Integrity Data Breaches: What they are and how to manage them

In today’s digital age, the frequency and severity of data breaches continue to rise, and they are a growing concern for businesses of all sizes. The number of data breaches reported to Supervisory Authorities (SA) – meaning that they have been assessed as posing a risk to the rights and freedoms of the individuals concerned – increases every year, as highlighted in the SA’s annual reports. For example, the Data Protection Commission (DPC), the Information Commissioner’s Office (ICO), and the Spanish Data Protection Agency, all reported increases of 20%, 28% and 15% respectively, in their latest annual reports, compared to the year before.  

Confidentiality and Availability data breaches, as categorised in Opinion 03/2014 on Personal Data Breach Notification of the Article 29 Data Protection Party, are most commonly encountered and reported in most organisations. With such breaches, unauthorised individuals gain access to sensitive data and/or there is an accidental or malicious unauthorised loss of access to, or destruction of, personal data.  However, another critical category of data breaches, is the Integrity breach, where an unauthorised or accidental alteration of personal data occurs. In Ireland, integrity breaches concerning unintentional alteration of personal data, represented 8.99% of the total breaches reported to the DPC in 2023, as highlighted in their annual report.  

This article aims to provide clarity around integrity data breaches, inform the reader of the associated risks, and explain how to prevent and manage this type of data breach.

What is an Integrity Data Breach?

Article 5(1)(d) of the General Data Protection Regulation (GDPR) places the obligation on Data controllers to ensure that the personal data they process is “accurate and, where necessary, kept up to date”.  The unauthorised alteration of personal data, either intentionally or unintentionally, in a way that compromises its accuracy, completeness, or authenticity, represents an integrity data breach. Such alterations can be a consequence of:  

• Human errors – accidental alterations such as incorrect data entry or unintentional data modification 

• Software issues – unintended changes or corruption of data, as a result of bugs in software updates or patches 

• Cyberattacks – malicious tampering with personal data for fraudulent purposes 

• Improper data synchronisation – when systems are not synchronised appropriately, discrepancies in data can lead to integrity issues across platforms

Potential consequences of Integrity Data Breaches for Organisations

The unauthorised alteration of data can pose severe risks and can have significant consequences for organisations, such as: 

1. Regulatory Fines: An organisation’s failure to comply with Article 5 (1)(d) of GDPR – that is, to ensure that personal data it processes is accurate and up to date, can lead to penalties or fines.
   
2. Operational Disruptions: Accurate data is critical for the appropriate functioning of organisations. Business operations can be significantly disrupted if data is incorrect, incomplete or inconsistent. In many industries, such as healthcare and finance, data integrity issues can lead to operational and service delivery inefficiencies, which can disrupt processes and damage relationships with stakeholders and clients. Furthermore, the breach investigation and implementation of mitigating actions following an integrity data breach can take a long time, depending on severity. In some cases, operations may need to be paused during the investigation, which can lead to loss of revenue.
   
3. Reputation Damage and Loss of Business: Partners and consumers trust businesses to handle their personal data with integrity. The reputational damage caused by data breaches can be long lasting and can impact an organisation’s ability to gain future investment, to obtain new customers and retain existing ones. In the healthcare industry, for instance, an integrity data breach can lead to severe consequences for data subjects and, as a result, the organisation’s reputation would be greatly challenged.
   
4. Legal Liabilities: Integrity data breaches may also expose organisations to lawsuits or legal action, where the alteration of data causes harm to individuals. 

A well-known example of an integrity data breach occurred in the UK in 2020 within the NHS Test and Trace system during the COVID-19 pandemic. This case highlights the risks, impact and consequences such incidents can have, where a data processing error led to the failure to report more than 15,000 positive COVID-19 test results. This breach delayed critical contact-tracing efforts and had public health implications, as infected individuals and their contacts were not promptly informed. The incident demonstrates how data processing errors can compromise the integrity of data, damage the reputation of the organisation involved, and lead to serious consequences for public health and operational efficiency.

How to Prevent Integrity Breaches

Given the risks associated with integrity breaches, organisations must take proactive steps to prevent them and have appropriate technical and organisational measures in place.  

Examples of prevention measures include: 

1. Employee training is a crucial step in preventing data integrity breaches. Staff should be educated on data protection principles, the importance of data accuracy, and the potential consequences of accidental alterations of personal data. The delivery of regular and effective staff training and awareness is an essential component of an effective data protection programme in general, and incident management frameworks in particular. 
   
2. A robust data governance framework, which includes clear guidelines and policies on data accuracy and data management throughout the organisation. This is essential for ensuring reliability and integrity of data and for preventing unauthorised or accidental alterations to data. 
3. Regular data quality checks and data validation can help identify potential inconsistencies or errors in datasets and environments before they lead to integrity breaches.  
4. Regular security audits should be conducted to identify vulnerabilities in data management systems. These audits should assess whether systems are secure against tampering or alteration that could impact data integrity and quality. 
5. Access controls should be put in place to ensure that personal data alterations are restricted to authorised personnel only. 

How to Manage Integrity Breaches

 The GDPR requires Data Controllers to be able to identify data breaches promptly, determine the likelihood and severity of risk and adverse effects, and to determine whether notification obligations arise. The European Data Protection Board (EDPB) Personal Data Breach Notification guidelines specify that in addition to, and separate from, the notification and communication of breaches under the GDPR, integrity breaches may also trigger obligations under other regulations, such as the eIDAS Regulation (EU 910/2014), which governs electronic identification and trust services in the EU. Article 19(2) of the eIDAS Regulation requires trust service providers to notify their supervisory authority of any breach of security or loss of integrity that impacts the services provided or personal data maintained.  

Organisations should implement appropriate technical and organisational measures to ensure compliance.  Such measures include the implementation of a robust data breach policy, procedure and risk assessment methodology.  

Trilateral’s Data Protection and Cyber Risk Team have data protection specialists with extensive expertise and experience in managing data breaches and assisting organisations in building robust frameworks, policies, procedures and training to ensure prevention of data breaches.

If you’d like to know more about how our data protection experts can support your organisation, check out the specialist services we provide. Please feel free to contact our advisors who would be more than happy to help.