GDPR: Remember GDPR? That thing that came into effect on 25th May and was responsible for the influx of consent emails to your inbox, as well as a whole host of existential memes? Well it’s still here, and here to stay. More to the point, it is important. Data Protection permeates everything you do, because you are inevitably always sharing personal data, right from the moment you’ve told someone your name. The purpose of this Blog is for the Data Protection Officer (that’s me) to share with you some of the latest GDPR news and best practice, distilling ICO guidance from legalese to plain English. So if you’re unsure of the effect of GDPR on research, or how the new legislation affects data storage in the Cloud, or whether you can share special category or criminal conviction data, among other things, then watch this space!
PROJECTS: The one thing we can be sure about is that change in some form or another is a constant in all of our lives. In a professional sense this is usually managing the introduction of new products and/or services, introducing new processes or refining existing processes via a project or change programme. This can be managed using a range of approaches including formal project management methodologies, continuous improvement or staff-led change and other ‘common sense’ approaches. We are probably all involved in managing projects or change in some form, perhaps without even knowing it. This Blog is the musings of the Head of Planning and Project Management sharing different thoughts, learnings and experiences both from my own travels through the change management landscape, sharing collective shared wisdom from others involved in change in the HE sector, and hopefully in time from others also involved in change at the University.
Welcome to my first blog post for Governance and Planning! As a qualified project manager certified as a PRINCE2 practitioner, holding the APM Project Manager Qualification (PMQ) and certified to IPMA Level D, of course the first thing I would like to write about is why project management can be for everyone!
Project Management to some is seen as an onerous task, involving a Project Manager tirelessly sticking to a project management methodology like PRINCE2, insisting on particular forms being completed for what seems like no logical reason at all and being perceived by some as just making life harder. For those who own the project (often known as a project sponsor) it can also be seen as a lack of control.
The good news is that is doesn’t have to be like this, and the key principles of project management can be applicable in your daily role! The principles of project management can be applied, and scaled up and down to whatever environment you are working in. So yes, a full structured project management methodology is probably a great idea if you are building Wembley Stadium or Crossrail, and it’s probably a good idea to adopt some form of structured approach if you are delivering projects which contribute to institutional or Strategic change. But let’s be honest, it’s probably overkill to implement full PRINCE2 if you are just looking for some hints and tips in order to be a little more streamlined when you next need to organise an exam board, or plan a trip for 15 students to a local employer.
So, in this initial blog post I plan to share some of the key principles of project management with the hope that I can begin to unpack some of these in future blog posts with some hints and tips to make these principles work for you in your daily roles. Project management is not just about process, it’s also about people – people are the instruments of change and without them your project just won’t be successful. So, I hope in later blog posts to also look a little about ‘changing hearts and minds’ too.
Firstly, let’s be clear about what a project is, and what a project isn’t. In the spirit of not relentlessly sticking to project management methodology tirelessly I won’t give a formal definition! A project should be considered as a temporary endeavour to achieve one or more planned outcomes that have been pre-defined. It is not business as usual, it is not normal daily operations and it is not a business plan or strategy. With this in mind, below are some key principles of project management for you to consider:
As I previously mentioned, I hope to unpack some of these in future posts in a way which is applicable to your everyday role. In the meantime, I leave you with this You Tube video from the Association of Project Managers (APM) which you may find useful: www.youtube.com
My door is always open to colleagues who want to talk about how to make project management work for them. Project management makes me happy (sad I know!) and sharing it with others makes me even happier so my door/inbox is always open.
Until next time…
Julie Tysoe – Head of Planning and Project Management
What if I told you that US surveillance laws, Facebook, and Edward Snowden are the root cause of one of our biggest upcoming data protection issues? You wouldn’t necessarily think these things are related, right?
But bear with me, because I promise you, there is a story here. And it all begins with international transfers of data.
International data transfers – what are the rules?
I’m talking about situations where you need to send the personal data of people residing in the EU, to a “third country”. This is known as a restricted transfer, and the basic rule is that you can only make such a transfer in 3 situations:
I like to call this the golden ticket. Adequacy is a status given to a country by the European Commission which indicates that they have an adequate level of data protection. If you have adequacy, then technically, you don’t need to have an additional safeguard (though it is always advisable to have one).
Currently, the countries which have been granted adequacy are listed here.
