Speaking slot

26 January 2018: Erik Valgaeren participates in a session on notification of personal data breach at the CDPD Conference

26 January 2018: Erik Valgaeren participates in a session on notification of personal data breach at the CDPD Conference

26 January 2018: Erik Valgaeren participates in a session on notification of personal data breach at the CDPD Conference

23.01.2018 BE law

Stibbe is a long standing partner of the International Computers, Privacy and Data Protection Conference (CPDP) which takes place in Brussels between 24 and 26 January 2018.

The theme of this year’s edition is “The Internet of Bodies”.

Erik Valgaeren, head of our Data Protection team, participates in a panel session on notification of personal data breach.

According to the GDPR, the data controller is required to adopt certain security measures in order to prevent such breaches. Nonetheless, in case of an eventual breach, the controller is required to notify the competent authority, and under certain conditions, the data subject as well. The main criteria for notification are “as soon as the controller has become aware”, and “high risks to the rights and freedoms of natural persons”, respectively. As these criteria are vague in nature, it is not always clear when and who must be notified. Taking into account the recent opinion of the WP29, this panel will discuss the notification duties under the GDPR, their timing, raison d’etre and risk mitigation.

  • How to define the moment a controller becomes aware of the data breach?
  • When to notify the competent supervisory authority, and when the data subject? 
  • How to address personal data breaches in the DPIA process, considering they do not refer to the same “high risk”?

Click here for more information on the programme.

Related news

19.08.2019 EU law
Enable “likes” and bear joint-controllership

Articles - The Court of Justice of the European Union recently ruled, in Case C-40/14 Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV,  that a website operator that features “Like” social-media plugin from Facebook likely qualifies as joint-controller with Facebook for its website visitors’ personal data collection and transmission to Facebook.

Read more

08.08.2019 BE law
Regulating online platforms: piece of the puzzle

Articles - The new Regulation no. 2019/1150 of the European Parliament and of the Council of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services, applicable as of 12 July 2020, is another piece of the puzzle regulating online platforms, this time focussing on the supply side of the platforms.

Read more

23.07.2019 LU law
The Revised CSSF Cloud Circular

Articles - On 27 March 2019, the Luxembourg supervisory authority for the financial sector (the Commission de surveillance du secteur financier or CSSF) published the long-awaited CSSF Circular 19/714 amending the CSSF Circular 17/654 on IT outsourcing relying on a cloud computing infrastructure (the Revised Cloud Circular).

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring