Privacy by Design Session 6 Data Breaches & Subject Access Requests

Identify Record (form) Assess Notify Mitigate Data Breach

Bavarian IS solution to record breaches: ticket system The importance of reporting data breaches to the DPO with the implemented system was announced via e-mail and is included in the intranet GDPR-pages Staff are familiar with our helpdesk ticket system (already in use for IT or facility support and Purchasing requests) Sub-types for different breaches Digital vs physical breach Several options

Bavarian IS solution to record breaches: ticket system Request details as open field for incident description as per instructions (individualized per sub-type) Required fields to collect information on the data subjects, kind of data and numbers of data sets affected Location, Room and Priority are standard fields from the system

Bavarian IS solution to record breaches: ticket system Backend of ticket system is used for documentation of assessment and further actions Notes for internal DPO qualification Assessment field (to be or not to be reported) Status options were extended with a ‘reported to supervisory authority’ option

Scenario 1 A list of student names and medical data is turned into the office by two students. A teacher was preparing for an upcoming field trip. They printed out the list of students with medical data and it was left at the photocopier. How would you manage a breach like this?

Scenario 2 Administrators request an account to be created for substitute teachers so they can access the attendance tools on the Student Information System. A generic account is created for substitute teachers. One month later, a substitute teacher reports that they have full access to student records and files on the Student Information System. How would you manage a breach like this?

Scenario 3 A teacher is sending an email message to all parents about an upcoming meeting. The teacher collects the names from the school management systems and CCes all parents on the message. How would you manage a breach like this?

Scenario 4 A teacher lends their device to a student so that they can present. The student logs into chrome, the teacher did not log out, and then chrome synchronized the two accounts. How would you manage a breach like this?

Subject Access Request Receive request Confirm request & identity Internal Communication Collation & Exemptions Data released Subject Access Request

Scenario 1 You receive an SAR from a student who is 18 years old. At the end of each term, you mail a report card to the family of each student. This particular student has requested that the report not be mailed and they will collect it personally from the office. How do you process this request?

Scenario 2 You receive a comprehensive SAR from a family that includes data from multiple departments within the school. The request is received the day after the school has closed for a holiday. There are no employees on site. How do you process this request?

Scenario 3 A family has applied to the school but their child’s application is rejected. The family has submitted a SAR for all notes including confidential discussions about their child’s application. How do you process this request?