But if a country doesn’t have adequacy, you may still be able to make a restricted transfer if:
OR
However, exceptions can only be used for one-off transfers.
Transfers of data from the EU to the US are currently covered by a rather singular adequacy decision. It is called the “Privacy Shield” framework. Any company which is certified on Privacy Shield is considered to offer an adequate level of data protection. So unlike other adequacy decisions, it is not the USA as a whole that has adequacy, just specific organisations.
However, it wasn’t always plain sailing for US-EU data transfers. Privacy Shield is in fact the second iteration of the framework. Its predecessor was known as “Safe Harbor”.
Timeline: From Harbor to Shield
But is Privacy Shield all it’s cracked up to be?
If you go on the Privacy Shield website, you will find that Facebook is a certified member of the framework. Which means it is deemed as providing an adequate level of data protection.
To those of you who remember the Cambridge Analytica scandal, this probably doesn’t sound right. Well, it’s not just you that thinks so.
And so just like with Safe Harbor, the question of whether Privacy Shield really provides adequate data protection has been raised by Max Schrems. It all comes down to a conflict of law.
Whereas the European Charter of Fundamental Rights and GDPR both promote data protection and privacy rights, this is in direct conflict with the Foreign Intelligence Surveillance Act, a piece of US legislation which gives wide-ranging powers of surveillance to US security agencies.
And it’s a fair question. What would happen if I were to transfer personal data to an American organisation under Privacy Shield, but then the NSA asked that organisation to disclose that data to them. FISA would allow this in situations where GDPR wouldn’t, and that means that national law trumps data protection.
For Max Schrems, that means it’s no better than slapping lipstick on the same old data protection pig.
It doesn’t help that the Trump administration has entrenched rather than rolled back privacy-hostile US laws.
But it’s not just US adequacy that’s in trouble.
As mentioned above, Snowden’s exposé of US surveillance practices got Facebook into trouble. But Facebook tried to argue that it never used the Safe Harbour mechanism, and instead relied on standard contractual clauses (SCCs) to transfer data between its European entity, Facebook Ireland, and Facebook USA — essentially via a contract in which Facebook USA pledges to follow EU privacy principles.
This is option 2 of the rules on international transfers. If adequacy is not available, then you can rely on SCCs as an appropriate safeguard.
However, once again, Schrems wasn’t convinced, and demanded the Irish Data Protection Commission look into it. The Irish DPC identified a “systematic” problem and took the view the SCCs are invalid as a whole.
The case has been escalated to the European Court of Justice, with a hearing due on 9th July, and a final determination likely in Summer/Fall of this year. At that point, we will find out 2 things:
If both these things happen (and it is likely that they will), then international data transfers are likely to become the next hot topic on the data protection agenda.
In other words, watch this space.
Follow the case here. (Case C-311/18: Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems)
Written by Alexandra Pavel, Data Protection Officer
It’s a new year, and a full eight months on from the implementation of GDPR. So here is your January GDPR update: complete with the biggest data protection shockers of 2019.
The big Google fine
This week has seen Google fined a staggering 50 million euros (£44m) by the French data regulator CNIL, for a breach of GDPR. They cited a "lack of transparency, inadequate information and lack of valid consent regarding ads personalisation". Basically, people were "not sufficiently informed" about how Google collected their data to personalise advertising.
The complaints in questioned were filed against Google in May 2018 by two privacy rights groups: noyb and La Quadrature du Net (LQDN), with the first complaint being filed the day GDPR came into effect. The groups argued that Google did not have a valid legal basis to process user data for ad personalisation, as required under GDPR.
Google's European headquarters is in Ireland; however, it was the French data regulator who dealt with the case, because, it was decided among the authorities that the Irish watchdog did not have "decision-making power" over its Android operating system and its services.
So what were the issues with Google?
And it’s not just consent and the Right to be Informed where companies have been falling foul of the rules. Another contentious one is the Right of Access.
You may have heard about how Amazon sent 1,700 Alexa voice recordings to the wrong user following Subject Access Request.
Well, it seems that the big tech giants are having a tough time right now, as entertainment streaming companies including Amazon, Apple, Google, Netflix and Spotify have been accused of breaking the EU's data regulations.
GDPR gives data subjects the right to demand a copy of their personal data from companies (this is called a Subject Access Request). As a result, many big tech companies including Amazon, Apple, Google and Spotify made changes in order to allow customers to download a copy of their data.
