Cyberstudy
PDF p.423 In progress

Privacy Breaches and Data Breaches

Open PDF at p.423 21 flashcards

Summary

PDF p.423

A data breach involves unauthorized access, modification, or deletion of information, while a privacy breach specifically pertains to the loss or disclosure of personal and sensitive data. Both types of breaches can have severe organizational consequences, including reputation damage, identity theft, fines, and intellectual property theft.

In plain words

Supplementary — not from your PDF

A data breach is any unauthorized access, modification or deletion of information; a privacy breach specifically involves personal and sensitive data. Consequences include reputation damage, identity theft, fines (sometimes a percentage of turnover) and IP theft. Laws set who must be notified and when. GDPR requires notification within 72 hours of becoming aware; HIPAA requires notifying individuals, the HHS Secretary, and the media for large breaches. Even potential unauthorized access can count as a breach.

Detailed explanation

PDF p.423
  • Data Breach
    • Definition: Unauthorized access, modification, or deletion of information.
    • Scope: Includes corporate information and intellectual property.
    • Examples: Reading, transferring, or deleting data without authorization.
  • Privacy Breach
    • Definition: Unauthorized loss or disclosure of personal and sensitive data.
    • Scope: Specifically pertains to personal information.
  • Organizational Consequences
    • Reputation Damage: Negative publicity and loss of customer trust.
    • Identity Theft: Legal actions from data subjects if identity theft occurs.
    • Fines: Regulatory fines, potentially a percentage of turnover.
    • Intellectual Property Theft: Loss of revenue from stolen IP, patents, designs, trade secrets.
  • Notifications of Breaches
    • Requirements: Set out in laws and regulations, indicating who must be notified.
    • Types of Breaches: Loss, theft, accidental disclosure, or damage of information.
    • Potential for Unauthorized Access: Even potential access can be considered a breach.
  • Escalation
    • Detection: Breaches detected by technical staff should be escalated.
    • Legal Jeopardy: Failure to notify can lead to legal consequences.
    • Senior Decision-Makers: Involvement required for personal data and IP breaches.
  • Public Notification and Disclosure
    • Regulatory Requirements: Notification to law enforcement, affected individuals, third parties, and the public.
    • HIPAA: Requires notification to affected individuals, the Secretary of the US Department of Health and Human Services, and the media if over 500 individuals are affected.
    • GDPR: Notification within 72 hours of becoming aware of a breach.
    • Disclosure Requirements: Description of breached information, contact details, consequences, and mitigation measures.

Important terms

taken from the text above
Data Breach
Unauthorized access, modification, or deletion of information.
Privacy Breach
Unauthorized loss or disclosure of personal and sensitive data.
Reputation Damage
Negative publicity and loss of customer trust.
Identity Theft
Legal actions from data subjects if identity theft occurs.
Fines
Regulatory fines, potentially a percentage of turnover.
Intellectual Property Theft
Loss of revenue from stolen IP, patents, designs, trade secrets.
Types of Breaches
Loss, theft, accidental disclosure, or damage of information.
Potential for Unauthorized Access
Even potential access can be considered a breach.
Legal Jeopardy
Failure to notify can lead to legal consequences.
Senior Decision-Makers
Involvement required for personal data and IP breaches.
Regulatory Requirements
Notification to law enforcement, affected individuals, third parties, and the public.
HIPAA
Requires notification to affected individuals, the Secretary of the US Department of Health and Human Services, and the media if over 500 individuals are affected.
GDPR
Notification within 72 hours of becoming aware of a breach.
Disclosure Requirements
Description of breached information, contact details, consequences, and mitigation measures.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Notifying regulators within 72 hours under GDPR.
  • HIPAA media notification for a large health-data breach.
  • Escalating a detected breach to senior decision-makers.

Scenario

An analyst discovers a database of personal data was exposed. Because GDPR sets a 72-hour notification window, the breach must be escalated immediately so the organization can notify regulators in time.

Common mistakes

Supplementary — not from your PDF
  • Delaying escalation and missing notification deadlines.
  • Assuming only confirmed access, not potential access, counts as a breach.

Practical skills

Supplementary — not from your PDF
  • State the GDPR and HIPAA breach notification requirements.

What I should remember

Key Points PDF p.423
  • Data Breach
    • Unauthorized Access: Reading, modifying, deleting information.
    • Scope: Corporate information, intellectual property.
  • Privacy Breach
    • Personal Data: Loss or disclosure of sensitive information.
  • Organizational Consequences
    • Reputation Damage: Negative publicity, loss of trust.
    • Identity Theft: Legal actions, damages.
    • Fines: Regulatory penalties.
    • IP Theft: Revenue loss, commercial losses.
  • Notifications of Breaches
    • Legal Requirements: Who must be notified.
    • Types of Breaches: Loss, theft, accidental disclosure.
  • Escalation
    • Detection: Technical staff, senior decision-makers.
    • Legal Jeopardy: Importance of notification.
  • Public Notification and Disclosure
    • Regulatory Requirements: HIPAA, GDPR.
    • Disclosure: Description, contact details, consequences, mitigation.