34 / 176
INTRODUCTION
REGULATION
32
become aware of it, unless the controller is able to demonstrate, in
accordance with the accountability principle, that the personal data
breach is unlikely to result in a risk to the rights and freedoms of natural
persons. Where such notification cannot be achieved within 72 hours,
the reasons for the delay should accompany the notification and
information may be provided in phases without undue further delay.
(86) The controller should communicate to the data subject a personal
data breach, without undue delay, where that personal data breach is
likely to result in a high risk to the rights and freedoms of the natural
person in order to allow him or her to take the necessary precautions.
The communication should describe the nature of the personal data
breach as well as recommendations for the natural person concerned
to mitigate potential adverse effects. Such communications to data
subjects should be made as soon as reasonably feasible and in close
cooperation with the supervisory authority, respecting guidance
provided by it or by other relevant authorities such as law-enforcement
authorities. For example, the need to mitigate an immediate risk of
damage would call for prompt communication with data subjects
whereas the need to implement appropriate measures against
continuing or similar personal data breaches may justify more time for
communication.
(87) It should be ascertained whether all appropriate technological
protection and organisational measures have been implemented to
establish immediately whether a personal data breach has taken place
and to inform promptly the supervisory authority and the data subject.
The fact that the notification was made without undue delay should
be established taking into account in particular the nature and gravity
of the personal data breach and its consequences and adverse effects
for the data subject. Such notification may result in an intervention of
the supervisory authority in accordance with its tasks and powers laid
down in this Regulation.
(88) Insettingdetailedrulesconcerningtheformatandproceduresapplicable
to the notification of personal data breaches, due consideration should
be given to the circumstances of that breach, including whether or not
personal data had been protected by appropriate technical protection
measures, effectively limiting the likelihood of identity fraud or other
forms of misuse. Moreover, such rules and procedures should take into
account the legitimate interests of law-enforcement authorities where
early disclosure could unnecessarily hamper the investigation of the
circumstances of a personal data breach.
(89) Directive 95/46/EC provided for a general obligation to notify the
processing of personal data to the supervisory authorities. While that
obligation produces administrative and financial burdens, it did not
in all cases contribute to improving the protection of personal data.
Such indiscriminate general notification obligations should therefore
be abolished, and replaced by effective procedures and mechanisms
which focus instead on those types of processing operations which
are likely to result in a high risk to the rights and freedoms of natural
persons by virtue of their nature, scope, context and purposes. Such
types of processing operations may be those which in, particular,
involve using new technologies, or are of a new kind and where no