Breach of Confidentiality and Personal Data Breaches

Breach of Confidentiality and Personal Data Breaches (CIPT: Data Collection, Use, Dissemination and Destruction)

Overview
In the IAPP CIPT (Certified Information Privacy Technologist) body of knowledge, breach of confidentiality and personal data breaches sit within the domain covering the data life cycle: collection, use, dissemination and destruction. They show what goes wrong when personal information escapes its intended boundaries. The CIPT treats them both as a privacy harm (drawing on Daniel Solove's Taxonomy of Privacy) and as a technical and operational event that technologists must prevent, detect and respond to.

Why It Is Important
1. Legal exposure: Many laws require breach notification. Examples include GDPR Articles 33 and 34, US state breach notification laws, HIPAA's Breach Notification Rule, Canada's PIPEDA, and Australia's Notifiable Data Breaches scheme. Missing a deadline can bring fines that are separate from the breach itself.
2. Trust and reputation: Breaking a promise of confidentiality damages the relationship between an organization and its customers, patients or employees.
3. Harm to individuals: Breaches can lead to identity theft, financial loss, discrimination, embarrassment, physical danger or emotional distress.
4. Technologist responsibility: The CIPT expects you to build controls such as encryption, access control, logging, data minimization and secure destruction. Good controls make breaches less likely and less harmful.
5. Privacy by Design: Considering confidentiality early in the life cycle is central to Privacy by Design and Privacy by Default.

What It Is
Breach of Confidentiality (Solove's Taxonomy):

• Solove places it under Information Dissemination, alongside disclosure, exposure, increased accessibility, blackmail, appropriation and distortion.
• It means breaking a promise to keep a person's information confidential.
• The harm comes from betraying trust within a relationship, such as doctor and patient, lawyer and client, bank and customer, or employer and employee.
• The information does not have to be embarrassing or false. The harm lies in the violated duty of trust.

How it differs from Disclosure:

• Disclosure is revealing truthful information that changes how others judge a person, damaging their reputation. Its focus is the information's effect on the person's image.
• Breach of confidentiality focuses on the relationship and the broken trust, whatever the content of the information.
• The same act can be both. For example, a therapist revealing a patient's mental health diagnosis to the patient's employer breaches confidentiality (a trusted relationship) and is also a disclosure (reputational effect).

Personal Data Breach (regulatory definition):

• GDPR Article 4(12) defines it as: "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed."
• Breaches are commonly grouped into three types, based on the CIA triad:
• Confidentiality breach: unauthorized or accidental disclosure of, or access to, personal data. Example: an email sent to the wrong recipient.
• Integrity breach: unauthorized or accidental alteration of personal data. Example: an attacker modifies payroll records.
• Availability breach: accidental or unauthorized loss of access to, or destruction of, personal data. Example: ransomware encrypts patient records with no backup.

Security incident vs. breach:

• A security incident is any event that threatens the confidentiality, integrity or availability of information.
• A breach is an incident that actually compromises personal data.
• Not every incident is a breach. Not every breach must be reported.

How It Works: Causes, Controls and Response
Common causes:

• External attacks: phishing, malware, ransomware, SQL injection, credential stuffing.
• Insider threats, both malicious and negligent: employees snooping on records, or misdirected emails and faxes.
• Lost or stolen devices: laptops, USB drives, backup tapes.
• Misconfiguration: publicly exposed cloud storage buckets, open databases.
• Third-party and vendor failures: processors and supply chain.
• Improper disposal: unshredded paper, drives that were never wiped.
• Social engineering and pretexting.

Preventive and detective technical controls:

• Encryption at rest and in transit. Under many laws, properly encrypted data with an uncompromised key is a safe harbor from notification.
• Access controls: least privilege, role-based access control (RBAC), multi-factor authentication.
• Data minimization and retention limits. Data you do not hold cannot be breached.
• Pseudonymization, tokenization, masking and de-identification.
• Data Loss Prevention (DLP) tools, Security Information and Event Management (SIEM) systems, intrusion detection, and audit logging.
• Secure destruction: degaussing, cryptographic erasure, shredding, following NIST SP 800-88.
• Vendor management: contractual clauses, audits, and breach notification obligations placed on processors.
• Training and awareness to reduce human error.

Incident response life cycle (based on NIST SP 800-61, commonly used in IAPP materials):

1. Preparation: incident response plan, team roles, playbooks, tabletop exercises.
2. Detection and analysis: identify the event, determine scope, classify it, and assess whether personal data is involved.
3. Containment: isolate affected systems, revoke credentials, stop the leak.
4. Eradication and recovery: remove the threat, restore from clean backups, patch.
5. Notification: regulators, individuals, law enforcement, partners and others as required.
6. Post-incident review: lessons learned, root cause analysis, control improvements.

