Article 34 - Communication of a personal data breach to the data subject

Article 34 GDPR implements the new obligation of the controller to inform data subjects about a personal data breach (as defined in Article 4(12) GDPR) where it is likely to result in a high risk to the rights and freedoms of natural persons. This obligation to notify data subjects is therefore closely connected to and supplements the controller's independent obligation to notify the relevant supervisory authority ("SA") under Article 33 GDPR. See therefore also the Commentary on Article 33 GDPR.

As described there, Article  and 34 are also closely linked with Article 32 GDPR which obliges controllers as well as processors to implement appropriate security measures. Further, the assessment of whether a notification of the data subject is necessary (due to the resulting high risk to the rights and freedoms of the natural person) as well as the notification itself should be covered by the controllers respective policy (Incident Response Plan) as described in more detail in the commentary on Article 33 GDPR.

Paragraph 1 of this provision imposes an obligation on controllers to notify data subjects without undue delay about a personal data breach where such breach is likely to result in a high risk to the rights and freedoms of natural persons.

Paragraph 2 describes linguistic requirements the information to the data subjects should have ("clear and plain language"), its purpose (describing "the nature of the personal data breach") and minimum content (contact points, consequences, actions taken or otherwise planned).

Paragraph 3 provides for exceptions to the information obligation in specific circumstances. For example, where the controller has implemented appropriate technical and organisational measures to exclude any harm.

Finally, paragraph 4 authorises the SA to require the controller to inform the data subjects about a personal data breach in case it did not already did so. Also, the SA might decide that one of the exemptions of Article 34(3) are applicable.

• ).

(1) Communication of a personal data breach to the data subject

Article 34(1) GDPR obliges the controller to communicate, without undue delay, the personal data breach to data subjects when the breach is likely to result in a high risk to the rights and freedoms of natural persons. This means that not all personal data breaches have to be communicated to the data subjects - not even all personal data breaches have to be reported to the SA under Article 33 GDPR.

This provision carries both theoretical and practical importance. On one hand, it acknowledges the individual's subjective right to be informed about the (failed) security of their personal data. On the other hand, it enables data subjects to make strategic choices to safeguard their personal sphere.

Example

After learning about a personal data breach involving its phone number, a data subject could switch numbers or pay more attention when they are contacted in a suspicious way. Similarly, a data subject might decide to close their account with their bank and look for a more secure financial institution after a personal data breach shows significant vulnerabilities of the bank's security measures. Further, a data subject might just block their credit card after learning that it has been compromised in a personal data breach.

Personal data breach

The obligation to notify data subjects of a personal data breach stipulated in this provision refers to the notion of a personal data breach defined in Article 4(12) GDPR, i.e. “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”. For more information, see commentary on Article 4(12) GDPR. However, as mentioned above, the obligation to communicate the personal data breach to data subjects only arises where there is a high risk to the rights and freedoms of natural persons, likely resulting from the personal data breach (see below).

Is likely to result in a high risk to the rights and freedoms of natural persons

Article 34(1) GDPR differs in an important respect from the obligation to notify the SA about a personal data breach in accordance with Article 33 GDPR. Instead of having to notify the SA of a breach that leads to any kind of risk to data subjects, the controller only has the obligation to communicate a personal data breach to data subjects where it is likely to lead to a high risk to the rights and freedoms of natural persons. The threshold for communicating the breach to data subjects concerned is therefore higher than in Article 33 GDPR. In any event, the controller needs to perform an assessment considering the risks for data subjects resulting from the personal data breach. For this risk assessment (consideration of the likelihood and severity of the impact of the personal data breach on the rights and freedoms of the data subjects) and the factors to consider, see commentary on Article 33(1) GDPR.

"[...] This risk exists when the breach may lead to physical, material or non-material damage for the individuals whose data have been breached. Examples of such damage are discrimination, identity theft or fraud, financial loss and damage to reputation. When the breach involves personal data that reveals racial or ethnic origin, political opinion, religion or philosophical beliefs, or trade union membership, or includes genetic data, data concerning health or data concerning sex life, or criminal convictions and offences or related security measures, such damage should be considered likely to occur."

