This incident and its continuing impact has proven a salutary lesson to many @HenryQ, but no small print relieves VM of its legal obligations to ensure User Data held on its servers are secure, and readily available – hence the reason they had to inform the ICO of this particular issue.
To directly quote the ICO on the Data Security aspect of UK GDPR governing organisations such as VM (comes under Article 32 - Security of Processing):
- A key principle of the UK GDPR is that you process personal data securely by means of ‘appropriate technical and organisational measures’ – this is the ‘security principle’.
- Your measures must ensure the ‘confidentiality, integrity and availability’ of your systems and services and the personal data you process within them.
- The measures must also enable you to restore access and availability to personal data in a timely manner in the event of a physical or technical incident.
- You also need to ensure that you have appropriate processes in place to test the effectiveness of your measures, and undertake any required improvements.
Unfortunately, a key element in this is the term: ‘timely manner’, which is imprecise and does not mandate a specific timescale. That is perhaps due to the potentially wide-ranging set of incidents, and their inherent complexities, that falls under this framework. I guess there has to be some flexibility owed to the impacted organisations, but I am surprised there is no insistence they provide an estimate of the timescale to complete the remedial action, within a set period of the incident occurring. As it currently stands, it is no better than simply mandating an: “As soon as possible”.
Despite this uncertainty wrt to timescales, I am still confident that the historical emails will be restored. We just don't know when... Hopefully we will have a better idea when Axel Wehrle provides his update 'early next week'.