united-kingdom gdpr european-union data-protection legal-research
Responsabilities on data breaches UK Data Protection Act
<p>Following a question from <a href="https://law.stackexchange.com/questions/83690/does-the-uk-have-a-enforcable-law-linked-with-the-data-protection-act-to-contr?noredirect=1#comment183547_83690">THIS StackExchange</a> about Data Protection Act application in  the UK, there is an aspect about &quot;proactivity&quot; and &quot;responsabilities&quot; that I do not fully understand.</p>
<p>Let's assume for this example: On a given organization the person responsible for Data Protection Act compliance do all due dilligences up to his/her knowledge to make sure that the company is compliant with the UK-GDPR / Data Protection Act.</p>
<p>At one point, a third party discovers a vulnerability on the company's IT estructure that produces a data breach. That third party notifies the organization's DPO with the details of the data breach, but the DPO &quot;do not believe&quot; the info and just ignore the new information.</p>
<ol>
<li>Is that &quot;bad practice&quot;?</li>
<li>Is this something regulated?</li>
<li>Is there any responsible for &quot;ignore that&quot;?</li>
<li>Who else should be notified?</li>
</ol>

<h2>The DPO clearly hasn’t done “all <a href="https://en.m.wikipedia.org/wiki/Due_diligence" rel="nofollow noreferrer">due diligence</a>”</h2>
<p>Ignoring a potential security vulnerability of which you are aware is not due diligence, it’s negligence.</p>
<p>Article 5(1) imposes the following <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/" rel="nofollow noreferrer">principle</a> on data controllers:</p>
<blockquote>
<p>(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).”</p>
</blockquote>
<p>I don’t think dismissing a tip-off without any investigation does this. We’re a breach to occur through this vulnerability the data controller could be successfully prosecuted and the DPO will likely need to bring their resume up to date.</p>
