University of Silesia in Katowice

• Sending emails to multiple recipients without using the UDW ‘blind copy’ function. This applies in particular to sending emails to private addresses;
• Sending an email or paper correspondence containing personal data to the wrong recipient;
• Unauthorised – caused by error or intentional action – deletion of personal data without proper authorisation/request;
• Loss/theft/misplacement of media such as USB sticks, memory cards, portable drives, laptops, mobile phones on which personal data is stored, including the loss of paper documentation containing personal data;
• Disposal of documents containing personal data without permanent destruction (failure to use a shredder or secure bin);
• Disclosure of personal data to an unauthorised entity or person/lack of legal basis for disclosure;
• Lack of access to personal data (e.g. in IT systems, on hard drives, servers) through, for example, a ransomware attack, which involves a hacker encrypting drives in order to obtain a ransom;
• Intentional or accidental damage to the system, resulting in the loss of access to personal data.

If you suspect or discover a personal data breach in your environment, you should report it immediately, without undue delay.

Please remember that the University of Silesia in Katowice, as the data administrator, is obliged to report any data breach to the President of the Personal Data Protection Office no later than 72 hours after discovering the breach.

In the absence of an adequate and rapid response, a personal data breach may result in physical injury, material or non-material damage to individuals, such as loss of control over their personal data or restriction of rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, breach of confidentiality of personal data protected by professional secrecy, or any other significant economic or social damage.

REPORTS SHOULD BE MADE – PREFERABLY IN WRITING

• to the Data Protection Officer at the following e-mail address: dariusz.pawelczak@us.edu.pl or iod@us.edu.pl, tel. 32 359 24 36;
• or to the Data Protection Officer’s Team at the following e-mail address: aneta.landrat@us.edu.pl, tel. 32 359 24 33;
• Reports can also be made in person at the Data Protection Officer’s office at the following address: Katowice, ul. Bankowa 14, room no. 334, 2nd floor.

A report of a personal data breach should include:

• the date of the incident (optionally the time of the incident);
• description of the nature of the breach, detailed description of the incident;
• description of the circumstances of the incident;
• category and approximate number of persons concerned;
• contact details of the person reporting the breach (telephone number, e-mail address, USil unit).

• Only work on your own account in the IT system
  to which you have been granted access;
• Create strong passwords for systems consisting of at least several characters, including lowercase and uppercase letters, numbers and special characters. Do not use words that can be found in dictionaries to create passwords, do not use your personal data such as first names, surname, date of birth, etc.;
• Keep your passwords and IDs to yourself: do not share your passwords with anyone, do not write them down in a visible place, keep your IDs for accessing IT systems safe;
• Follow the clean screen, clean desk and clean printer rule:
  – do not save files on your computer desktop, keep only standard desktop icons;
  – lock your computer if you leave your workplace even for a moment (Windows key + L);
  – collect printouts and copies from printers/photocopiers immediately after printing/copying;
  – when you finish work, put documents away in lockable cabinets and desks;
• Protect media containing personal data from loss, theft or damage;
• Destroy media containing data that you no longer need – destroy paper documents in a shredder or put them in a ‘secure bin’;
• Be careful when discussing work matters – do not disclose
  information about work in public places (e.g. public transport, restaurants, telephone conversations in public places, etc.) or in private conversations. Maintain the good image of the University of Silesia;
• Lock your office when you leave it if no one else is there;
• Be careful when using online resources – email, websites, social media;
• Watch out for suspicious text messages;
• Protect your personal data by pseudonymising and anonymising it wherever possible.