Examples of "high risk" situations include, inter alia, a cyberattack on an online marketplace where usernames, passwords and purchase history are made public; a cyberattack on a hospital resulting in medical records being made inaccessible; or where personal data was mistakenly sent to a wrong mailing list (with over a thousand recipients).

The fact that controllers only have to communicate personal data breaches likely resulting in a high risks to natural persons should strike a balance between the controllers interest not to notify data subjects (often customers or business partners) about circumstances that might very well be harmful for their reputation and not overloading data subjects with too much information about only limited risks on the one hand with the necessity to give data subjects the ability to take measures to reduce harm that might result from a personal data breach on the other side.

Controllers might be incentivised to perform this assessment in a way that shows no high risk for data subjects in order to avoid the communication stipulated in this provision. Therefore, the SA has the authority to require the controller to communicate the personal data breach to the affected data subjects.

The controller

The obligation set forth in this provision addresses controllers as defined in Article 4(7) GDPR. Please see the commentary on Article 33(1) GDPR on this point including notes on joint-controllership, the relationship with processors and with manufacturers.

Its worth highlighting that the processor's obligation in Article 33(2) GDPR to notify controllers “without undue delay” in case they identify a personal data breach is also essential for the controller's obligation to notify data subjects under this provision (see commentary on Article 33(1) and (2) GDPR). However, the processor is neither obliged to communicate the personal data breach to data subjects, nor supposed to assess the risk to the rights and freedoms of natural persons; this is the obligation of the controller.

Shall communicate [the breach] to the data subject

The affected data subjects should be directly notified of the relevant breach by the controller. When communicating a breach to data subjects, dedicated messages should be utilised, separate from regular updates, newsletters, or standard messages. Otherwise the affected data subjects might not realise the relevance of the communication which should be a clear and transparent communication of the personal data breach. Recital 86 states in this regard that the communication to the data subjects should "describe the nature of the personal data breach as well as recommendations for the natural person concerned to mitigate potential adverse effects".

In case a direct notification to the affected data subjects would involve an disproportionate effort, the communication of a personal data breach could also be done via public communication or similar measures, ensuring that data subjects are informed in an equally effective manner (see exemption in Article 34(3)(c) GDPR below).

"Examples of transparent communication methods include direct messaging (e.g. email, SMS, direct message), prominent website banners or notification, postal communications and prominent advertisements in print media. A notification solely confined within a press release or corporate blog would not be an effective means of communicating a breach to an individual. The EDPB recommends that controllers should choose a means that maximizes the chance of properly communicating information to all affected individuals. Depending on the circumstances, this may mean the controller employs several methods of communication, as opposed to using a single contact channel."

Controllers will generally be in the best position to determine the most suitable contact channel and method for communicating a breach to individuals, especially if they have regular interactions with their customers. However, it is crucial for controllers to exercise caution when selecting a contact channel, as using a channel compromised by the breach could potentially enable attackers to impersonate the controller.

The communication should take place in a language understand by the data subjects. This could be the language in which the previous communication with the data subject took place or the local national language of the data subjects. It could be appropriate to provide the communication in various languages.

In some cases, it might also be appropriate for the controller to consult the SA regarding the communication to data subjects about a personal data breach as well as how to formulate an appropriate message and what the most appropriate way would be to contact the affected natural persons. This could be the case if the controller is unable to assess whether the personal data breach will likely result in a high risk for the rights and freedoms of natural persons. Moreover, according to Recital 88, the legitimate interests of law-enforcement authorities is also something to consider in case the early disclosure of a personal data breach could unnecessarily hamper investigations connected to the breach.

"Whenever it is not possible for the controller to communicate a breach to an individual because there is insufficient data stored to contact the individual, in that particular circumstance the controller should inform the individual as soon as it is reasonably feasible to do so (e.g. when an individual exercises their Article 15 right to access personal data and provides the controller with necessary additional

information to contact them)."

