The European legal framework on the protection of personal data (Directive 95/46/Ec) is acknowledged as one of the strictest in the world. This tendency seems to be confirmed by the new draft regulation on the protection of personal data revealed by the European Commission in January 2012, which, once adopted, will certainly not enter into force before 2015. On the contrary, as opposed to American regulations, the current European Directive seems quite lenient when it comes to data breaches.
This said, in reality, should data breaches be treated differently in Europe than in the United States? The answer is “no.”
Although the current Directive does not provide an explicit obligation of notification to the competent national authorities and the individuals concerned, this obligation still exists. In the absence of case law on this point from the European Court of Justice, the Directive needs to be interpreted and applicable general principles of law need to be taken into account.
First, in accordance with the Directive itself, any communication (even involuntary) constitutes a processing of personal data. Therefore, this processing must be notified to the competent national authorities, particularly when the data controller has not made a prior notification, either contrary to the regulation or because he benefitted from an exemption. This point is confirmed by the obligation of security that the Directive imposes on the data controller, by virtue of which all controllers must take organizational measures, notably in the case of a data breach. Because these measures must be proportionate to the risks and the nature of the personal data concerned, notification appears to be an adequate organizational measure when a data breach occurs.
Second, several sectorial regulations require an explicit obligation of notification to the competent authorities and to individuals, particularly when the latter are likely to suffer damage. This is the case with the “e-privacy Directive” (Directive 2002/58), applicable to the telecommunication sector and for certain professions, such as attorneys.
And last but not least, the general principle of liability obliges all controllers to minimize the damage caused to the individuals concerned. One of the ways to do this is to notify the data breach to the concerned individuals, who can then take appropriate measures to avoid certain risks (identity theft, unauthorized use of access codes, etc.).
In summary, a prudent and diligent controller will notify, particularly when the data breach is likely to cause damage to the concerned individuals. Confirming this analysis, several member states of the European Union and of the European Economic Area — such as Norway, Germany and Austria — have adopted regulations that explicitly oblige data controllers to notify any data breaches to the national authorities and to concerned individuals. Other European countries provide in an explicit manner, but without making it mandatory, procedures for notification of data breaches.
Undoubtedly for these reasons the Commission has introduced in the new draft regulation an explicit and general obligation of notification in case of data breaches.
In conclusion, a controller who suffers a data breach in the United States — for example by the loss of a laptop containing personal data of individuals residing in the European Union, the European Economic Area or the United States — must notify the breach to the competent authorities and to the individuals, in both the United States and Europe. A controller that does not, could have liability issues.
McGuireWoods Global Data Privacy and Security Team
Members of our data privacy and security team include more than 30 interdisciplinary lawyers on the front lines of this rapidly evolving area of the law. We provide proactive counseling designed to protect the integrity of our clients’ systems, investigative and remediation services that may be required after a breach, and guidance to assist our clients as they develop new relationships and sources of revenue. Whatever the context, the team possesses the experience and professional networks necessary to address all our clients’ global needs spanning the industry spectrum in the area of data privacy and security.