Article 34 - communicating the breach to data subjects
Article 34 requires controllers to inform affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms - a higher threshold than Article 33. Three exceptions in Article 34(3): data rendered unintelligible (e.g. by encryption - the 'encryption safe harbor'); measures taken so the high risk is no longer likely; or disproportionate effort, requiring a public 'substitute notice' instead. Regulators can order communication under Article 34(4). Recital 86 lets law enforcement justify a delay.
Article 34 requires controllers to inform data subjects of a breach where it is likely to present a high risk to their rights and freedoms. This severity threshold is what distinguishes it from Article 33: a breach of names and business email addresses might be a 'risk' triggering Article 33 notification, but not a 'high risk' triggering Article 34, since many people share business emails openly. 'High' can be determined either via impact on a large number of data subjects or a large amount of damage to certain individuals (Recitals 75-76).
| Exception | Effect |
|---|---|
| Art 34(3)(a) - Data rendered unintelligible | Encryption safe harbor: if data is unintelligible to unauthorised persons (e.g. encrypted), no communication needed |
| Art 34(3)(b) - Subsequent measures | If the controller took steps so the high risk is no longer likely to materialise, no communication needed - rewards good incident response |
| Art 34(3)(c) - Disproportionate effort | Where individual communication is impractical (e.g. individuals unidentifiable), use a public 'substitute notice' (press release / website) instead |
By Article 34(4), regulators can order a controller to communicate - often after receiving the Article 33 notification, or after reviewing the Article 33(5) records and finding a case wrongly kept secret. Illustrative high-risk breaches: cyberattacks causing data exfiltration; ransomware encrypting non-backed-up data; hospital records unavailable for thirty hours due to a cyberattack; a marketing email disclosing all recipients' addresses to each other. Recital 86 notes that law enforcement interests (e.g. tipping off offenders or destroying evidence) may justify delaying communication.
Article 33 (regulator) triggers on a mere risk. Article 34 (data subjects) triggers only on a high risk. Same breach, two different thresholds.