white_paper_on_data_protection_in_india_171127_final_v2

In the US, personal data breaches are defined under sector-specific statutes or specific state
laws. Under HIPAA Privacy Rule 726 , a breach is, generally, an impermissible use or
disclosure that compromises the security or privacy of the protected health information. 727
Privacy Technical Assistance Center (PTAC), established by the US department of education
defines a data breach as any instance in which there is an unauthorized release or access of
PII or other information not suitable for public release. 728
Further, the California Security Breach Notification Act, 2016 defines a security breach as an
unauthorized acquisition of computerized data that compromises the security, confidentiality,
or integrity of personal information maintained by the entity. Good-faith acquisition of
personal information by an employee or agent of an entity for the purposes of the entity is not
a breach of the security of the system, provided that the personal information is not used or
subject to further unauthorized disclosure. 729
North Dakota Century Code, Chapter 51-30 Notice of Security Breach for Personal
Information defines a security breach as unauthorized acquisition of computerized data when
access to personal information has not been secured by encryption or by any other method or
technology that renders the electronic files, media, or data bases unreadable or unusable. 730
It is important to note that although worded differently, US sector specific laws and a
comprehensive privacy legislation like the EU GDPR, both recognise the cause and effect
relationship between a security incident and a breach that may hamper personal data.
(ii)
Data Breach Notifications
Data breach notification refers to the practice of alerting and informing stakeholders
including data subjects that a personal data breach has occurred. The nature of notification
required depends on the nature of data involved in the breach.
A breach can potentially have a range of significant adverse effects on individuals, which can
result in physical, material, or non-material damage. The EU GDPR explains that this can
include loss of control over their personal data, limitation of their rights, discrimination,
identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to
726 The HIPAA Privacy Rule establishes national standards to protect individuals‘ medical records and other
personal health information and applies to health plans, health care clearinghouses, and those health care
providers that conduct certain health care transactions electronically. The rule requires appropriate safeguards to
protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that
may be made of such information without patient authorization.
727 Office for Civil Rights (OCR), ‗Breach Notification Rule‘, US Department of Health & Human Services (26
July 2013), available at: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html, (last
accessed 20 November 2017).
728 Privacy Technical Assistance Center, ‗Data Breach Response Checklist‘ (September 2012), available at:
http://ptac.ed.gov/sites/default/files/checklist_data_breach_response_092012.pdf (last accessed 10 November
2017).
729 Section 1(d), California Security Breach Notification Act, 2016.
730 North Dakota Century Code, Chapter 51-30 Notice of Security Breach for Personal Information.
162