1. Privacy by Design Session 6
Data Breaches & Subject Access Requests

2. Identify
Record (form)
Assess
Notify
Mitigate
Data Breach

3. Bavarian IS solution to record breaches: ticket system
The importance of reporting data breaches to the DPO with the implemented system was announced via and is included in the intranet GDPR-pages
Staff are familiar with our helpdesk ticket system (already in use for IT or facility support and Purchasing requests)
Sub-types for different breaches
Digital vs physical breach
Several options

4. Bavarian IS solution to record breaches: ticket system
Request details as open field for incident description as per instructions (individualized per sub-type)
Required fields to collect information on the data subjects, kind of data and numbers of data sets affected
Location, Room and Priority are standard fields from the system

5. Bavarian IS solution to record breaches: ticket system
Backend of ticket system is used for documentation of assessment and further actions
Notes for internal DPO qualification
Assessment field (to be or not to be reported)
Status options were extended with a ‘reported to supervisory authority’ option

6. Scenario 1
A list of student names and medical data is turned into the office by two students.
A teacher was preparing for an upcoming field trip. They printed out the list of students with medical data and it was left at the photocopier.
How would you manage a breach like this?

7. Scenario 2
Administrators request an account to be created for substitute teachers so they can access the attendance tools on the Student Information System.
A generic account is created for substitute teachers. One month later, a substitute teacher reports that they have full access to student records and files on the Student Information System.
How would you manage a breach like this?

8. Scenario 3
A teacher is sending an message to all parents about an upcoming meeting. The teacher collects the names from the school management systems and CCes all parents on the message.
How would you manage a breach like this?

9. Scenario 4
A teacher lends their device to a student so that they can present. The student logs into chrome, the teacher did not log out, and then chrome synchronized the two accounts.
How would you manage a breach like this?

10. Subject Access Request
Receive request
Confirm request & identity
Internal Communication
Collation & Exemptions
Data released
Subject
Access
Request

11. Scenario 1 You receive an SAR from a student who is 18 years old.
At the end of each term, you mail a report card to the family of each student. This particular student has requested that the report not be mailed and they will collect it personally from the office.
How do you process this request?

12. Scenario 2
You receive a comprehensive SAR from a family that includes data from multiple departments within the school.
The request is received the day after the school has closed for a holiday. There are no employees on site.
How do you process this request?

13. Scenario 3
A family has applied to the school but their child’s application is rejected.
The family has submitted a SAR for all notes including confidential discussions about their child’s application.
How do you process this request?