Scouting NL: Data Breach Procedure.pdf

Purpose: This procedure outlines the steps to be taken when a (suspected) data leak occurs at a processor of Scouting Nederland.

Background: Since January 1, 2016, organizations are legally required to report data leaks to the Dutch Data Protection Authority (AP) if there's a risk of serious adverse effects on the protection of personal data. In some cases, the data subjects must also be notified.

Scope: This procedure applies to Scouting Nederland and its subgroups, regions, and other organizational units that process personal data.

Processor Definition: A processor is an entity that processes personal data on behalf of the controller, without being subject to the controller's direct authority (article 1, sub e, Wbp).

Importance of Timely Reporting: A late or insufficient report can result in a significant fine. A data leak report must be made within 72 hours.

Data Leak Definition: A data leak occurs when personal data is accessed, altered, or compromised without authorization. This includes not only data leaks but also unauthorized data processing. A data leak is considered to have occurred if there's a breach of personal data security (as defined in article 13 of the Personal Data Protection Act).

Procedure Steps:

1. Report Data Leak: Immediately report suspected data leaks to the Legal Affairs department of Scouting Nederland's national service center via [email protected]. For advice or clarification, contact this email or call 033-4960911. This email will notify the relevant personnel for data leak handling, and the report is considered formally submitted upon sending the email.

2. Determine if a Data Leak Occurred: Evaluate if the reported issue is indeed a data leak and if the data subjects need to be informed. If information is unclear, attempt to clarify it with the reporter.

3. Report to AP: If a data leak is confirmed, report it to the AP via the national service center. The reporter will be informed about this.

4. Notify Data Subjects: If the nature of the data leak requires notifying the data subjects, do so as soon as possible. The method of communication depends on the amount of leaked data. The national service center will handle this, and the reporter will be informed.

5. Record Data Leak: Keep a record of reported data leaks in a dossier, which the national service center will manage.

Examples of Data Leaks:
- Accidentally providing login credentials to the data controller of your group for Scouts Online.
- Sending a letter to the wrong person, who reads it.
- Sharing a membership list with unauthorized personnel.
- A present list with address data disappearing from the clubhouse.
- A post-it note with a new member's name, birthday, and email address being visible to unauthorized personnel.
- Sharing a mailing list with an external party that should not have received it.