Without undue delay

Article 34(1) GDPR stipulates that controllers must notify data subjects of a data breach “without undue delay” - in other words, given the likelihood of high risks for the data subject (see above), as soon as possible, considering that such a communication should enable data subjects to take individual steps to protect themselves from any negative consequences of the breach of their personal data. However, Article 34 GDPR does not provide a specific deadline of 72 hours as is the case in Article 33 GDPR; nevertheless, for more information on the term "without undue delay" also compare commentary on Article 33 GDPR. Instead, timelines should be assessed depending on the nature and gravity of the breach itself, the level of risk to natural persons and the need to implement appropriate technical and organisational measures before the communication; e.g. Recital 86 GDPR provides examples of issues to take into account when assessing the timeliness of a notification to data subjects: “the need to mitigate an immediate risk of damage would call for prompt communication with data subjects whereas the need to implement appropriate measures against continuing or similar personal data breaches may justify more time for communication.”

Similarly, Recital 88 GDPR indicates that communication to data subjects may be delayed to preserve the integrity of an investigation led by a law-enforcement authority into the circumstances of the breach.

(2) Minimal requirements for the controller's communication to the data subject

The communication to the data subjects should enable them to take any steps to protect themselves. Article 34(2) GDPR therefore requires that the communication to the data subject (Article 34(1) GDPR) must contain a description in clear and plain language of the nature of the breach as well as the elements outlined in Article 33(3)(b)-(d) GDPR. Namely, the name and contact details of the data protection officer or other contact point where more information can be obtained; the likely consequences of the data breach; and the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Describe in clear and plain language

This wording is already used in Article 12(1) GDPR requiring controllers to provide any communication under Articles  to  and 34 "in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child". Due to the use of the term "clear and in plain language", reference can be made to this provision which is also directly applicable to the communication to affected data subjects under this provision. See therefore commentary on Article 12(1) GDPR. Regarding the language the controller should use for the communication, see commentary on Article 34(1) GDPR above.

(a) Nature of the personal breach

See commentary on Article 33(3) GDPR which already describes the controller's obligation to provide the SA with "the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned". However, it should be noted that the additional elements mentioned there are not required in the communication to the data subjects under Article 34(2) GDPR. This is a reasonable choice since, generally, data subjects do not need to know these specific details in order to make informed decisions regarding the breach.

(b) Point of contact

Article 34(2) GDPR provides for the obligation to include information about the name and contact details of the data protection officer or other contact point where more information can be obtained by referencing to Article 33(3)(a) GDPR. See, therefore, commentary on Article 33(3)(a) GDPR.

In case of the communication to the affected data subject, special consideration should be given to the urgent nature of the communication - considering that it is mandatory only in cases of "high risk" to the data subject. The contact point for data subject should therefore be easily and directly reachable. Consequently, obstructive methods that, for example, require the requester to navigate complex online systems to establish contact are not permissible at this stage. In such cases, an email address seems more appropriate.

(c) Consequence of the breach

Again, reference can be made to commentary on the provision in Article 33(3)(c) GDPR. However, it should be recalled that the communication to the data subject has to use clear and plain language. The use of examples and accessible terminology allows the data subject to immediately understand the risks they are facing and the most appropriate actions to take.

Example

An e-commerce platform experiences a cyber attack resulting in the disclosure of user passwords on the web. The communication under Article 34 GDPR should explain to the user, in clear and plain language, that, due to the breach, it will be necessary to change their service password and ensure that the same value is not used to access other services. In such case, the user should be advised to change those passwords as well to prevent further unauthorised access.

(d) Measures taken or proposed

Also regarding the description of measures taken or proposed to be taken by the controller to address the personal data breach (including, where appropriate, measures to mitigate its possible adverse effects), reference can be made to the commentary on Article 33(3)(d) GDPR. It should be considered, however, that the information on measures to mitigate the potential adverse effects will probably be especially important for the affected data subjects.

