Understanding the Risk
Your interaction with a supervisory authority doesn't end with your final response. Under GDPR Article 82, every data subject whose personal data you've mishandled can pursue damages. This right exists independently of regulatory enforcement.
Class actions often follow regulatory investigations. Your responses to regulators become discovery material in litigation. Every statement, timeline, and control gap you acknowledge can reappear in plaintiff filings later.
This isn't just a theoretical risk. There's been a notable increase in civil claims following regulatory investigations. The pattern is clear: an investigation begins, the company cooperates, findings are issued, and then class actions are filed citing the same facts.
You're now defending two cases simultaneously, each with different rules and exposure profiles.
Preparing Before the Investigation
Before your next interaction with a supervisory authority, ensure you have these components ready:
Legal Privilege Framework
Establish attorney-client privilege over your internal breach investigation before sharing findings with regulators. Draft your incident timeline and remediation plan under legal counsel's direction. Mark all documents as privileged work product. You can selectively waive privilege for disclosures without exposing your entire file to civil discovery, but only if you've documented privilege from the start.
Dual-Track Response Team
Designate separate contacts for regulatory and litigation defense. Your DPO should handle communication with the supervisory authority, while outside litigation counsel reviews every regulatory submission to avoid statements that could create civil liability.
Notification Language Library
Pre-draft your Article 34 data subject notifications with litigation exposure in mind. Avoid speculative language about "potential" harm. Only quantify affected records if verified. Never characterize the breach severity in absolutes.
Breach Register with Litigation Flags
Extend your Article 33 breach register to flag high-litigation-risk incidents: breaches involving special category data under Article 9, incidents affecting children, missed notification windows, and any breach under formal investigation.
Implementing a Dual-Track Process
Step 1: Segregate Your Investigation
Immediately place breach investigations under legal counsel's supervision. Draft internal reports as privileged work product. Create two documents: a privileged internal analysis and a separate regulatory notification with only the facts required under Article 33.
Step 2: Script Your Supervisory Authority Responses
Treat each response to the supervisory authority as a litigation filing. Have outside counsel review submissions. Avoid conditional language and admitting violations of specific GDPR articles. Provide facts, not legal admissions.
Step 3: Coordinate Your Article 34 Notifications
Align your notifications with regulatory requirements and litigation defense. State facts without editorializing. Provide concrete protective steps without promising outcomes you can't guarantee.
Step 4: Document Your Article 32 Remediation
Document specific Technical and Organisational Measures deployed after a breach. This log shows accountability to the supervisory authority and mitigates damages in civil litigation.
Step 5: Prepare for Follow-On Discovery
Expect plaintiff firms to file within 90 days after an investigation closes. Preserve all documents related to the breach and investigation. Place these materials under a litigation hold immediately.
Validating Your Process
Test your dual-track process with a tabletop exercise simulating a breach. Draft your regulatory notification and have litigation counsel review it for statements that could strengthen a plaintiff's claim. Review past interactions for admissions you wouldn't want in court.
Ongoing Maintenance
Monthly: Review Breach Register
Flag any notifications involving special category data, children's data, or supervisory authority follow-up. Assign litigation counsel to monitor these cases for 18 months.
Quarterly: Update Notification Templates
Adjust your Article 34 notification language as case law develops around Article 82 damages.
After Every Supervisory Authority Interaction: Conduct Litigation Exposure Review
Have outside counsel review all submissions for statements that create civil liability. Document any admissions and assess their defensibility in litigation.
Annually: Train Your Incident Response Team
Ensure your technical responders understand that their reports will be read by plaintiff attorneys. Train them to document facts without legal conclusions and verify counts before reporting.
The supervisory authority investigation is your first case. The class action is your second. Defend both from day one.
