A person who works for a union took home a draft newsletter to finish it. The thumb drive containing the draft and contact list has been lost. To whom, among others, this data breach should be reported?

The lost data includes a union's contact list, which implicitly reveals the trade union membership of the individuals. Under the General Data Protection Regulation (GDPR), trade union membership is classified as a 'special category of personal data' (Article 9). The unauthorized disclosure or loss of such sensitive data is considered likely to result in a high risk to the rights and freedoms of the data subjects. According to GDPR Article 34, when a personal data breach is likely to result in such a high risk, the controller (the union) must communicate the breach to the affected data subjects (the members on the contact list) without undue delay.

B. To the Union staff: This is an internal incident response procedure, not a formal external reporting obligation mandated by data protection law to protect the affected individuals.
C. To the police: Reporting to law enforcement is only necessary if a criminal act, such as theft, is suspected. The scenario describes the drive as "lost," which does not automatically imply a crime.

1. General Data Protection Regulation (EU) 2016/679, Article 34(1): "When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay."

2. General Data Protection Regulation (EU) 2016/679, Article 9(1): This article defines "special categories of personal data" and explicitly includes data revealing "...trade union membership...".

3. European Data Protection Board (EDPB), Guidelines 01/2021 on Examples regarding Data Breach Notification, Version 2.0 (14 January 2022): Page 15, Example 8 discusses the loss of an unencrypted USB stick containing employee data, including union affiliation. The EDPB concludes this constitutes a high risk, mandating notification to the data subjects under Article 34.

4. Article 29 Working Party, Guidelines on Personal data breach notification under Regulation 2016/679 (WP250rev.01), Section IV.B.2: This section details criteria for assessing risk, stating that a breach involving special categories of data, such as trade union membership, is a key factor indicating a likely high risk to individuals.