War Room · Free pilot
The Breach
A Friday-night data breach, a 72-hour clock and eight decisions before Monday.
It is Friday, 21:15. You are the on-call lawyer at the outside firm that advises Aldermere Pharmacy Direct, an online pharmacy with about two hundred staff. Its general counsel has been in touch twice in a year, and tonight the chief executive has called you herself. Aldermere's IT lead noticed unusual downloads from a cloud storage folder at 19:50 and, an hour and a half later, found a message on a server demanding payment. Customer files may be involved. The company's head of IT, its chief executive and its general counsel are on the call. You must advise them through the weekend. The regulator's clock may already be running.
Who is on the call
- Naomi Falk, Chief executive
- Idris Quaye, General counsel
- Piotr Lenz, Head of IT
- Mara Voss, Head of communications
- A forensic investigator, Called in on Saturday
The rule in this exercise (the Marland Data Protection Act, invented)
You do not need any outside knowledge. This is the rule you must apply, and it is printed beside every step.
- A company that becomes aware of a personal-data breach must tell the regulator within 72 hours, unless the breach is unlikely to put people at risk.
- 'Aware' means reasonably certain that a breach has happened. A first alert that has not yet been checked is not awareness; confirmed evidence is.
- Where the risk to people is high, the company must also tell the affected people without undue delay, in plain language, saying what happened, what data and what they can do.
- A company that handles data for others (a processor) must tell its customer without undue delay.
- The company must keep a record of every breach, how it was assessed and what was decided.
- A first notification to the regulator may be incomplete if it says so, and may be updated in stages.
What can be lost
- Regulator's confidence: How well the company is placed with the authority that can fine it.
- Customers' trust: Whether the people whose data was taken are treated honestly and in time.
- Evidence and privilege: Whether the facts are preserved and legal advice stays protected.