The data breach announced by email: the written walkthrough

Myth · If it were serious, they would not send a mere email. I delete it.

The myth: “no registered letter, no real problem” The official EU page says exactly the opposite: when the breach carries serious risks, the company must inform you directly. A discreet email is not a weak signal, it is the channel the rules provide for. Deleting it means throwing away item number one of a file that has just opened itself.

“the data controller (the person or body handling your personal data) must report it to the national data protection authority. The data controller must also inform you directly if there are serious risks related to your personal data or privacy due to the breach.”

In plain words: this message is a legal obligation addressed to you. A legal obligation gets filed, not binned.

Myth · They talk about an “internal incident”, not a hack: that is not a real breach.

The myth: “a breach necessarily means hackers” The Regulation defines a personal data breach far more broadly than a heist movie: destruction, loss, alteration, unauthorised disclosure or unauthorised access, whether accidental or unlawful. A laptop forgotten on a train fits the definition. The word “incident” does not walk anyone out of the text.

“‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;”

In plain words: no hooded hackers required. An internal mistake, a loss, one access too many: the definition covers all of it, and the obligations that come with it apply.

Myth · They had to warn ME within 72 hours: deadline missed, automatic compensation.

The myth: “72 hours to warn me, or jackpot” The 72 hours of Article 33 time the notification to the supervisory authority, not the email addressed to you. And the text provides for no automatic compensation: a late notification to the authority calls for reasons, not a cheque. Building your claim on the wrong deadline hands the company the easiest answer in the world: “that deadline does not concern you”, and it will be right.

“Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.”

In plain words: even when they are late towards the authority, the written sanction is a justification to provide, not a sum that falls from the sky. Your real card is elsewhere: the content of the warning, and the complaint in your own country.

Myth · The investigation is ongoing: they are not allowed to tell me more, confidentiality rules.

The myth: “they cannot say anything, it is confidential” The Regulation has already arbitrated between discretion and your information: the communication addressed to you describes the nature of the breach, in clear and plain language, and contains at least the contact point, the likely consequences and the measures taken. That list is the legal minimum, not a post-crisis favour. A company invoking secrecy to empty it is reciting its internal policy, not the text.

“2. The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3).”

In plain words: the minimum content of the warning is set by the Regulation itself. What is missing can be claimed, and the company cannot hold its own investigation against you.

Myth · It is a technical subject, jargon is unavoidable: my job to keep up.

The myth: “a breach can only be explained in jargon” “In clear and plain language”: five words of the Regulation, placed exactly there, in the article describing the warning email. Clarity is not a stylistic effort left to the company's goodwill, it is a legal requirement on the form of the message. An incomprehensible text is not a compliant text, and you can ask for a readable version.

“The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach”

In plain words: being understandable is their job, being an engineer is not yours. The law imposes the clarity of the message just as much as its content.

Myth · No personal email = infringement, full stop. She demands immediate compensation.

The myth: “no email for me, so certain infringement” The text spells out, in black and white, the cases where the individual communication is not required: protection measures such as encryption applied to the data affected, or a public communication that is just as effective when writing to each person would take disproportionate effort. Fuming at a written exception costs you the next argument. The right question is not “why not me?”, it is “does the exception hold?”, and that question has a judge.

“3. The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met: (a) the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;”

In plain words: properly encrypted data can excuse the individual email. The exception exists, it is precise, and it can be checked: better to know that before writing the letter.

Myth · If they write that it was encrypted, case closed: nobody can go and check.

The myth: “their press statement counts as proof” A statement is a declaration, not a verification. Yet the national data protection authority has already been told: the notification is owed to it as soon as the breach happens. It knows the file, it can hold the statement up against the facts, and it can require the individual communication if the risk was high. Giving up because the company declared itself blameless is mistaking the defendant for the clerk of the court.

“the data controller (the person or body handling your personal data) must report it to the national data protection authority.”

In plain words: your country's authority is already in the loop, by obligation. What the company tells the public, it must be able to prove to someone with the power to check.

Myth · Without a proven, quantified loss, no complaint is admissible. I will wait until I have lost money.

The myth: “to complain, you first need an invoice” The entry condition is not a loss, it is a reasoned opinion: you think your rights have not been respected, and you can complain directly to your national authority, which will investigate and answer within three months. Waiting to be robbed before reporting the open door gets the order wrong: the complaint exists precisely so the file gets examined before things get worse.

“If you think your data protection rights have not been respected, you can make a complaint directly to your national data protection authority which will investigate your complaint and give you a response within 3 months.”

In plain words: “if you think” is enough. No loss to prove before walking through the authority's door.

Myth · Files like this never go anywhere without a lawyer or a class action. I pass.

The myth: “only an army of lawyers can take on a breach” A complaint to the authority is not a lawsuit: it is an administrative procedure you start on your own, and the text obliges the authority to keep you informed of the progress and the outcome, including the possibility of a judicial remedy afterwards. Court remains an option, never a prerequisite. The file you hold, vague email included, is enough to begin.

“2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.”

In plain words: once the complaint is lodged, the authority works and reports back to you. You have engaged no fees, no lawyer, no trial.