After a ransomware incident, a city restores systems from backups and leadership says there is no personal-data breach because availability was recovered. What should privacy counsel emphasize?
Select an answer to reveal the explanation.
Short Explanation
Getting the lights back on is not the same as proving nobody peeked. If attackers had a window into personal data, that confidentiality hit still counts as a breach idea—even after a clean restore. Availability recovery and breach assessment are different questions.
Full Explanation
A personal-data breach under the GDPR is a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Restoring city systems from backups may repair availability, yet a ransomware event can still involve confidentiality compromise if attackers accessed or exfiltrated personal data. Privacy counsel should emphasise that availability recovery does not, by itself, erase the breach characterisation or the duty to assess notification under Articles 33–34.
Paying ransom does not convert the incident into a non-breach once files reopen; payment is an operational decision, not a legal cleansing of unauthorised access. Backups alone do not erase notification assessment: integrity and confidentiality risks to data subjects remain separate from restore success. Limiting “breach” to encrypted databases only is incorrect—plaintext ransomware affecting personal data is not mere IT downtime under the definition.
Exam caveat: do not equate “we restored service” with “no personal-data breach”; CIA facets are distinct. Operational check: preserve forensic evidence, determine attacker dwell time and data touchpoints, document the risk assessment to individuals, and decide supervisory-authority and data-subject notifications on that analysis—not on restore success alone. For municipal services, transparent breach handling protects residents who depend on city systems and shows that public bodies do not hide confidentiality failures behind uptime metrics.