Privacy at the bank, roles and rules to avoid derailments at the counter

The criminal front is not the only bulwark that should shelter citizens from 'data breaches'. On 25 May 2018, the EU Regulation 2016/ 679 better known as Gdpr came into force. With explicit reference to the hypothesis of a breach of or abusive access to databases, Article 55 of the Gdpr lays down the obligation for data controllers to notify any breach to the Privacy Authority, specifically when a database theft occurs or when ransomware or any other subject steals a set of personal data stored within the computerised archives of a company or other legal entity.

The timing

In this case, the timing of the notification to the authorities assumes a fundamental value: the GDPR, in fact, requires the data controller to notify breaches detected without undue delay and, if possible, within 72 hours from the moment of knowledge of the fact. It is obvious that in view of this, the data controller must equip itself with reporting mechanisms to be able to promptly detect such violations and possibly find appropriate solutions to remedy the 'leakage'.

Defensive gaps.

And it is precisely here that the system shows dangerous 'defensive' shortcomings. Roberto De Vita, a criminal lawyer and expert in digital and cybercrime, explains: "While the capacity for (technical and behavioural) defence against attacks from outside the organisation's perimeter has grown and is growing over time, this is not so true with respect to the risk of information compromise and leakage originating from within, from an employee or collaborator who has access privileges and diverts them for illegitimate and even illegal activities. There are numerous cases that demonstrate the weakness of preventive alerts and the timeliness of discovery, as well as a lack of willingness to immediately share with supervisory and judicial authorities'.

Reputational damage

"What holds us back," De Vita continues, "is sometimes the fear of reputational damage, others the fear of potential sanctions arising from organisational and management dysfunctions. But the macroscopic datum,' De Vita adds, 'concerns the structural lack of automated capillary monitoring of accesses to databases, which through algorithms is able to construct behavioural risk indices that would then allow the selective targeting of control on specific accesses and on specific employee conduct. This lack,' De Vita concludes, 'does not depend on particular technical complexities, but on a culpable underestimation of the risk, on a 'proprietary' idea of the data collected, and on a presumption of unquestionability of their internal use.

© REPRODUCTION RESERVED