ENISA Report on Breach Notification

As discussed here previously, the revision of the European Telecommunications Directives in late 2009 introduced a requirement for telecoms providers to report breaches affecting personal data to their national regulators. Although the revised European Directive has not yet been transposed into national laws, ENISA has been surveying both regulators and telcos on their practice and plans. The results have been published in a, mostly reassuring, report.

There seems to be wide agreement that the main purpose of data breach notification should be to help affected individuals to minimise the damage to themselves, and that the companies that held the information are the best placed to do that. Reporting to regulators is seen as having the secondary purpose of ensuring that companies are fulfilling their duties. There is concern on all sides that breach notification should not overload either reporters, regulators or recipients - creating 'notification fatigue' - and agreement therefore that notifications to users should only be used for significant breaches. A straightforward way to assess the severity of a breach, which may involve a mixture of different types of personal data, is therefore required.

Interestingly the report concentrates almost entirely on the kind of breaches - principally unauthorised access to customer or employee information - that could happen to any organisation. Since the regulators seem agreed that telcos are, in general, pretty good at the security practices needed to protect that information, it seems particularly odd that this sector was singled out for legislation. The report confirms that other types of organisation have a greater need for this kind of regulation, though noting that sectors such as banks already have sector-specific regulation that may be stricter and carry heavier penalties. Avoiding conflicts with these other regulators is therefore important.

Although the UK does not yet have mandatory notification of personal data breaches, the Information Commissioner has published a good practice note on breach reporting for all types of organisation.