Chapter 8 — Privacy and data protection: difficult cases | Postgraduate Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 8 — Privacy and data protection: difficult cases

Lesson map

Lesson 08 published. Map, example, EX036.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 AML versus erasure"]
  N2["8.2 Law enforcement requests"]
  N3["8.3 Complex breach"]
  N4["8.4 Lessons"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX036"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 AML versus erasure"]
  N2["8.2 Law enforcement requests"]
  N3["8.3 Complex breach"]
  N4["8.4 Lessons"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX036"]

[Learning outcomes]
    |
    v
[8.1 AML versus erasure]
    |
    v
[8.2 Law enforcement requests]
    |
    v
[8.3 Complex breach]
    |
    v
[8.4 Lessons]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX036]

Learning outcomes

You will (1) handle conflicting obligations such as anti-money-laundering and erasure; (2) respond to law enforcement requests; (3) manage a complex breach.

8.1 AML versus erasure

A customer asks Corvina to erase all their data. Anti-money-laundering rules require Corvina to keep transaction records and identity documents for several years. Priscila explains that GDPR Article 17(3)(b) allows retention where processing is necessary for compliance with a legal obligation, and the LGPD has similar provisions. Corvina erases marketing data and profile preferences, restricts the retained records to compliance use and tells the customer clearly what is kept, why and for how long. Anti-money-laundering law requires keeping records for years. Erasure therefore applies only partly.

8.2 Law enforcement requests

Police request transaction records for a customer under investigation. Priscila checks that the request is in proper legal form, specifies the data and comes from an authorised body. Corvina discloses only the transactions in the requested period and records the disclosure. She notes that Corvina may not be able to inform the customer if this would prejudice the investigation. She creates a procedure for such requests to ensure consistency and to protect both customers and staff. Each request is checked for a legal basis.

8.3 Complex breach

A vendor providing customer support software reports that an attacker accessed support tickets, some containing partial card numbers and addresses. Priscila leads the response. The breach affects customers in both countries. Under the GDPR, Corvina notifies the Portuguese supervisory authority within 72 hours; under the LGPD, it communicates with the Brazilian authority within the timeframe set by its regulations. EDPB Guidelines 9/2022 help assess risk. Affected customers are informed with advice on phishing. The response log records each notification time, so the team can show that both the Portuguese and Brazilian deadlines were met.

8.4 Lessons

Priscila reflects that difficult cases often involve competing obligations, multiple jurisdictions and incomplete information. Clear procedures, documented reasoning and coordination with legal counsel help. She updates the vendor contract to require faster notification and restricts card data in support tickets through automated masking. Dr. Ward notes that difficult cases test whether a privacy programme works under pressure, and that learning from them is as important as handling them. The breach review produces three changes: faster vendor contact, a template for customer letters and a rehearsal every six months.

Worked example

Priscila balances erasure with AML retention, handles a police request with minimal disclosure, coordinates a cross-border vendor breach and adds automated masking of card data in tickets.

Synthetic case. Cases are synthetic; GDPR Article 17(3)(b) and EDPB Guidelines 9/2022 are real.

Errors and limits

Jurisdiction-specific timelines change; check current regulations.

Exercises

EX036 — AML erasure. What does Corvina erase and retain for the erasure request? Rubric: 3 = erases marketing and preferences; retains AML records restricted to compliance;; 2 = one part;; 1 = everything;; 0 = none.
EX037 — Article 17(3)(b). Which provision allows retaining data for legal obligations? Rubric: 3 = GDPR Article 17(3)(b);; 2 = close;; 1 = wrong;; 0 = none.
EX038 — Police disclosure. What did Corvina disclose to police? Rubric: 3 = only transactions in the requested period, with a record;; 2 = mentions limited;; 1 = all;; 0 = none.
EX039 — Cross-border breach. Which authorities were notified for the vendor breach? Rubric: 3 = Portuguese supervisory authority under GDPR and Brazilian authority under LGPD;; 2 = one;; 1 = vague;; 0 = none.
EX040 — Ticket masking. What preventive fix followed the breach? Rubric: 3 = automated masking of card data in support tickets;; 2 = mentions masking;; 1 = vague;; 0 = none.

Synthesis

Chapter 8 handles hard cases. Chapter 9 provides leadership and assurance.

Continue studying — chapter 08 of 12

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →