Don’t Put the Cart Before the Horse – Effective Incident Handling Under GDPR and NIS Directive - Privacy and Identity Management
Conference Papers Year : 2021

Don’t Put the Cart Before the Horse – Effective Incident Handling Under GDPR and NIS Directive

Abstract

This paper serves as notes to a lecture given at the IFIP summer school of privacy and identity management 2020. We discussed notification requirements in the NIS directive and the GDPR in the case of security and privacy incidents form legal and technical perspective. In particular, we discuss timing. While a need to mitigate an immediate risk of damage for an individual would call for prompt communication with data subjects, there are scenarios which may justify a delay in communication to a wider public, e.g. a large user base. This might be advisable, for instance, where a service provider needs to analyse the current attack to prevent further attacks and assess the full impact. In the latter, any delay in communication should fulfil the requirement of “without undue delay”. Further, we discuss why the concurrent reporting under both regimes is needed and conclude with a call for more cooperation of the respective competent authorities.
Fichier principal
Vignette du fichier
498598_1_En_1_Chapter.pdf (303.37 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03703760 , version 1 (24-06-2022)

Licence

Identifiers

Cite

Sandra Schmitz-Berndt, Stefan Schiffner. Don’t Put the Cart Before the Horse – Effective Incident Handling Under GDPR and NIS Directive. 15th IFIP International Summer School on Privacy and Identity Management (Privacy and Identity), Sep 2020, Maribor, Slovenia. pp.3-17, ⟨10.1007/978-3-030-72465-8_1⟩. ⟨hal-03703760⟩
35 View
25 Download

Altmetric

Share

More