Chapter 8 — Privacy and data protection: supervised case analysis
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 The case"]
N2["8.2 Risk assessment"]
N3["8.3 Communicating with candidates"]
N4["8.4 Proportionate actions"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 The case"]
N2["8.2 Risk assessment"]
N3["8.3 Communicating with candidates"]
N4["8.4 Proportionate actions"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 The case]
|
v
[8.2 Risk assessment]
|
v
[8.3 Communicating with candidates]
|
v
[8.4 Proportionate actions]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) analyse a real-style privacy incident under supervision; (2) assess risk to candidates; (3) recommend proportionate actions.
8.1 The case
A consultant's laptop bag is stolen from a car. The laptop is encrypted, but the bag also contains printed interview notes for six candidates, including one candidate's request for disability adjustments at interview. Marta analyses the case with Ms. Lin and the data protection lead. She lists the facts: what was lost, when, where, what protections applied, who is affected and what has been done so far. She notes that paper often escapes the controls designed for systems. The theft is reported to police that evening.
8.2 Risk assessment
Marta assesses the risk using EDPB Guidelines 9/2022. The encrypted laptop presents low risk, because the data are unintelligible without the key. The printed notes present higher risk: they include names, current employers, salary expectations and, for one candidate, health information. Disclosure could harm candidates still employed elsewhere and could reveal a disability. She concludes that the breach is likely to result in a risk to candidates, so the supervisory authority must be notified within 72 hours under Article 33. The decision is recorded with reasons.
8.3 Communicating with candidates
Because the disability information creates a high risk for that candidate, Article 34 requires informing her directly. Marta drafts communications for all six candidates explaining what happened, what information was involved, what Halden is doing and who to contact. The draft avoids technical jargon and does not minimise the event. Ms. Lin reviews the wording and suggests offering a direct phone call to the candidate with health information, because a personal conversation is more respectful for sensitive news. Letters go out within two days of the theft.
8.4 Proportionate actions
Marta recommends actions in proportion to the causes: no printed interview notes leave the office, notes are recorded directly in the recruitment system, adjustment requests are stored only in a restricted field, and staff receive a short briefing on carrying documents. She avoids recommending disciplinary action, because the consultant followed the practice everyone used. The data protection lead records the breach, notification and decisions. Ms. Lin notes that the analysis is useful because it changed practice, not because it assigned blame. Causes, not people.
Worked example
Marta analyses a stolen bag with an encrypted laptop and printed notes, assesses higher risk from the paper, supports notification within 72 hours, drafts candidate communications and recommends ending printed notes.
Synthetic case. The case is synthetic; GDPR Articles 33 and 34 and EDPB Guidelines 9/2022 are real.
Errors and limits
Risk assessment depends on facts that may change; update it as information arrives.
Exercises
- EX036 — Low-risk item. Why was the laptop low risk? Rubric: 3 = encrypted, data unintelligible without key;; 2 = mentions encryption;; 1 = vague;; 0 = none.
- EX037 — High-risk content. What made the printed notes higher risk? Rubric: 3 = names, employers, salaries and health information;; 2 = most;; 1 = one;; 0 = none.
- EX038 — Notification. Within what time must the authority be notified? Rubric: 3 = 72 hours;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX039 — Article 34. Why must one candidate be informed directly? Rubric: 3 = high risk from disability information;; 2 = mentions health;; 1 = vague;; 0 = none.
- EX040 — No blame. Why was disciplinary action not recommended? Rubric: 3 = the consultant followed common practice;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 08 (chapter 08 of 12)
← Chapter 07 · Course chapter index · Chapter 09 →
Continue to the next authored lesson.