However, when noyb employees requested a copy of their data from several movie and music streaming services, they discovered that Amazon, Apple, Spotify and Google's YouTube all let people download a copy of their personal information quickly. However, only some of the data was "intelligible", with some parts supplied in a format that could not be understood by people.
All four streaming giants also failed to supply additional information to which people are entitled, while both Soundcloud and UK-based streaming service Dazn did not reply to the information requests at all.
Noyb has filed 10 complaints with Austria's data protection regulator as a result.
And while we haven’t seen any big fines come out of our own UK Data Regulator, the ICO, the regulators in other EU countries have certainly been busy…
Germany
Around 330,000 users of a chat platform had their personal data access by hackers, who then made this data publicly available in September 2018. This was possible because their passwords had been stored in an unencrypted form.
As a result, the data protection authority (DPA) of the German state of Baden-Württemberg saw this as a breach of the obligation to implement adequate security measures (Article 32 GDPR). However, because the platform provider cooperated fully, and notified breach in due time, the fine they were issued was actually quite modest in GDPR terms.
Fine: EUR 20,000.
Austria
An entrepreneur in Austria installed CCTV in front of his establishment, which you would think is a very normal and sensible thing to do. However, it also recorded a substantial section of the side walk.
The Austrian DPA considered this a breach of GDPR as there was no legitimate reason for companies (or entrepreneurs) to put public spaces under CCTV surveillance. What’s more, there was insufficient signage to show that video surveillance was in place, which therefore violated the transparency obligation under the GDPR.
Fine: EUR 4,800 for illegal video surveillance activities.
Portugal
Following an inspection at a Portuguese hospital, the Portuguese DPA found that the hospital' s account management practices were deficient. This was because although there were 985 active accounts for doctors, there were only 296 doctors working at the hospital. What’s more, any doctor had access to all patient files, regardless of the doctor' s specialty. Considering the sensitive nature of the data being accessed, the Portuguese DPA imposed a higher fine on the hospital.
Fine: EUR 400,000
So as you can see, the complaints are racking up, and the fines are coming out. So it’s more important than ever that we all make sure we handle personal data in a GDPR-compliant way.
To better understand how to obtain consent appropriately, please see my Guidance on Consent.
And remember, I’m running specialised GDPR sessions currently bookable via the staff development calendar. You can book your place via our iTrent self-service. Click on “Career & Development” at the top, and under “Learning Activities”, search for “GDPR”. You can book onto any of these four sessions, which will be mirrored at Luton and Bedford.
Written by Alexandra Pavel, Data Protection Officer
(Originally posted: Fri 25th January, 2019)
So it’s the end of another busy year. The staff Christmas party has come and gone. The decorations are up. Let’s be honest, data protection is probably the last thing on your mind, am I right?
But as a wise man once said, “Security is always excessive until it’s not enough”. So for my final blog post of the year, I’ve decided to tackle a rather complicated, but also very topical issue: Brexit.
To me, the Brexit referendum feels like it only happened yesterday. It’s somewhat jarring to realise it was actually 2 years ago. I still remember being out the night before, celebrating the end of my LPC exams with my classmates, and hardly expecting what the results would be the day after.
Yet despite the referendum, the UK still went on to refresh its data protection law to meet the standards of the EU’s GDPR, through the Data Protection Act 2018. After Brexit, GDPR will no longer apply directly to institutions and organisations in the UK, and UK citizens will not be considered EU citizens. This inevitably means that they will not be given the same protections which GDPR offers EU citizens.
After we leave the EU (currently scheduled for 29 March 2019), it will still be possible for parliament to make changes to the GDPR framework as it sees fit. The main issue with this is that any major changes will put UK organisations at odds with EU laws, thereby making data protection issues more complex. For Universities, who recruit students from the EU, use EU agents, and EU partners, this could potentially be a big issue. We would still need to comply with GDPR for any EU citizens, which means that even after Brexit, GDPR may not directly apply to us, but it will still be relevant to us.
I recently attended the inaugural Data Protection World Forum, and one question which was raised there was the status of the Information Commissioner’s Office after Brexit. We should not assume that the ICO will have a place on the European Data Protection Board (EDPB). It may be asked there on a case by case basis, but it may not be able to take part in plenary meetings of the EDPB, meaning it will not be able to influence decision-making, yet it would still need to adhere to the rules and implement decisions of the board. The question was also raised if our lead authority needs to be a Member State authority. If so, then the ICO can no longer be our lead authority after Brexit.
