Data Breach Response and Notification Procedure

1. Purpose, scope, and users

This Procedure provides general principles and an approach model to respond to and mitigate breaches of any type of personal data (a “personal data breach”) in one or both of the following circumstances:

• The personal data identifies data subjects who are residents of the Member States of the European Union (EU) and countries in the European Economic Area (EEA), regardless of where that data is subject to processing globally and
• The personal data is subject to processing in the EU and/or EEA, regardless of the country of residency of the data subject.

This procedure is also applicable to any other type of security incident.

The Procedure lays out the general principles and actions for successfully managing the response to a data breach as well as fulfilling the obligations surrounding the notification to Supervisory Authorities and individuals as required by the EU GDPR.

All employees, contractors, temporary employees, and third parties working for or acting on behalf of Resolver Inc. (“Company”) must be aware of and follow this procedure in case of a personal data breach, security weakness, or an incident.

2. Reference documents

• Personal Information Protection and Electronic Documents Act (Canada) (PIPEDA) and similar Provincial legislation
• EU GDPR 2016/679 (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC)
• ISO/IEC 27001:2013 standard, controls A.7.2.3, A.16.1.1, A.16.1.2, A.16.1.3, A.16.1.4, A.16.1.5, A.16.1.6, A.16.1.7
• ISO/IEC 27701:2019 standard, clause 6.13
• Information Security Policy
• Health Insurance Portability and Accountability Act of 1996 (HIPAA)

3. Definitions

The following definitions of terms used in this document are drawn from Article 4 of the European Union’s General Data Protection Regulation (GDPR):

• “Personal Data” means Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person Regulation.
• Protected Health Information (PHI). Protected health information means individually identifiable health information that is transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium.
• Unsecured Protected Health Information (Unsecured PHI). Unsecured PHI means any PHI that is not unusable, unreadable, or indecipherable to unauthorized persons due to technology or methodology, such as encryption or destruction, as specified by the HHS Secretary.
• “Controller” is the natural or legal person, public authority, agency, or any other body that, alone or jointly with others, determines the purposes and means of processing personal data.
• “Processor” is a natural or legal person, public authority, agency, or any other body that processes personal data on behalf of a Data Controller.
• “Processing” means any operation or set of operations which is performed on personal data or sets of personal data, whether by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unintentional acquisition, unauthorized disclosure of, or access to, any personal data; transmitted, stored, or otherwise processed.
• “Supervisory Authority” means an independent public authority established by applicable legislation (e.g. a Member State pursuant to Article 51 of the GDPR).
• For more information about PIPEDA rules and definitions, please refer to What you need to know about mandatory reporting of breaches of security safeguards – Office of the Privacy Commissioner of Canada
• For more detailed information about HIPPA rules and definitions, please refer to https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
• For more detailed information about GDPR rules and definitions, please refer to https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

4. Data Breach Response Team

A Data Breach Response Team must be a multi-disciplinary team comprised of knowledgeable and skilled individuals from the IT Department, IT Security, Legal, Legal and Public Affairs. The team may be a physical (local) or virtual (multiple locations) team that responds to any suspected/alleged data breach, security weakness, or a security incident (further in text collectively referred to as “data breach”).

Chief Information Security Officer (CISO) appoints the Data Breach Response Team members. The Team must be appointed regardless of whether or not a breach has occurred.

The team must ensure that necessary readiness for a data breach response exists, along with the needed resources and preparation such as call lists, the substitution of key roles, desktop exercises, plus a required review of company policies, procedures, and practices.

The team’s mission is to provide an immediate, effective, and skillful response to any suspected/alleged data breaches affecting the Company.

If required, the team members may also involve external parties (e.g., an information security vendor) for digital forensics tasks or an external communications agency to assist the Company in crisis communications needs.

The Data Breach Response Team Leader (CISO) can choose to add additional personnel to the team to deal with a specific data breach.

The Data Breach Response Team may deal with more than one suspected/alleged or actual data breach at a time. Although the core team may be the same for each suspected/alleged or actual data breach, this is not required.

The Data Breach Response Team must be prepared to respond to a suspected/alleged or actual data breach 24/7, year-round. Therefore, the contact details for each member of the Data Breach Response Team, including personal contact details, shall be stored in a central location and shall be used to assemble the team whenever notification of a suspected/alleged or actual data breach is received.

5. Data Breach Response Team duties

Once a data breach is reported to the Data Breach Response team leader, the team must implement the following:

• Validate/triage the data breach.
• Ensure proper and impartial investigation (including digital forensics if necessary) is initiated, conducted, documented, and concluded.
• Identify remediation requirements and track resolution.
• Report findings to the top management.
• Coordinate with appropriate authorities as needed.
• Coordinate internal and external communications.
• Ensure that impacted data subjects are properly notified, if necessary.
• Analyze each incident recorded in the Data Breach Register and, if necessary, suggest preventive or corrective action.

The Data Breach Response Team will convene for each reported (and alleged) data breach and will be headed by the Data Breach Response Team Leader.