Additional information

As indicated by the phrase “at least” found under Article 34(2) GDPR, this list of information to be provided to data subjects is non-exhaustive. Recital 86 GDPR outlines that the controller “should” provide “recommendations for the natural person concerned to mitigate potential adverse effects”. The information given to data subjects should therefore enable them to take any “necessary precautions”, which, although not directly mentioned by Article 33(3)(b)-(d) GDPR could be shared as additional information by the controller

(3) Exemptions from the obligation to communicate to the data subject

Article 34(3) GDPR lists three exemptions from the controller's obligation to communicate the breach to data subjects. It should be noted that, as per the accountability principle, controllers are required to provide evidence to the SA to demonstrate the applicability of one or more of the specified conditions if they rely upon them. The EDPB also notes that, although the communication may not be immediately necessary (if there is no risk to the rights and freedoms of individuals), the situation may evolve over time, and the risk assessment would need to be reassessed accordingly.

"If a controller decides not to communicate a breach to the individual, Article 34(4) GDPR explains that the supervisory authority can require it to do so, if it considers the breach is likely to result in a high risk to individuals. Alternatively, it may consider that the conditions in Article 34(3) GDPR have been met in which case notification to individuals is not required. If the supervisory authority determines that the decision not to notify data subjects is not well founded, it may consider employing its available powers and sanctions"

(a) The controller has applied “appropriate technical and organisational protection measures”

The first exception from the obligation to communicate a personal data breach to the affected data subjects is applicable if the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach. This provision specifically mentions measures that render the personal data unintelligible to any person who is not authorised to access it, such as encryption.

In other word, the exception applies if, prior to the breach, the controller had implemented suitable technical and organizational measures to safeguard the personal data. In particular, these measures aim to make the personal data incomprehensible to unauthorized individuals. One effective approach is the use of pseudonymisation, advanced encryption techniques or tokenisation to protect the personal data. These security measures ensure that even if the data is accessed unlawfully, it remains unintelligible and therefore protected.

Since effective pseudonymisation can mitigate adverse effects of data breaches, it may also be considered when assessing the obligations a controller has under Art. 33 and 34 GDPR. In particular, it may be regarded as an appropriate technical and organisational measure that limits the impact of a personal data breach in the sense of Art. 34(3)(a) GDPR. However, the content of data that was accessed without authorisation can still be analysed by the actor who accessed it.

Careful analysis is required in this case to establish whether the pseudonymisation has reduced the risks resulting from the data breach sufficiently to render communication of the breach to the affected data subjects unnecessary, Art. 34(1) and (3) GDPR.

Example

An unauthorised person got access to a device where highly sensitive personal data are stored. However, the content of such a device in encrypted. Therefore, even if a data breach occurred theoretically entailing high risks for data subject, the obligation under Article 34(1) is not triggered, as the authorised party will not be able to make use of the data obtained.

(b) The controller takes “subsequent measures” that diminish the likelihood of a high risk

The second exception applies in case the controller has taken subsequent measures ensuring that the high risk to the rights and freedoms of the data subjects is no longer likely to materialise.

“Subsequent” measures should therefore be interpreted as measures, adopted immediately following a personal data breach, which are able to mitigate the likelihood of the high risk to individuals' rights and freedoms from materialising. For instance, in certain situations, the controller may have promptly identified and addressed the unauthorized access to personal data, preventing any further misuse. However, it is essential to consider the potential consequences of a breach of confidentiality, taking into account the nature of the data involved.

In addition, it must be stressed that after a risk actually materialised, the controller can no longer invoke subsequent measures to avoid communication to the data subject. Even if subsequent measures could mitigate damages and reduce further risks, the controller is no longer in the position to evaluate what kind of negative consequences could stem from the original data breach. Therefore, a communication to the people concerned is the most effective way to prevent an even greater impact on their rights and freedoms.

(c) The communication would demand a disproportionate effort from the controller

The last exception in this provision applies if the communication of the personal data breach would involve a disproportionate effort. In that case, the controller must instead make a public communication or similar measure whereby the data subjects are informed in an equally effective manner.

