Notifying affected individuals (s 26WL)

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which individuals must an organisation notify under s 26WL after an eligible data breach?

A Every customer on the organisation's database, whether affected or not

B Those at risk of serious harm from the breach

2. Which item must the notification to an individual include?

A The kinds of information involved in the breach

B The names of the staff member who caused the breach

3. What else must the notification tell individuals?

A What steps they should take in response to the breach

B That they must wait for the organisation to fix everything

4. Which is an example of direct notification?

A Emailing each at-risk customer with details of the breach

B Posting a general notice on a staff noticeboard

5. An organisation cannot practically contact the affected individuals. What should it do?

A Skip notifying individuals because contacting them is too hard

B Publish a notice on its website and take reasonable steps to publicise it

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1s 26WL(2)		AUsed when direct contact with the affected individuals is not practicable, so the organisation makes the statement public instead
2Publish a notice on the website		BEmail to each affected customer: 'Your name and address were accessed in a breach'
3Direct notification: the organisation contacts each individual at risk of serious harm		Cs 26WL also requires the organisation to tell the individuals at risk of serious harm, directly or by publishing a notice, not just the Commissioner.
4Recommended steps for individuals: the notice must tell people how to reduce harm		DNotice says: 'Change your password and watch your bank statements for unusual activity'
5Notice says: 'A breach occurred. We are investigating.'		EThe notice leaves out the kind of information involved and the steps individuals should take, both required by s 26WL.
6Organisation notifies only the Commissioner and stays silent to customers		FThe organisation must give the affected individuals a statement of the breach, the information involved and recommended steps, either directly or by publishing a notice

Definitions

s 26WL

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Notifying affected individuals: s ____

IF breach = eligible THEN ______(individualsAtRisk)

notify(person, infoInvolved, _____)

IF directContact = impractical THEN _______(noticeOnWebsite)

Notify people at risk of ____________

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF eligibleBreach = TRUE THEN

B SET info TO breachDetails

C notify(Commissioner, info)

D END IF

Question 2

A FOR EACH person IN atRiskList

B c = getContact(person)

C IF c = AVAILABLE THEN

D publishNotice(person)

E ELSE publishNotice()

Question 3

A SET msg TO NEW Statement()

B msg.add(breachDescription)

C msg.add(organisationLogo)

D msg.add(recommendedSteps)

Question 4

A steps ← NEW LIST

B ADD 'do nothing' TO steps

C ADD 'watch accounts' TO steps

D notify(person, steps)

Question 5

A statement ← prepareStatement()

B IF seriousHarm = TRUE THEN

C waitSixMonths()

D END IF

Answer Key

Notifying affected individuals (s 26WL)

Section A: Quick Questions

B — Those at risk of serious harm from the breach

A — The kinds of information involved in the breach

A — What steps they should take in response to the breach

A — Emailing each at-risk customer with details of the breach

B — Publish a notice on its website and take reasonable steps to publicise it

Section B: Match the Pairs

s 26WL(2) → The organisation must give the affected individuals a statement of the breach, the information involved and recommended steps, either directly or by publishing a notice

Publish a notice on the website → Used when direct contact with the affected individuals is not practicable, so the organisation makes the statement public instead

Direct notification: the organisation contacts each individual at risk of serious harm → Email to each affected customer: 'Your name and address were accessed in a breach'

Recommended steps for individuals: the notice must tell people how to reduce harm → Notice says: 'Change your password and watch your bank statements for unusual activity'

Notice says: 'A breach occurred. We are investigating.' → The notice leaves out the kind of information involved and the steps individuals should take, both required by s 26WL.

Organisation notifies only the Commissioner and stays silent to customers → s 26WL also requires the organisation to tell the individuals at risk of serious harm, directly or by publishing a notice, not just the Commissioner.

Section C: Definitions

s 26WL — Organisation must tell individuals at risk of serious harm about an eligible data breach, what information was involved and what steps to take, directly or by publishing a notice.

Section D: Fill in the Blanks

Notifying affected individuals: s 26WL

IF breach = eligible THEN
  notify(individualsAtRisk)

notify(person, infoInvolved, steps)

IF directContact = impractical THEN
  publish(noticeOnWebsite)

Notify people at risk of serious harm

Section E: Spot the Error

C — Under s 26WL the organisation must notify the individuals at risk of serious harm, not only the Commissioner. It should be notify(individuals, info).

D — When contact details are available, the organisation notifies the person directly. Publishing a notice is only the fallback (the ELSE branch) if direct contact is impractical. It should be notifyDirectly(person).

C — The notification must say what information was involved in the breach. A logo does not tell people this. It should be msg.add(informationInvolved).

B — The recommended steps must help individuals reduce the risk of serious harm, such as resetting a password. Telling them to do nothing is not a useful step.

C — Once the statement is prepared, the organisation must notify affected individuals as soon as practicable, not delay for months. It should be notifyAsSoonAsPracticable().