Chapter 32 — Privacy, legal and communications interfaces

Lesson map

Lesson 32 published. Map, example, EX094.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["32.1 Notification regimes"]
  N2["32.2 What specialists need"]
  N3["32.3 Legal hold"]
  N4["32.4 Stakeholder communication"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX094"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["32.1 Notification regimes"]
  N2["32.2 What specialists need"]
  N3["32.3 Legal hold"]
  N4["32.4 Stakeholder communication"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX094"]

[Learning outcomes and connection]
    |
    v
[32.1 Notification regimes]
    |
    v
[32.2 What specialists need]
    |
    v
[32.3 Legal hold]
    |
    v
[32.4 Stakeholder communication]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX094]

Learning outcomes and connection

You will be able to (1) supply fact-limited inputs to privacy impact and notification decisions; (2) recognize when a legal hold is needed; (3) communicate under uncertainty without speculation; and (4) mark issues that require legal or privacy review. Chapter 14 introduced privacy principles; Chapter 4 taught calibrated writing. This chapter joins them at the boundary where responders hand information to specialists and the public.

32.1 Notification regimes

Many laws require notification of personal-data breaches. Under the GDPR, a controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach unless it is unlikely to result in a risk to people's rights and freedoms (Article 33), and must inform affected people when the risk is high (Article 34). Sector rules (health, finance), other countries' laws and contracts add their own conditions and deadlines. Responders do not decide whether notification is required; they provide the facts on which counsel and the privacy officer decide, quickly and with explicit uncertainty.

32.2 What specialists need

For each possible exposure: what data types; how many people; whether access, acquisition, alteration or loss is established, suspected or ruled out; the time window; whether the data was encrypted and keys were safe; what containment was done; and the confidence of each statement. "Unknown" is a legitimate and useful answer.

The newsletter fact sheet follows this list: data types for 18,400 subscribers and the health-interest field for 2,100, access possible but not confirmed, and the time Harbourline became aware, 6 May at 14:20. Each line says whether the source is the vendor's statement or Harbourline's own verification, because the specialists weigh those differently.

32.3 Legal hold

When litigation or regulatory action is reasonably anticipated, relevant records must be preserved, overriding normal deletion schedules. Responders should flag the possibility early to counsel, who issues the hold; meanwhile, avoid deleting logs, images or messages related to the incident.

In the newsletter case, the fact sheet already lists a legal hold on vendor communications and logs as an issue for review. Until counsel decides, nobody at Harbourline should delete related messages or exports, even under normal retention rules. Ask the vendor in writing to preserve its own logs too, since Harbourline cannot hold what it does not control.

32.4 Stakeholder communication

Internal and external messages should state confirmed facts, what is being done, what is not yet known, what people should do (if anything) and when the next update will come. Avoid speculation about attackers or motives, avoid minimizing language ("no evidence of misuse" when you have not looked), and avoid promising what you cannot verify.

The internal update in the newsletter case follows this pattern: what the provider reported, that it is not confirmed, what is not involved, who is working on it and when the next update comes. Even "patient medical records are not involved" is a claim that needs a basis, here that they are held in a different system.

32.5 Worked example (synthetic): subscriber list

Fictional. Harbourline's newsletter platform (a vendor) reports that "an unauthorized party may have accessed" an export containing 18,400 subscriber records (name, email, postcode; for 2,100 subscribers, a free-text field "health interests"). The vendor has not confirmed access.

Fact sheet for privacy and legal (fact-limited): - Data types: name, email, postcode for 18,400; health-interest text for 2,100 (special-category data likely — specialist to confirm). - Status: vendor reports possible access to the export file between 3 and 5 May; not confirmed; no evidence yet of acquisition. - Awareness: Harbourline informed 6 May 14:20 (relevant to the 72-hour clock if GDPR applies — counsel to determine). - Containment: vendor rotated credentials; export deleted (vendor statement, unverified). - Unknowns: whether the file was downloaded; how access occurred; whether other exports exist. - Issues requiring review: whether this is a notifiable breach under applicable law and contract; whether notification to individuals is needed for the 2,100; legal hold on vendor communications and logs.

Internal update (to clinic managers): "Our newsletter provider has told us that a file of subscriber contact details may have been accessed by an unauthorized party between 3 and 5 May. This has not been confirmed. Patient medical records are held in a different system and are not involved. We are working with the provider and our privacy officer. Please refer any questions from the public to [contact]. Next update: 8 May 12:00."

32.6 Common errors and limits

• Responders making notification decisions.
• Stating "no evidence of misuse" without a search capable of finding misuse.
• Speculating about attacker identity in messages.
• Losing evidence through routine deletion before counsel assesses a hold.

• This chapter is not legal advice; deadlines and thresholds vary and change.

• Treating a vendor's statement that an export was deleted as verified.

• Letting the 72-hour clock start from when a manager read the email, rather than from when the organization became aware, without asking counsel.
• Sending different versions of the facts to different audiences.

Exercises — chapter 32

Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.

EX094 — Fact sheet. Inputs: a staff laptop with an unencrypted spreadsheet of 300 patients' appointment times was stolen from a car. Steps: write the fact sheet for privacy and legal. Rubric: 3 = data types, count, status (loss established; access unknown), encryption state, time of awareness, containment (remote wipe attempted?), unknowns, issues for review; 2 = missing awareness time or unknowns; 1 = narrative; 0 = none.

EX095 — Rewrite a message. Inputs: "We were hacked by sophisticated criminals but no data was stolen and there is no risk to anyone." Steps: rewrite for an external audience with incomplete facts. Rubric: 3 = confirmed facts, actions, unknowns, advice, next update; no speculation or unsupported reassurance; 2 = one unsupported claim remains; 1 = still speculative; 0 = none.

EX096 — Hold trigger. Steps: list three signals that should prompt you to ask counsel about a legal hold. Rubric: 3 = regulator inquiry or notification, threat of litigation (customer complaint, lawyer letter), employee misconduct suspicion, law-enforcement involvement, contractual dispute with vendor; 2 = two; 1 = one; 0 = none.

Chapter synthesis

Give specialists fact-limited inputs with explicit unknowns and timestamps of awareness, preserve evidence until counsel decides on holds, and communicate confirmed facts, actions, unknowns and next updates without speculation or false reassurance.