There may also be a potential issue with our use of the “Legal Obligation” lawful basis, which under GDPR has to be EU Member State law. This would suggest that once we are outside the EU, we will not be able to process EU citizens’ personal data under this lawful basis by relying solely on UK law.
You’ve probably seen how complicated negotiations over a Brexit deal have become. Clearly the Government is making provision for a ‘no-deal’ Brexit, as they have recently issued papers about various issues in a ‘no deal’ situation. The one on data protection is available to read here: Data protection if there’s no Brexit deal.
But that’s the most worrying part – we face the prospect of being regarded as a third country when we exit the EU. That means that personal data transfers from organisations within the EU to organisations in the UK will be subject to strict data transfer rules. Currently, international transfers to third countries require an “adequacy decision” by the European Commission. The question is, will the UK be given “adequacy status”?
In a nutshell, it’s about proving to the EC that the UK’s level of data protection is equivalent to that of the EU, so that restrictions on data transfers are not imposed on us. This includes a very rigorous test, and if a country “passes” the test, the Commission can then make an “adequacy decision”. Having an adequacy decision means personal data flow would be much simpler and unrestricted, as we would not be bound by the appropriate safeguard requirements in Article 46 and Article 47 GDPR.
As of now, the EC has recognised Andorra, Argentina, Canada (commercial organisations only), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland and Uruguay as providing adequate protection. The US-EU Privacy Shield is a recognised mechanism for data transfers between the US and EU. However, this is limited to organisations in the US who sign up to the Privacy Shield framework. More recently, in July this year, the EU and Japan agreed to recognise each other’s data protection systems as ‘equivalent’. Japan will in fact be the first adequacy decision made under GDPR so we could learn a lot from them.
One thing to note is that unless a Brexit deal is reached between the UK and the EU which covers data protection and data transfer arrangements, we will not automatically be awarded “adequacy” status. And although the UK Government has asked the Commission to begin its assessment process for this, the Commission’s stance is that they will not do so until the UK has left the EU.
But there are concerns that their assessment will include an in-depth look at our crime and national security legislation, and especially the controversial Investigatory Powers Act 2016 which has previously been criticised by the European Court of Human Rights as potentially violating individual privacy by granting too much power to security and intelligence services. What’s more, the adequacy decision process can last several months (or even years), so there could be a long wait ahead of us.
The important thing to remember is that if no agreement is reached, the UK will become a third country to the EU, and (at least right after Brexit) will not have adequacy. This means that it is likely new restrictions for EU-UK data transfers will apply.
The Government has stated that the transfer of personal data from the UK to EU member states will remain unaffected. However, organisations which rely on transfers of personal data from the EU to the UK will need to prepare for the possibility of no deal. In the absence of an adequacy decision, this means we will need to ensure we are compliant with Articles 46-49 of GDPR, and we will need to work with our EU partners to ensure transfers of personal data are compliant.
For most organisations, the Government has advised that the most relevant legal basis for such transfers would be Standard Contractual Clauses (SCCs), which are basically EC-approved data protection clauses, also known as “model clauses”. These would need to be embedded in contracts, or added as an appendix.
And as for UK-US data transfers, we would need to consider if we are currently relying on the EU-US Privacy Shield, because after Brexit we will no longer be part of this arrangement.
So really, in this age of uncertainty, we have to keep our ears to the ground, and prepare for any eventuality.
Or in the words of another wise person: “Keep Calm and Data On!”
Merry Christmas all! See you in the New Year.
Written by Alexandra Pavel, Data Protection Officer
(Originally posted: Mon 10th December, 2018)
ICO finds Metropolitan Police Service’s Gangs Matrix breached data protection laws
We’ve heard of a number of high profile data breach cases recently. Facebook was one, British Airways another. But surely the police, for example, are exempt from some of the strictures of Data Protection Law? After all, they have a legitimate reason to do what they do!
Well, it isn’t as simple as that.
In a rather unexpected development this month, the Information Commissioner’s Office (ICO) found that the Metropolitan Police Service’s use of the Gangs Matrix (set up after the 2011 London riots) resulted in numerous serious breaches of data protection law.
What is the Gangs Matrix?
