Security and personal data breaches

What a personal data breach is

The Law defines a personal data breach as any breach of security leading, accidentally or unlawfully, to the destruction, loss, alteration or unauthorised disclosure of personal data, or to unauthorised access to it art. 4. This is not only about cyberattacks: for example, a lost file or an e-mail sent to the wrong recipient can also fall within the definition.

Security of processing

The controller and the processor implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. They take into account the current state of technological development, the costs, the nature and purposes of the processing and the risks to individuals art. 32(1). The Law gives examples of such measures, as appropriate: pseudonymisation and encryption art. 32(1)(a), ensuring the confidentiality, integrity, availability and resilience of systems art. 32(1)(b), restoring access to data after an incident art. 32(1)(c), and regularly testing how effective the measures are art. 32(1)(d).

In assessing the appropriate level of security, account is taken in particular of the risks of destruction, loss, alteration, unauthorised disclosure of or unauthorised access to data art. 32(2). The controller and the processor take steps to ensure that people acting under their authority who have access to data process it only on the controller’s instructions art. 32(4). Adherence to an approved code of conduct or certification mechanism may be used as an element by which to demonstrate that these requirements are met art. 32(3).

Notifying the Centre

In the case of a personal data breach, the controller notifies the National Centre for Personal Data Protection without undue delay and, where possible, within 72 hours of becoming aware of it. Notification is not required where the breach is unlikely to result in a risk to the rights and freedoms of natural persons. A notification made after 72 hours is accompanied by a reasoned explanation of the delay art. 33(1).

The processor notifies the controller without undue delay after becoming aware of a breach art. 33(2). The minimum content of the notification is set by the Law art. 33(3), and the information may be provided in phases if it is not all available at once art. 33(4).

Whether or not it notifies, the controller documents all personal data breaches so that the Centre can verify compliance art. 33(5).

Informing data subjects

Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller informs the data subjects without undue delay art. 34(1), in clear and plain language art. 34(2).

Informing them is not required if the controller had applied measures that render the data unintelligible to unauthorised persons, such as encryption; if it has since taken measures ensuring that the high risk is no longer likely to materialise; or if informing them would involve disproportionate effort, in which case a public communication or an equally effective measure is used instead art. 34(3). The Centre may require the controller to inform the data subjects, or may decide that one of these conditions is met art. 34(4).

Why it matters

Infringements of the security and notification obligations are punishable by fines of up to 1,000,000 lei or, for an enterprise, of up to 1% of the total turnover achieved in the year preceding the imposition of the sanction, whichever is higher art. 88(1)(a). The way the breach became known to the Centre, including whether it was notified, is taken into account in setting the fine art. 87(2)(h).