The protection of personal data involves more than simply implementing technical security measures. It also requires clearly defining responsibilities, access rights and rules governing access to personal data.
One of the risks faced by Controllers is unauthorized access to personal data by employees. Such access may result from the intentional misuse of access rights, but also from inadvertent access to data that is not necessary for the performance of specific job duties.
Access to personal data must be limited to what is necessary for the performance of specific job-related tasks and must remain within the scope of the access rights granted and the instructions provided.
For example, if an employee has access to a database due to the nature of their job but uses it to check information about a friend, family member or another individual for personal reasons, such conduct falls outside the scope of their official authorization.
Unauthorized viewing, use, retrieval, copying or disclosure of personal data may constitute a violation of personal data protection rules and, depending on the specific circumstances, may result in disciplinary or other liability for the employee.
The fact that unauthorized access was carried out by an employee does not automatically exclude the Controller’s responsibility.
The Controller is required to implement appropriate technical and organisational measures to ensure the lawful and secure processing of personal data.
Among other things, this includes:
- Clearly defining the rules and conditions governing access to personal data;
- Assigning user access rights in accordance with employees’ job responsibilities;
- Restricting access strictly to the data necessary for the performance of work-related duties;
- Regularly educating and informing employees about their obligations;
- Monitoring and reviewing access activities to ensure the timely detection of potential misuse.
Therefore, whenever such an incident occurs, it is not sufficient to establish only who accessed the data. It is also necessary to assess whether the Controller had implemented appropriate measures to prevent and promptly detect unauthorized access.
Where the Controller has established appropriate policies, access restrictions, technical safeguards and monitoring mechanisms, but the employee has deliberately circumvented them, the employee’s conduct may be assessed separately from the question of whether the Controller has fulfilled its legal obligations.
Conversely, where access rights are excessively broad, clear internal rules are lacking, employees have not received adequate training or appropriate security controls are missing, questions may arise regarding the Controller’s own compliance with its obligations.
Not every instance of unauthorized access automatically gives rise to the same legal consequences. The assessment depends on the specific circumstances of each case, particularly the type and volume of personal data accessed, the purpose and duration of the access, whether the data was downloaded or disclosed, and the potential risks to the rights and freedoms of the individuals concerned.
Accordingly, once such an incident is identified, the Controller should promptly investigate the circumstances, document the incident and assess whether it constitutes a personal data breach, as well as whether any additional obligations arise under the applicable regulatory framework.
Effective protection against unauthorized access requires more than simply assigning user access rights. It involves the continuous review of access privileges, the implementation of appropriate technical safeguards, clear internal procedures and regular employee training.
The key takeaway is that responsibility for unauthorized access cannot automatically be attributed solely to the employee. Each individual case requires an assessment of both the employee’s conduct and the measures, controls and processing arrangements established by the Controller.
Personal data protection begins with proper access management and is sustained through continuous monitoring, responsible conduct and awareness among all individuals involved in the processing of personal data.