Information security incidents
Information security incidents are handled differently depending on whether they involve an IT incident or a personal data breach.
IT incidents
An IT incident is an unwanted and unplanned IT-related event that may affect the security of the organisation’s or society’s information management and may disrupt the organisation’s ability to carry out its operations.
Identification
An IT incident has occurred, for example, if information has been destroyed, lost in some other way or fallen into the wrong hands.
Examples of IT incidents include situations where:
- the integrity, availability or confidentiality of information identified as requiring additional protection has been affected
- information systems that process information identified as requiring additional protection have been unable to maintain their intended functionality
- the public authority’s ability to carry out its responsibilities has been affected
- there has been a serious impact on the security of information management for which the public authority is responsible, or on services that the public authority provides to another organisation.
Reporting
Anyone who discovers an IT incident is responsible for reporting it to the IT Helpdesk as soon as possible at ithelpdesk@bth.se.
The IT Helpdesk refers the incident to the IT Manager, system owner or system manager, as appropriate.
Further reporting
If there is a risk that the incident could have a serious impact on the security of information management for which the public authority is responsible, or on services that the public authority provides to another organisation, it must be reported to MSB.
MSB must be notified within six hours.
Documentation
If it is unlikely that the incident could have a serious impact on the security of information management, it should not be reported to MSB. However, a suspected incident must always be documented, including the reason why it was not reported to MSB.
The IT Manager documents the incident together with the relevant departments within BTH.
Handling
The IT Manager, system owner or system manager is responsible for handling the incident, including assessing it, reporting it externally and following up on measures taken to resolve the problem.
Call CERT-SE: +46 (0)10 240 40 40.
Personal data breaches
A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss or alteration of personal data. It may also lead to the unauthorised disclosure of or access to personal data.
Identification
A personal data breach has occurred, for example, if personal data relating to one or more data subjects has been destroyed, lost in some other way or fallen into the wrong hands.
Examples of personal data breaches include situations where:
- an unauthorised party has gained access to personal data, for example when personal data has been sent to recipients who should not have received it
- computers containing personal data have been lost or stolen
- someone has altered personal data without authorisation
- personal data is unavailable to someone who needs it, resulting in negative consequences for the data subjects.
Reporting
Anyone who discovers a personal data breach is responsible for reporting it to the Data Protection Officer as soon as possible at dataskyddsombud@bth.se.
Further reporting
If the personal data breach is likely to result in a risk to the data subjects, it will be reported to the Swedish Authority for Privacy Protection (IMY).
The breach must be reported to IMY within 72 hours of becoming aware of it.
Documentation
If a personal data breach is unlikely to result in a risk, it will not be reported to the Swedish Authority for Privacy Protection. However, a suspected breach must always be documented, including the reason why it was not reported to the Swedish Authority for Privacy Protection.
The Data Protection Officer documents the breach together with the relevant departments within BTH.
Handling
The Data Protection Officer and the relevant departments within BTH assess the likelihood and severity of the breach and the resulting risk to the rights and freedoms of the data subjects.
If the personal data breach is likely to result in a risk to the data subjects, the Data Protection Officer is responsible for ensuring that it is reported to IMY.
If a personal data breach is considered serious, BTH must also inform the affected data subjects without undue delay. This applies if the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.
The Data Protection Officer provides this information together with the relevant departments within BTH.
Report incidents
Report IT incidents as soon as possible to: ithelpdesk@bth.se
Report personal data breaches to: dataskyddsombud@bth.se