6. Special HIPAA compliance notification considerations

6.1. Notification: Individuals Affected.

If it is determined that breach notification must be sent to affected parties, the Company’s standard breach notification letter (as modified for the specific breach) will be sent out to all affected individuals.  Notice to affected parties shall be written in plain language and must contain the following information, which elements are included in the Company’s standard breach notification letter:

• A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known.
• A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved).
• Individuals should take any steps to protect themselves from potential harm resulting from the breach.
• A brief description of what the Company is doing to investigate the breach, mitigate harm to individuals, and protect against further breaches.
• Contact procedures for individuals to ask questions or learn additional information, including a toll-free telephone number, email address, website, or postal address.

Notice to affected parties shall be made without unreasonable delay and in no case later than 60 calendar days after the discovery of the breach.

Since GDPR requirements are more restrictive and require notification within 72 hours, Resolver will be following the GDPR requirement.

If the Company determines that notification requires urgency because of possible imminent misuse of unsecured PHI, a notification may be provided by telephone or other means, as appropriate, in addition to the methods noted above. It is the responsibility of the Company to demonstrate that all notifications were made as required, including evidence demonstrating the necessity of any delay.

6.2. Delay of Notification Authorized for Law Enforcement Purposes.

If a law enforcement official states to the Company or a business associate that a notification, notice, or posting would impede a criminal investigation or cause damage to national security, the Company shall:

• If the statement is in writing and specifies the time for which a delay is required, delay such notification, notice, or posting for the time period specified by the official or
• If the statement is made orally, document the statement, including the identity of the official making the statement, and delay the notification, notice, or posting temporarily and no longer than 30 days from the date of the oral statement unless a written statement as described above is submitted during that time.

7. Data breach response process

The Data Breach Response Process is initiated when anyone notices that a suspected/alleged or actual data breach occurs, and any Data Breach Response team member is notified. The team is responsible for determining if the breach should be considered a breach affecting personal data.

The Data Breach Team leader is responsible for documenting all decisions of the core team. Since the supervisory authorities might review these documents, they need to be written precisely and thoroughly to ensure traceability and accountability.

8. Personal data breach notification: Data processor to the data controller

When the personal data breach or suspected data breach affects personal data that is being processed on behalf of a third party, the Data Protection Officer of the Company acting as a data processor must report any personal data breach to the respective data controller/controllers without undue delay.

The Data Protection Officer will send a notification to the controller that will include the following:

• A description of the nature of the breach.
• Categories of personal data affected.
• An approximate number of data subjects were affected.
• Name and contact details of the Data Breach Response Team Leader/ Data Protection Officer.
• Consequences of the personal data breach.
• Measures are taken to address the personal data breach.
• Any information relating to the data breach.

The Information Security Analyst will record the data breach into the Data Breach Register.

9. Personal data breach notification: Data controller to the supervisory authority

When the personal data breach or suspected data breach affects personal data that is being processed by the Company as a data controller, the following actions are performed by the Data Protection Officer (DPO):

1. The Company must establish whether the personal data breach should be reported to the Supervisory Authority.
2. In order to establish the risk to the rights and freedoms of the data subject affected, the Data Protection Officer must perform the Data Protection Impact Assessment on the processing activity affected by the data breach.
3. No notification is required if the personal data breach is not likely to risk the rights and freedoms of the affected data subjects. However, the data breach should be recorded in the Data Breach Register.
4. The Supervisory Authority must be notified with undue delay but no later than 72 hours if the personal data breach is likely to risk the rights and freedoms of the data subjects affected by the personal data breach. Any possible reasons for delay beyond 72 hours must be communicated to the Supervisory Authority.

CISO will send Notifications to the Supervisory Authority that will include the following:

• A description of the nature of the breach.
• Categories of personal data affected.
• The approximate number of data subjects affected.
• Name and contact details of the Data Breach Response Team Leader/ Data Protection Officer.
• Consequences of the personal data breach.
• Measures are taken to address the personal data breach.
• Any information relating to the data breach.

10. Personal data breach notification: Data controller to the data subject

CISO must assess if the personal data breach will likely result in a high risk to the rights and freedoms of the data subject. If yes, the Data Protection Officer of the Company must notify with undue delay the affected data subjects.

The Notification to the data subjects must be written in clear and plain language and must contain the same information listed in Section 7.

If, due to the number of affected data subjects, it is disproportionately difficult to notify each affected data subject, the CISO must take the necessary measures to ensure that the affected data subjects are notified by using appropriate, publicly available channels.

11. Accountability

Any individual who breaches this Procedure may be subject to internal disciplinary action (up to and including termination of their employment), and may also face civil or criminal liability if their action violates the law.

12. Managing records kept based on this document

13. Validity and document management

This document is valid as of August 2023.

The owner of this document is an Information Security Analyst who must check and, if necessary, update the document at least once a year.

When evaluating the effectiveness and adequacy of this document, the following criteria need to be considered:

• The number and significance of incidents arising from suppliers’ and partners’ activities.
• The number of contracts where the contract owner is not defined.

EFFECTIVE ON: August 2023

REVIEW CYCLE: Annual at least and as needed