A database which is used to record intelligence related to alleged gang members. The matrix is used across the Metropolitan area, with each of the 32 London boroughs operating their own. These are then centrally collated into a London-wide Matrix containing personal data of individuals, including full names, home address, date of birth, and whether a person is a prolific knife carrier or firearms offender.
So what was wrong with it?
In a nutshell, the Gangs Matrix failed to distinguish between the approach to victims of gang-related crime and perpetrators, and this led to confusion among officers who were using it. The operating model was applied inconsistently across boroughs, with some even using informal lists of individuals who had in fact been removed from the Matrix. This meant the MPS was continuing to monitor individuals even after intelligence showed they were no longer active gang members.
What’s more, blanket sharing with third parties meant there was excessive processing of data, and a lack of clarity regarding high and low-risk offenders, resulting in potentially disproportionate action against those who were no longer a risk. The MPS was not providing enough guidance to these third parties on how the information they shared should be used. The ICO added that the Matrix’s serious breaches of data protection laws had the potential to cause “damage and distress” to the disproportionate number of young, black men on the list.
What did the ICO do?
The MPS has now been issued with an Enforcement Notice, and given six months to make changes to ensure it is compliant with data protection laws in future. The Met has stopped sharing personal data on the Gangs Matrix with third parties where there is no data sharing agreement in place, and are working with the ICO to complete a Data Protection Impact Assessment.
They will also work to improve guidance on what constitutes a gang member, and distinguish properly between suspected offenders and victims of crime. All informal lists of individuals which no longer meet gang matrix criteria will be deleted.
Deputy Information Commissioner of Operations, James Dipple-Johnstone, said:
“Protecting the public from violent crime is an important mission and we recognise the unique challenges the MPS faces in tackling this…Our aim is not to prevent this vital work, nor are we saying that the use of a database in this context is not appropriate; we need to ensure that there are suitable policies and processes in place and that these are followed…”
What have we learned from this?
No one is exempt from GDPR compliance, and in fact, a major cause of breaches of data protection law is a failure to conduct a Data Protection Impact Assessment (DPIA) when one is required.
DPIAs are a new requirement under GDPR. They are a type of risk assessments which need to be done for new projects and processing which includes new technologies, large amounts of sensitive data, or innovative ways of using personal data, among other things. You may have received an update recently on Microsoft’s terms of use. That stemmed from a DPIA commissioned by the Dutch Government on Microsoft Office. And that is just another example of DPIAs being used to drive change.
Remember, the point of a DPIA is to identify and mitigate risk. Just because your legal basis is statutory, doesn’t mean that the risk is mitigated.
Download our DPIA Form and DPIA Guidance to find out more.
Written by Alexandra Pavel, Data Protection Officer
(Originally posted: Wed 28th November, 2018)
Not long ago, I sat in on a Data Breach Webinar which was part of the GDPR Summit Series and hosted in association with Iron Mountain. A very interesting scenario was posed, which I’d like to share with you.
So picture this: you need to buy a ticket for an event. The website is acting up, so you pick up the phone and dial the number instead. That automated voice comes on telling you "this call may be recorded for training purposes". You don’t think much of that – after all, if you’ve heard it once, you’ve heard it a thousand times. Now you have that standard elevator music playing in your ear (as always far too loud for comfort), and you’re on hold for what seems like ages. By the time you’ve got an actual human being on the line, you’ve completely forgotten about the fact that this call is being recorded.
Or perhaps you may not think that is an issue, but it is. After all, you’re about to give this person your card details over the phone - card details which are now being recorded. And if the call centre is in a non-EU country, as many are, then you are transferring your personal data outside of the EU. The implications of this can be significant.
And this is why we need to think about what we do with personal data. Not just our own, but that of others as well. A large number of data breaches result from improperly stored data, or data transferred using unsecured methods.
One of the key principles of GDPR is that personal data must be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).”
We have therefore produced a Guidance document, to give you more information on University-approved methods of storing and transferring personal data.
What are the most common causes of data breaches?
It ranges from the accidental to the malicious. Some examples are:
Loss of removable media: USBs or hard drives going missing, which contain personal data. This often happens when they are stored in unlocked drawers in unlocked offices, or are forgotten at conferences. Oftentimes, these are not encrypted.