Key notification rules to remember:

• GDPR Art. 33: the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals.
• GDPR Art. 28 and 33(2): the processor notifies the controller without undue delay.
• GDPR Art. 34: the controller notifies data subjects without undue delay when there is a high risk. This is not required if the data was encrypted, if subsequent measures removed the high risk, or if individual notice would involve disproportionate effort (a public communication is used instead).
• GDPR Art. 33(5): all breaches must be documented internally, even ones that are not reported.
• HIPAA: notify individuals without unreasonable delay and no later than 60 days after discovery. Notify HHS (immediately if 500 or more people are affected, otherwise annually). Notify media if more than 500 residents of one state are affected.
• US states: all 50 states have breach notification laws. Definitions of personal information, timelines (often 30 to 60 days or "most expedient time possible"), harm thresholds and encryption safe harbors vary.
• Content of a notice: nature of the breach, categories and approximate numbers of people and records, contact point (such as the DPO), likely consequences, and the measures taken or proposed.

Risk assessment factors:
Type and sensitivity of the data, volume, ease of identifying individuals, severity of consequences, vulnerable individuals (such as children), whether the data was encrypted, and who received it (a trusted party versus a criminal).

Exam Tips: Answering Questions on Breach of Confidentiality and Personal Data Breaches
1. Look for a trusted relationship. If a scenario involves a professional or fiduciary relationship and the provider shares information, think breach of confidentiality. If the focus is embarrassment or how others now view the person, think disclosure. If the content is graphic or intimate, such as nudity or bodily functions, think exposure.
2. Know Solove's four groups. They are Information Collection, Information Processing, Information Dissemination and Invasion. Breach of confidentiality belongs to Dissemination. Distractors often place it under Processing or Invasion.
3. Map breaches to the CIA triad. Wrong recipient or exposure points to confidentiality. Tampering points to integrity. Ransomware or deletion points to availability. Remember that ransomware can also involve confidentiality if data was exfiltrated.
4. Memorize timelines precisely. GDPR is 72 hours to the authority, measured from when the controller becomes aware. HIPAA is 60 days maximum. Watch for distractors such as "72 hours to individuals" or "72 business days."
5. Remember the encryption safe harbor. Strongly encrypted data with an uncompromised key usually removes the duty to notify individuals. If the key was also stolen, the safe harbor does not apply.
6. Containment comes first. When asked what to do first after discovering a breach, the best answer is usually to contain the breach and activate the incident response plan, not to notify the media or fire staff. Preparation, meaning having a plan, is the best proactive answer.
7. Separate controller and processor duties. Processors notify controllers. Controllers notify regulators and individuals.
8. Prefer the technologist's preventive answer. CIPT questions often ask which control best reduces breach risk or impact. Strong answers include data minimization, encryption, least-privilege access, retention schedules and secure deletion. Choose the option that removes or protects the data rather than relying on policy alone.
9. Watch for "not every incident is a breach." An attempted attack that was blocked and touched no personal data is an incident, not a reportable breach.
10. Documentation is always required under GDPR. Even when notification is not needed, the record-keeping requirement in Art. 33(5) applies.
11. Read the scenario carefully. Identify the jurisdiction, the data type (health, financial or children's data raises the risk), the number of people affected, whether encryption was used, and who discovered the breach. These details decide the correct answer.
12. Eliminate absolute answers. Options with "always notify," "never notify" or "immediately notify the public" are usually wrong. Notification is risk-based.

Quick Example Question
A hospital nurse tells a patient's neighbor about the patient's HIV status. Which privacy harm in Solove's taxonomy BEST describes this?
A. Exposure
B. Breach of Confidentiality
C. Aggregation
D. Intrusion
Answer: B. A trusted provider-patient relationship was betrayed. Disclosure could also apply, but the emphasis on the relationship makes breach of confidentiality the best answer.

Summary
Breach of confidentiality is a privacy harm based on betrayed trust. A personal data breach is a security failure that compromises the confidentiality, integrity or availability of personal data. As a CIPT, you are expected to prevent both through privacy-enhancing technical controls, detect them quickly, respond through a structured incident response plan, and meet notification obligations accurately. On the exam, focus on precise definitions, notification timelines, the encryption safe harbor, controller and processor roles, and choosing the most preventive, risk-based answer.