Under the General Data Protection Regulation (GDPR), which of the following situations would LEAST likely require a controller to notify a data subject?

Under GDPR Article 34, a controller must notify data subjects of a breach if it is "likely to result in a high risk to the rights and freedoms of natural persons." However, Article 34(3)(a) provides a specific exemption if the controller has implemented measures that "render the personal data unintelligible to any person who is not authorised to access it, such as encryption." The theft of a properly encrypted USB key means the data remains confidential and inaccessible. Assuming the encryption is state-of-the-art and the decryption key has not been compromised, the risk to data subjects is low. Therefore, this situation is the least likely to require notification to the data subjects.

B. A direct marketing email is sent with recipients visible in the ‘cc’ field This is a confidentiality breach exposing personal data (email addresses) to unauthorized third parties, creating a risk of spam or phishing that likely requires notification.
C. Personal data of a group of individuals is erroneously sent to the wrong mailing list This is an uncontrolled disclosure of personal data to an incorrect audience, which constitutes a clear confidentiality breach and presents a risk requiring notification.
D. A hacker publishes usernames, phone numbers and purchase history online after a cyber-attack This is a severe breach where sensitive data is made public. It presents a high risk of identity theft, fraud, and other harms, making notification mandatory.

1. General Data Protection Regulation (EU) 2016/679.

Article 34(1): "When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons

the controller shall communicate the personal data breach to the data subject without undue delay."

Article 34(3)(a): States that the communication to the data subject referred to in paragraph 1 shall not be required if "the controller has implemented appropriate technical and organisational protection measures

and those measures were applied to the personal data affected by the personal data breach

in particular those that render the personal data unintelligible to any person who is not authorised to access it

such as encryption."

2. European Data Protection Board (formerly Article 29 Working Party)

Guidelines on Personal data breach notification under Regulation 2016/679 (WP250rev.01)

adopted on 3 October 2017

as last Revised and Adopted on 6 February 2018.

Page 13

Section III.B: "If the controller has implemented appropriate technological protection measures

such as encryption

that render the data unintelligible to any person not authorized to access it

notification to the data subject is not required."

Page 22

Annex B

Example 2: Describes a scenario where a hospital employee's encrypted USB stick is stolen. It concludes: "As the data on the USB stick was encrypted using a state-of-the-art algorithm

the hospital determines that the data is unintelligible and therefore there is no likely high risk to patients. The hospital does not need to notify the patients."