone may be lower risk, but combined with gym membership it can enable targeting or identification of vulnerable individuals. A risk assessment should be documented; if high risk is found, notify all affected.
Press sequencing: The ICO should be notified within 72 hours. A public statement naming gyms before ICO notification risks inconsistent information, prejudice to the investigation, and confusion for members. Recommended sequence: (1) contain and assess, (2) notify ICO by the deadline, (3) notify high-risk individuals with clear guidance, (4) issue a coordinated public statement aligned with the ICO notification, (5) update as facts develop. The press team should not pre-empt the regulatory notification; legal and the DPO should approve wording.