Thanks to those who responded. I am reassured the general view is that it is OK, in principle, to tell the subject of a breach but not necessarily ICO.
As Adam has said, this may be difficult to square with a strict reading of GDPR, but those working in health, at least, will know that the current HSCIC notification guidance, on which ICO consulted, allows a slightly more relaxed interpretation - no doubt to avoid ICO having to handle thousands of very trivial events.
As a follow up then. If you do notify a subject, when not telling ICO, do you nevertheless tell subject of his right to lodge a complaint with ICO.
Strictly this is not one of the circumstances where Art 13 or 14 require this. If you INTEND to extend processing beyond what was notified to or known by the subject, you are required to do so (see e.g. Art 13(3)). Since a breach usually implies processing beyond what was notified to or known by the subject, should you not, under the transparency principle do the same even where it was not intentional?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
