Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
Data on external media was misplaced and all the protocols to report it as lost were followed.
A few months after, the media was discovered. It never left the secure location.
Given that data was never lost, how should the case be filed respecting GDPR and DPO legislation?
Precedents I can reference would be of great help.
The Dutch DPO (Autoriteit Persoonsgegevens, AP) recently clarified that an accidental leak does not require reporting, if the data is leaked to a trustworthy party. In the Dutch case, data was sent to the government by accident. It was accepted that the government deleted the leaked data when informed, undoing the leak.
In your case, finding back the data also undid the leak - the question whether you need to trust an external party doesn't even exist.
The company believed that some external media was not there anymore, and found it months later exactly in the place where it belonged.
If I was bribed to give a copy of that data to someone, I'd take the media, copy it, sell it to the briber, and return the media where it belonged. Except in this case, everyone is up in arms because the media is gone missing, so I wait until everything goes quiet, and that's when I return the media, a few months later when nobody is watching anymore.
Conclusion: If the external media cannot be found, and then some months later it is found exactly where it belongs, then it is quite likely that it has been copied in between, so that should be treated as a breach.
On the other hand, if the media had been accidentally destroyed (like putting a CD into a broken CD reader can destroy it), that would not be a breach. You'd have to check the exact wording of the GDPR to see if such destruction needs to be reported, but it wouldn't really make sense.
The only solution I can foresee is contact all the relevant parties and discuss the situation openly. You can't make the event dissappear but you may be able to control its impact if you can provide evidence that the data was never misplaced.
