{"id":6899,"date":"2022-03-03T13:39:36","date_gmt":"2022-03-03T12:39:36","guid":{"rendered":"https:\/\/www.actonic.de\/verletzung-des-schutzes-personenbezogener-daten-in-jira-und-confluence\/"},"modified":"2023-03-31T10:56:18","modified_gmt":"2023-03-31T08:56:18","slug":"violation-of-the-protection-of-personal-data-in-jira-or-confluence","status":"publish","type":"post","link":"https:\/\/actonic.de\/en\/violation-of-the-protection-of-personal-data-in-jira-or-confluence\/","title":{"rendered":"Violation of the protection of personal data in Jira or Confluence – How to deal with data leaks & breaches in a GDPR-compliant way"},"content":{"rendered":"

[vc_row][vc_column][vc_column_text]<\/p>\n

Data leaks & data breaches: These rules must be observed according to the GDPR<\/h2>\n

A violation of the protection of personal data is defined in the GDPR as a “breach of security leading unintentionally or unlawfully, to the destruction, loss, alteration or unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed”. This therefore includes both a data leak, where there is a possibility that third parties could access personal data stored by you, and a data breach, where unauthorized third parties have intentionally accessed data.<\/p>\n

In Article 33 (1)<\/span> of the GDPR, the legislator specifies what must be done in these cases. It states that a violation of the protection of personal data must be reported to the local supervisory authority without delay, which means that you must comply with a deadline of 72 hours. In addition, all cases must be logged internally. Which authority you need to contact varies from country to country. In Germany, there is one competent supervisory authority per federal state.<\/p>\n

Additionally, if there is a “high risk to personal rights and freedoms” as a result of the violation, all affected individuals must be notified without exception. This high risk arises from data leaks or breaches of financial or medical data, which can be credit card or bank account data, for example.
\nHowever, if “only” contact information<\/span> is affected, such as names, e-mail address or address, notification is not absolutely necessary. However, it should be noted that if a large number of individuals are involved, the affected individuals must also be contacted in addition to the supervisory authority.<\/p>\n

The aforementioned 72-hour time limit for reporting a violation of the protection of personal data begins from the time a data controller becomes aware of the personal data violation. Therefore, if you come across a circumstance involving personal data in your company, and you are unsure whether it is a violation of the protection of personal data, you should first check the incident carefully. If you then know after the examination that this is actually the case, the time limit begins.[\/vc_column_text][vc_column_text]<\/p>\n

Personal data breach or leak according to the GDPR: What must be reported<\/h3>\n

In this regard, the law specifies what information you must provide to the supervisory authority. According to Article 33<\/span><\/span><\/span> of the GDPR, you must notify the authority of the following:<\/p>\n