In other words, in cases where notifying the data subject would require a disproportionate effort, the controller is not obligated to inform the individual. The concept of "disproportionate effort" is not explicitly defined in the GDPR. However, it is understood that the effort involved in notifying data subjects relates to the scope of the breach, particularly the number of individuals affected. As the number of affected individuals increases, the communication process becomes proportionally more complex. Nevertheless, since this exception should be interpreted restrictively, the notion of disproportionate effort should be evaluated in relation to the size of the organisation and the availability of technical tools for conducting notifications. In other words, a large-scale controller will be expected to allocate greater resources, including the adoption of electronic communication tools capable of handling the notification burden. In such cases, the effort required cannot be deemed "disproportionate". If the effort is in fact "disproportionate", an alternative obligation exists, namely the requirement to publicly disclose the breach, which should be equally effective in ensuring transparency and accountability. The EDPB suggests that “technical arrangements” could nonetheless be taken to ensure that data subjects can access further information upon request.

Other exemptions

It is important to highlight that according to Article 23 GDPR, Union or Member State law may restrict the obligations and rights outlined in Article 34 GDPR.

(4) Involvement of the supervisory authority

As mentioned previously, Article 34(4) GDPR authorises the SA to require the controller to communicate a personal data breach to the affected data subjects in case the controller did not already do so. Moreover, the SA might also decide that any of the conditions listed in Article 33(3) GDPR are met which means that no communication of the personal data breach is necessary.

In that regard, it should be recalled that the threshold triggering the communication of a personal data breach to the affected data subjects under Article 34 GDPR is higher than for the notification obligation to the SA under Article 33 GDPR. Therefore, in all cases where a communication to the affected data subjects is necessary, the notification to the SA is also necessary. Thus, since the SA should be aware of the data breach, it can also be involved in the controller's procedure for communicating the breach to affected data subjects as required under Article 34(1) GDPR. Accordingly, Article 34(4) GDPR suggests that the SA can play a determinative role in indicating that there is a “high risk” to the rights and freedoms of natural persons.

It should also be noted that the SA can also provide advice to the controller. This advice can relate to the assessment of the risk to the data subjects or on the method of communicating the breach to data subjects, such as how to identify an adequate channel to notify them, the language to communicate in, and what kind of message to send.

Not already communicated the breach to the data subject

Obviously, this provision only applies in situations in which the controller did not already communicate the breach to the affected data subjects. However, it is questionable to what extent the authority could use its power to require the controller to communicate a personal data breach to the affected data subjects in cases where it considers a prior communication of the controller to be incomplete or insufficient. It would make sense for the SA to also require improved communication in those cases.

The supervisory authority

While Article 33(1) GDPR specifically mentions the SA competent in accordance with Article 55 GDPR regarding the controller's notification obligation, Article 34(4) GDPR only mentions the SA. However, it is reasonable to consider this provision referring to the SA which got notified under Article 33(1) GDPR.

Having considered the likelihood of the breach resulting in a high risk

In order for the SA to use its power to request the controller to communicate a personal data breach to the affected data subjects, it must consider the likelihood of the data breach resulting in a high risk. Therefore, it can correct a faulty risk assessment by the controller in case the controller came to the conclusion that no high risk for the rights and freedoms of the data subjects are likely to result from the personal data breach.

May require [the controller] to do so

In such case, the authority can instruct the controller to communicate the breach to the affected data subjects.

"[...] If the supervisory authority determines that the decision not to notify data subjects is not well founded, it may consider employing its available powers and sanctions."

However, the SA is not authorised under this provision to communicate the personal data breach to the affected data subjects directly.

May decide that [exemptions] are met

The SA can also decide whether any of the exemptions under Article 34(3) GDPR apply, relieving the controller of its obligation to communicate the personal data breach to affected individuals. This can be very helpful for a controller who is uncertain whether or not one of the exceptions might apply.

Example

The notification of the affected data subjects could involve a significant effort and the controller could be uncertain if this could already be considered a disproportionate effort and a public communication of the personal data breach would suffice. A decision by the SA might help to provide the controller with clearity.