Phishing: You get what appears to be a legitimate email, e.g. from HMRC, which then asks you to click on a link and input some data. Maybe it is asking you to pay an unpaid invoice or it simply requests that you open an attachment. However, it is not legitimate. It is a phishing email, and that attachment could contain a virus that will compromise your computer. As a result, the phisher gets access to your inbox, and potentially any personal data you store in there. University email accounts have increasingly been under attack from fraudsters pretending to be other members of staff by faking University email addresses. Often the name of the staff member will look the same, but the domain name will be different, e.g. ...beds@mail.ru.
If you receive a phishing email, forward it as an attachment to phishing@beds.ac.uk and mark it as “Phishing” in the web version of Outlook at outlook.beds.ac.uk.
Most importantly, do not reply to it, and do not open any attachments. If you do so accidentally, please contact the ICT Service Desk immediately.
Unsecure mobile devices: maintaining a high level of security when mobile devices are in use is difficult. Especially when employees use their personal phones for work. This often means the University has less control over security, passwords, and application downloads which could potentially pose security threats. It is also difficult to determine who has access to that device, for example, the employee’s friends or family members.
Best practice is to not download any personal data to your mobile phone, because if you lose it, you can change your email password so your outlook cannot be accessed, but you won't be able to erase any data you have downloaded to your mobile.
Also have a look at our Bring Your Own Device Policy
Cybercrime: hacking of a website which is not appropriately secure. If you read my previous blog post, you may remember the case of the University of Greenwich, which was fined £120,000 by the Information Commissioner after a “serious” security breach that occurred because they placed the (in some cases sensitive) personal data of nearly 20,000 people on a microsite for a training conference. This was then not closed down or properly secured, and was subsequently hacked.
Similarly, in September this year, Facebook suffered another security breach where up to 90 million of its user accounts were exposed. The attackers made use of a vulnerability in the code of Facebook's “View As” tool (that feature which allows you to see what your profile looks like to other people). They were then able to steal Facebook access tokens which would allow them to take over almost 50 million profiles. What’s more, another 40 million users who interacted with the “View As” feature were also exposed. Not good news after their fairly recent data breach involving Cambridge Analytica.
Above: Cambridge Analytica’s London offices raided by ICO Enforcement Agents. (Image source: the Guardian)
Although Facebook has fixed the vulnerability, the breach had a significant effect on them, causing their stock prices to dip. This just highlights the true impact of data breaches. It isn’t just the potentially significant fine – the maximum fine under GDPR could be up to 4% of Facebook’s global annual revenue from the previous year, which works out to around $1.63 billion (£1.25 billion) – it is also the subsequent reputational damage resulting from the breach, which can include a drop in share prices, and a class action law suit.
But what about the impact on the individual? Some may say that you should expect everything you post online to be available to the public anyway. But if there's one thing we can take away from the case studies above, it is that this doesn't give individuals or organisations carte blanche to do whatever they want with your data. And that is what GDPR is ultimately here for - safeguarding the rights of data subjects.
I for one am re-thinking how I use social media!
Written by Alexandra Pavel, Data Protection Officer
(Originally posted: Tue 13th November, 2018)
“Alexandra, don’t make me break up with you this Friday?!”
This was the subject heading of an email I received on May 23rd. Certainly not an email I expected to receive (and really, I don’t know anyone who addresses me by my full first name). However, I recognised the sender, and it didn’t look like a spam email. So I continued reading.
“This is awkward…It’s time to have a chat about our relationship status. We’d love to stay together, but if you want to keep receiving our monthly newsletter…”
Ah, now I understood. This was a GDPR email. One of many I had received in the run up to the 25th May implementation date, asking me to ‘opt in’ to continue receiving communications.
But what has happened since then?
The Information Commissioner’s Office (ICO) has reported a significant increase in the amount of self-reported personal data breaches in the first full month after GDPR came into force. So while April 2018 saw a grand total of 367 data breach notifications, in May this had risen to 657 reports, and then 1,792 in June (a 173% rise on the May statistics, and an almost fivefold increase compared to April). The ICO figures also reveal that the highest number of self-reported data breaches came from the education, health, general business, legal, and local government sectors. That’s right, even LAWYERS were getting it wrong!
However, data breaches are not new. Remember the now infamous 2013/14 breach at Yahoo where 3 billion user accounts were compromised? That was possibly the largest data breach in history. The difference is that it occurred under a different Data Protection regime, where the rules were not as strict, and the fines not as high. Under the old Data Protection Act 1998, the maximum financial penalty was £500,000. Under the new legislation (the GDPR and the Data Protection Act 2018), the higher maximum fine is €20 million (up to £17 million) or 4% of the total annual worldwide turnover in the preceding financial year, whichever is higher. Imagine how much Yahoo could have been fined had their breach occurred under the new legislation!
