4.4.1 Account to Data Subject

This scenario below gives an example of how a data breach could be reported to a data subject. It hypothesises a breach of a cloud provider where data has been accessed and downloaded without authorisation. This breach notification is not required by law. Neither the Data Protection Directive, nor its implementation in national legislation in Member States of the EEA requires a notice of a security breach to be provided to either the Data Protection Authority or the data subjects. Regardless, we are giving an example of a scenario in which an accountable cloud provider, the provider here desires to provide an account to the user and the Data Protection Authority.

How the breach notice should be communicated

The question of how the breach should be communicated to data subjects is entirely at the discretion of the cloud provider since there is no legal obligation to provide an account. That said, it is most likely that the cloud provider would send the account by email to data subjects, in the first instance at least, but depending on the severity of the breach, notice could and quite possibly should also be sent by mail to ensure proper notice and receipt.

What should be included in the breach notice

As noted above in section 4.2.2 , there is no legal or regulatory template for such a communication but the account here should encompass answers to the fullest extent possible of the reporters questions, i.e. who, what, when, where, how and why, as well as measures being taken to prevent such breaches in the future.

More specifically, the cloud provider will want to do the following in its communication:

1. explain who committed the breach, if known, or that further investigation is being undertaken to ascertain who committed the breach;
2. what the breach consisted of and the extent of the information that might have been accessed, i.e. health information, financial information, etc.;
3. when the breach occurred and was discovered;
4. where the breach occurred;
5. how and why the breach occurred, if known, what security measures in place, whether those security measures were properly working at the time of the breach, and how the breach generally circumvented such measures;
6. what measures were taken to ascertain the extent of the breach;
7. what measures are being taken to prevent such breaches in the future;
8. contact information for a department or person to respond to any further enquiries regarding the breach; and
9. perhaps a link to a web page where further information, if any, will be disseminated regarding the breach and any further investigation.

Thus, hypothetically and in a basic form, an account by a cloud customer and/or cloud provider to cloud subjects after a data breach may look like the letter or email shown in Figure 16.

Figure 16 : Example data breach account (notification to end user)

To the data subject, the account will be general and use simple and non-technical language, without much of the technical information that would otherwise be available to the cloud provider. The cloud provider may decide to include more technical information on its website or upon request by the data subject, but the overriding objective to the end user should receive a clear explanation of the account.

What should not be included in the breach notice

The notice to the data subject is in contrast to the account of the same breach to the Data Protection Authority, discussed in the following section about investigations, section 4.4.2, where the account should contain more technical information, for example, the extent of the breach, a more technical overview of the breach, and the number of persons impacted by the breach. In addition, the account to the Data Protection Authority would also include relevant evidence regarding the breach, i.e. any applicable logs, audit trails, system maintenance records, and any other technical evidence regarding the proper operation of the cloud providers security measures and the extent of the breach. Providing such information to a data subject, however, would be counterproductive since such detail could confuse them about the nature and extent of any breach. Therefore excessive technical detail or evidence should not be included in the initial breach notice to the data subject.

Updating and providing additional information after the breach notice

As more information is obtained by the cloud provider and/or business, such information could continue to be provided through updated accounts to the data subject. An example of this is the handling of the data breach by U.S. company Target, who established a webpage containing rather detailed information after its credit card processing systems were compromised²⁴. It continued to update that page, providing its customers with information about the extent of the breach, measures that were being taken to prevent such breaches in the future, and other precautions end users should take to avoid damages and/or further damages. The account and updated accounts by Target provide an excellent template for companies facing similar data breaches and/or circumstances in the future.

[24] https://corporate.target.com/about/shopping-experience/payment-card-issu... (last accessed on 29 January 2015).