UK businesses face increased uncertainty in EU GDPR breach reporting

Law firm Pinsent Masons has confirmed its objections to the latest change by the European Data Protection Board (EDPB) to remove the one-stop shop reporting mechanism contained in its new draft data breach notification guidelines. The changes would particularly impact businesses not established in the EU and would mean data breaches can no longer only be notified to the lead supervisory authority (SA) in the EU member state where the controller's representative is established. The new guidelines state that the "mere presence of a representative in a member state does not trigger the one-stop-shop system." Consequently, a breach of the regulations would need to be notified to every SA where affected data subjects reside. Pinsent Masons Partner David McIlwaine said: "It is already very challenging for multinational businesses who suffer a data breach to manage their breach notification duties, as typically a variety of supervisory authorities need to be notified – both national and industry specific regulators. The proposed amendments will add a significant burden on the entity to notify all national data protection authorities where data subjects reside – no matter how few – and all within the stipulated timescales within article 33."

Last week an article for the IAPP cautioned against the EDPB's proposed update to its Guidelines on Personal Data Breach Notification.