Blauw Research B.V. – Court Ruling (Netherlands, 2023)

In this decision, Blauw Research B.V., a market research agency (controller) had a processing agreement with NEBU B.V., a software provider (processor). On 10-11 March 2023, the processor suffered a cyber attack by which third parties gained unauthorized access to its servers and data was extracted. The processor informed the controller about it two days after the attack took place. The controller requested more information and the processor confirmed that data (passwords) had been stolen and personal data (stored in cloud databases and surveys) were leaked. After repeatedly requesting information, unsatisfied with the processor's replies, the controller brought the case to the Court of Rotterdam. During the proceeding, the controller explained that it considered that, based on the processing agreement, the processor must provide information regarding security incidents and data breaches at all times. It also argued that the information provided following the cyber attack was not sufficient to meet the requirements set out in the agreement. The processor objected to such claim. As a result, the controller claimed to order the processor to: # provide information about (i) the details of the cyber attack; (ii) how and with what methods the system was recovered after the attack; (iii) an overview of which customers' personal data were leaked; (iv) the perpetrators of the attack; (v) which preventive and reactive technical and organisational measures were taken; (vi) internal reporting within the organization of the processor about the cyber attack that has taken place; # in the future, within 4 hours after new information is available, transfer this information to the controller and send an update on the state of affairs twice a day (at 14:00 and 19:00); # appoint a forensic investigator to find out the root-cause analysis; and # provide all necessary assistance and to answer all controller's questions. In the event of non compliance, the controller claimed a penalty of €25,000 per day with a maximum of €500,000. The processor considered this amount as unreasonable. The preliminary relief judge upheld the claim, but in a watered-down form. The Court ruled that the processor must provide all the requested information in order to enable controller to investigate the cyber incident in a proper manner. With regards to the claim to inform the controller of new information within four hours the Court stated that this will only apply when (i) a new cyberattack occurs (ii) new information shows that personal data of controller were compromised or (iii) information about the perpetrators is known. In all other cases an update twice a day seemed exagerated and the Court held that a daily update at 18:00 would be sufficient. Concerning the appointment of an external forensic researcher the Court confirmed that within the framework of the instruction right of the controller, it can appoint an external researcher/auditor to check whether personal data is processed securely. Finally, the Court considered the amount of €25,000 per day was not unreasonable and added it to the judgement.