The 72-hour clock
We now have a time limit for reporting breaches to the ICO – 72 hours from identification of the breach. Not all breaches have to be reported to them, only those that have a significant impact on the rights and freedoms of individuals. This is a balancing exercise which the Legal Office needs to conduct, so it is important that if you identify a data breach, you report it to us ASAP. We have a Data Breach Process and Data Breach Reporting Form available on our GDPR intranet site (via the drop down menu at the top right of in.beds, just under Service Desk), and through the in.beds document search.
We have Case Studies!
The good thing about case studies is that we can learn a number of important lessons from them. Take the University of Greenwich for example. Around the same time GDPR came into force, came the news that Greenwich was fined £120,000 by the Information Commissioner following a “serious” security breach which involved the personal data of nearly 20,000 people (among them students and staff) being placed on a microsite for a training conference. After the event, the site was not closed down or properly secured, and in 2016, a number of attackers gained access to data which included names, addresses, dates of birth, phone numbers, signatures and – in some cases – physical and mental health problems.
Greenwich was the first university to receive a fine under the Data Protection Act 1998 (the breach occurred pre-GDPR). This highlights the need to ensure that personal data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (‘storage limitation principle’). We must also ensure personal data is stored securely (‘integrity and confidentiality’).
What about third parties which we use to store personal data? If they have a data breach, that’s on their head, right?
Wrong. If we use data processors to process data on our behalf, we are both liable for the breach. As controllers, we have the duty to inform the ICO, so it is important that we have GDPR-compliant contracts with these processors, which include clauses stating their GDPR obligations.
Take the example of a third-party hacking breach experienced by Ticketmaster, which discovered a malware attack on third-party vendor Inbenta's chatbot. This allowed hackers to steal names, email addresses, telephone numbers, addresses, payment card details and Ticketmaster login details. Up to 40,000 people who had bought tickets between September 2017 and 23 June 2018 were affected.
Given the timeframe, the ICO is still deciding which is the relevant legislation, but it is likely that either the breach will be judged under both the DPA 1998 and DPA 2018, or the DPA 2018 itself.
What about simple mistake?
Mistakes do happen, but unfortunately when it comes to data, a simple error like sending an email attachment to the wrong person, can result in a data breach. Take the Independent Inquiry into Child Sexual Abuse (IICSA), which was set up in 2014 to investigate the extent to which institutions failed to protect children from sexual abuse. It was fined £200,000 by the ICO after sending a bulk email in 2017 which identified possible victims of historic child sexual abuse. How did this happen? It was a simple case of a staff member entering email addresses into the ‘To’ field instead of ‘bcc’ (blind carbon copy). This allowed the recipients to see each other’s email addresses, thereby identifying them as possible victims of child sexual abuse.
But the IICSA is not alone in making this mistake. In 2016, a London NHS trust was fined £180,000 by the ICO after making the same mistake, and thereby identifying 781 people who had attended HIV clinics. Gloucestershire Police made a similar mistake in 2016 and was fined £80,000.
Sometimes a little bit of diligence can make the difference! If you are attaching something to an email, check that it is the right document (if it is an excel sheet, check all the tabs within the workbook). Ensure you are sending it to the right email address, and when sending group messages, remember: bcc is your friend!
A lot of the case studies we currently have available were judged under the old legislation, and the ICO hasn’t issued any GDPR-related fines yet. However, we’re now a few months on from May 25th, and we will soon be seeing those high numbers. Remember the British Airways breach that occurred recently, where the financial details of around 380,000 customers were stolen? The ICO are still investigating this, but the news outlets have been speculating as to the fine. The BBC reported that BA's total revenue in the year to 31 December 2017 was £12.226bn, and 4% of that is a potential maximum fine of £489m!
Check out our range of new GDPR Resources!
And there will be more guidance to come.
Is there something in your area that you’re unsure about? Don’t just leave it, ask about it!
Get in touch with any questions, comments, or concerns:
Data Protection Officer: DPO@beds.ac.uk
Legal Office: legaloffice@beds.ac.uk
Written by Alexandra Pavel, Data Protection Officer