After unauthorised access to citizen records, a city argues that intact backups make breach notification unnecessary. Which distinction should privacy counsel draw?
Select an answer to reveal the explanation.
Short Explanation
Backups are a spare tire—great when you need to roll again, useless as proof nobody saw the data. Restoring availability doesn't cancel confidentiality-breach analysis or notification thinking. Keep those questions separate.
Full Explanation
Backups primarily support availability and recovery after disruption. Unauthorised access to citizen records remains a confidentiality—and possibly integrity—personal-data breach issue that still requires assessment of risks to data subjects and application of Articles 33–34 where applicable. The existence of intact backups does not, by itself, erase the need to analyse notification duties for confidentiality compromises.
Backups do not legally convert every confidentiality incident into a non-event under Chapter IV. Notification is not conditioned solely on failing a forty-eight-hour restore test; restore success is an operational metric, not the GDPR risk test. Nor may controllers skip risk assessment to individuals merely because spare copies exist.
Exam caveat: availability recovery ≠ confidentiality clearance—keep the CIA facets separate in breach analysis. Operational check: investigate what was accessed, by whom, and for how long; preserve evidence; document the Article 33/34 analysis; restore service in parallel without using restore success as the sole decision metric. Municipal counsel should explain to leadership that residents’ notification rights turn on likely harm to people, not on whether the city still has a spare copy of the database, and should record why “we have backups, so no breach” was rejected.