S.L. 586.8 Art. 31Communication of a personal data breach to the data subject. 22 [S.L.

(1) In the case of a personal data breach which is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach, in writing, to the data subject without undue delay:

Provided that in cases where it is not feasible to communicate the data breach to the data subject in writing, or where due to the severity of the personal data breach and the possible consequences that may ensue if the communication of a personal data breach to the data subject is not made immediately, such communication may be made through other means.

(2) The communication to the data subject referred to in sub-regulation (1) shall describe in clear and plain language the nature of the personal data breach and shall contain at least the information and measures referred to in regulation 30(3)(b), (c) and (d).

(3) The communication to the data subject referred to in sub-regulation (1) shall not be required if any of the following conditions are met:

(a) the controller has implemented appropriate technological and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;

(b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in sub-regulation (1) is no longer likely to materialise;

(c) it would involve a disproportionate effort:

Provided that in such a case, there shall be a public communication or a similar measure whereby the data subjects are informed in an equally effective manner.

(4) If the controller has not already communicated the personal data breach to the data subject, the Commissioner, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so, or may decide that any of the FOR THE PURPOSES OF THE PREVENTION, INVESTIGATION, DETECTION OR PROSECUTION OF CRIMINAL OFFENCES OR THE 586.08 EXECUTION OF CRIMINAL PENALTIES conditions referred to in sub-regulation (3) are met.

(5) The communication to the data subject referred to in sub-regulation (1) may be delayed, restricted or omitted subject to the conditions and on the grounds referred to in regulation 13(3).

(6) A record shall be kept of the date, time, and means of the communication to the data referred to in sub-regulation (1), and where applicable, the reason for making such communication to the data subject through other means pursuant to the proviso to the same sub-regulation.

(7) Where the controller decides that a communication to the data subject referred to in sub-regulation (1), is not required for any of the reasons mentioned in sub-regulation 3(a) to (c), the controller shall document the reasons for such decision.

(8) Where the communication to the data subject referred to in sub-regulation (1) has been delayed, restricted or omitted in accordance with sub-regulation (5), the controller shall document the reasons for such delay, restriction or omission.