Chapter 28 — Privacy and data protection: failure analysis | Bachelor's Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 28 — Privacy and data protection: failure analysis

Lesson map

Lesson 28 published. Map, example, EX082.

flowchart TD
  N0["Learning outcomes"]
  N1["28.1 The incident"]
  N2["28.2 Root causes"]
  N3["28.3 Response"]
  N4["28.4 Lasting fixes"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX082"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["28.1 The incident"]
  N2["28.2 Root causes"]
  N3["28.3 Response"]
  N4["28.4 Lasting fixes"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX082"]

[Learning outcomes]
    |
    v
[28.1 The incident]
    |
    v
[28.2 Root causes]
    |
    v
[28.3 Response]
    |
    v
[28.4 Lasting fixes]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX082]

Learning outcomes

You will (1) analyse a privacy incident to find root causes; (2) distinguish individual error from system failure; (3) recommend lasting fixes.

28.1 The incident

A synthetic incident: a teacher emails a spreadsheet of pupils' reading levels and special needs flags to all parents in a class instead of a single colleague. Elena leads the failure analysis. She gathers facts: the email client auto-completed the parent group, the spreadsheet contained more columns than needed, and there was no warning for external recipients with attachments. The breach is reported to the data protection lead within an hour. A teacher emailed a spreadsheet to all parents. Every family in the class received it.

28.2 Root causes

Elena asks why repeatedly. Why did the email go to parents? Auto-complete suggested the parent group. Why did the spreadsheet contain special needs flags? It was exported from the system with default columns. Why was there no warning? The warning covered external domains, but parents' addresses were in a school-managed group. She identifies three system causes, not just the teacher's error, and explains that blaming the teacher would leave the causes in place. The export included unneeded columns. Email groups were unmanaged.

28.3 Response

The trust assesses the risk. The spreadsheet included special needs information, which may be health data, so the risk to pupils is likely, and the trust notifies the supervisory authority within 72 hours under Article 33. It contacts parents to ask them to delete the email and informs affected families. EDPB Guidelines 9/2022 help assess the severity. Elena records the timeline and decisions. Within the first day, the trust asks each recipient to confirm deletion, and the data protection lead decides whether the authority must be notified under Article 33.

28.4 Lasting fixes

Elena recommends three fixes: disable auto-complete for parent groups, change export defaults to minimal columns, and extend warnings to any message with attachments sent to large groups. She also recommends sharing reports through a secure system rather than email. After the fixes, she runs a laboratory test to confirm them. Dr. Asante notes that good failure analysis produces fixes that make the same mistake hard to repeat for anyone. External attachments now trigger a warning before sending. Exports now default to minimal columns.

Worked example

Elena analyses a misdirected spreadsheet, finds three system causes, supports notification within 72 hours and recommends disabling auto-complete, minimal export defaults, broader warnings and secure sharing.

Synthetic case. The incident is synthetic; GDPR Article 33 and EDPB Guidelines 9/2022 are real.

Errors and limits

Root cause analysis can stop too early; keep asking why until a system cause appears.

Exercises

EX082 — System causes. Name the three system causes of the incident. Rubric: 3 = auto-complete of parent group, default export columns, warnings limited to external domains;; 2 = two;; 1 = blame teacher;; 0 = none.
EX083 — Notification reason. Why did the trust notify the supervisory authority? Rubric: 3 = special needs data made risk to pupils likely;; 2 = mentions sensitivity;; 1 = not needed;; 0 = none.
EX084 — Lasting fix. Give one lasting fix Elena recommends. Rubric: 3 = e.g. minimal export columns by default;; 2 = example;; 1 = retrain only;; 0 = none.

Synthesis

Chapter 28 learns from failure. Chapter 29 runs operations.

Continue studying — chapter 28 of 40

← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →