While performing a backup, a data server disk crashed. Both the data and the backup are lost. The disk contained personal data, but no special category personal dat

Question

Options

• AYes, because there were no special category personal data stored on the disk.
• BNo, because no personal data on the disk were processed, only destroyed
• CYes, because the personal data on the disk were unlawfully processed.
• DNo, because this is only a security incident and not a data breach

• A
  10% (4)
• B
  8% (3)
• C
  79% (31)
• D
  3% (1)

Explanation

Yes, because the personal data on the disk were unlawfully processed. Correct. Personal data irretrievably lost is regarded as 'a breach of security leading to unlawful destruction of personal data, which also makes it a personal data breach. (Literature: A, Chapter 5; GDPR Article 4(12)) Yes, because there were no special category personal data stored on the disk. Incorrect. Accidental loss of data is a security incident (data is no longer available). According to the GDPR it is also unlawful processing of personal data, hence a personal data breach. Data do not have to belong to the category of special personal data to fall under the category personal data breach. No, because no personal data on the disk were processed, only destroyed. Incorrect. A technical malfunction causing data to be no longer available is a security incident. The GDPR sees accidental loss of personal data as unlawful processing (not on instruction of the controller or processor) hence as a personal data breach. No, because this is only a security incident and not a data breach. Incorrect. Personal data that are irretrievably lost, is regarded as unauthorized processing by the GDPR, hence a personal data breach. The fact that data was accidentally destroyed also makes the event a security incident.

No community discussion yet for this question.