Report on the Online Seminar “How to Properly Handle Data Breaches in Business Practice” with Prof. Lüdemann

On August 26, 2020, Prof. Dr. Volker Lüdemann gave a presentation at an online seminar organized by the IMKR in cooperation with the Mittelstand 4.0 Competence Center Siegen on how to properly handle data breaches in business practice. Since October 2017, the Mittelstand 4.0 Competence Center Siegen has been supporting small and medium-sized enterprises in South Westphalia with questions and issues related to digitalization. Key areas of focus include user-centered technology and human-machine interaction (https://kompetenzzentrum-siegen.digital).

At the start of the event, Prof. Lüdemann – who holds a professorship in business and competition law at Osnabrück University of Applied Sciences and is also the scientific director of the Lower Saxony Data Protection Center (NDZ) – explained the concept of a data breach. He illustrated the issue using several examples from his practical consulting work and highlighted sensitive areas such as hospital operations, where patients’ health data is processed. Referring to the requirements of Articles 33 and 34 of the GDPR, he explained that not every instance of incorrect data processing within a company automatically triggers a reporting obligation to the supervisory authority or even to the data subject. Rather, the obligation requires a certain risk to the rights and freedoms of natural persons. Consequently, reporting obligations arise in fewer cases than one might assume.

Prof. Lüdemann then addressed the reporting deadline for a data breach to the competent supervisory authority. He emphasized that, in practice, there are differing views on when the 72-hour deadline begins to run and how its duration should be interpreted. Using the reporting form from the State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia as an example, Prof. Lüdemann demonstrated that filing a report does not entail a great deal of formal effort. However, he cautioned against adopting the principle of “better one report too many than one too few.” Reporting data breaches can lead to significant reputational damage, especially if the notification is also sent to all affected individuals. Therefore, the reporting obligation should be carefully assessed in advance and, ideally, supported by experts to minimize unnecessary reports and the associated negative consequences.

Prof. Lüdemann then addressed other potential pitfalls in the context of a data breach. These included, first and foremost, the possible sanctions – most notably the potentially high fines under Article 83 of the GDPR. Prof. Lüdemann also outlined ways to avoid these sanctions by carefully crafting the content of the breach notification and implementing professional data breach management. Setting up and implementing such a management system is less complex than it may seem, especially since its value is enormous when a data breach occurs.

Finally, participants had the opportunity to ask questions. The discussion initially focused on the reporting deadline and the required scope of the report. The discussion then turned to the importance of appropriate technical and organizational measures, as defined in Article 32 of the GDPR, in relation to data breaches, and how the relationship between the controller and processors is affected with regard to the reporting obligation in the event of a data breach.