Search

Brian Pennington

A blog about Cyber Security & Compliance

Tag

Information Commissioner’s Office

ICO: Warning to SMEs as firm hit by cyber attack fined £60,000

Small and medium sized businesses are being warned to take note as a company which suffered a cyber attack is fined £60,000 by the UK Information Commissioner’s Office.

An investigation by the ICO found Berkshire-based Boomerang Video Ltd failed to take basic steps to stop its website being attacked.

Sally Anne Poole, ICO enforcement manager, said:

“Regardless of your size, if you are a business that handles personal information then data protection laws apply to you.

“If a company is subject to a cyber attack and we find they haven’t taken steps to protect people’s personal information in line with the law, they could face a fine from the ICO. And under the new General Data Protection Legislation (GDPR) coming into force next year, those fines could be a lot higher.”

She added:

“Boomerang Video failed to take basic steps to protect its customers’ information from cyber attackers. Had it done so, it could have prevented this attack and protected the personal details of more than 26,000 of its customers.”

The video game rental firm’s website was subject to a cyber attack in 2014 in which 26,331 customer details could be accessed. The attacker used a common technique known as SQL injection to access the data.

The ICO’s investigation found:

  • Boomerang Video failed to carry out regular penetration testing on its website that should have detected errors
  • The firm failed to ensure the password for the account on the WordPress section of its website was sufficiently complex
  • Boomerang Video had some information stored unencrypted and that which was encrypted could be accessed because it failed to keep the decryption key secure
  • Encrypted cardholder details and CVV numbers were held on the web server for longer than necessary

Ms Poole said:

“For no good reason Boomerang Video appears to have overlooked the need to ensure it had robust measures in place to prevent this from happening.

“I hope businesses learn from today’s fine and check that they are doing all they can to look after the customer information in their care.”

Advertisements

Is the North West a hub for nuisance calls?

In the last few months it appears that the North West of England has become a hub of nuisance calls after three raids undertaken on behalf of the Information Commissioners Office.

The ICO executed two search warrants this week, one in Gatley, Greater Manchester, on Wednesday and the other in Wilmslow, Cheshire, on Thursday.

Computers and phones were seized during the searches as the ICO continues to investigate nuisance calls prompted by the theft of people’s details from car repair centres throughout the UK. The items will now be subject to forensic examination and investigation.

Mike Shaw, ICO Criminal Investigations Group Manager, said:

“This illegal trade has multiple negative effects – both on the car repair businesses targeted for their customer data and the subsequent nuisance calls made to customers. These can be extremely unsettling and distressing. 

“Our searches this week are the latest step in us tracking down the unscrupulous individuals involved in this industry. These people won’t get away with it – any person or business involved in the theft and illegal trade of personal data may find themselves subject to ICO action.”

ICO investigators are looking at how the data was stolen, who stole it and which companies have subsequently made calls to the public encouraging them to make compensation claims about to accidents they may have been involved in.

The ongoing investigation, named Operation Pelham, started in May 2016 and has so far involved:

December 2016. A business and two homes in Macclesfield and Heald Green were searched by ICO officers. The business was linked to the making of telephone calls to numbers originating from some of the car repair centres. Computers, telephones and documents were among items seized from the residential properties.

April 2017. Homes in Macclesfield and Droylsden.

Will GDPR Change the World?

Rob Luke’s keynote speech ‘Will GDPR Change the World?’.

Introduction

Thank you.

Let me take a moment to thank TechUK for putting together this event and for offering me the platform to speak with you this morning.

Our Commissioner, Elizabeth Denham, has been clear that the ICO’s vision – of increasing data trust and confidence among the UK public – can only be achieved by working in partnership with the private, public and third sectors.

An important part of that is developing key relationships with representative or umbrella organisations as multipliers and amplifiers for our engagement with different constituencies. Helping us reach new or hard-to-reach audiences.

Our strong relationship with Tech UK is a great example of that partnership approach.

We appreciate the role you play in bringing together representatives from across the sector and your ongoing constructive dialogue with us around issues of importance to your members and the sector as a whole.

I’m glad to have the opportunity to continue that dialogue this morning.

Will GDPR change the world?

Will the General Data Protection Regulation change the world?

Wow, what a question. On the face of it, even the most ardent data protection advocate would struggle to make a case that a blandly titled piece of European legislation deserves that billing.

So despite my professional obligation to emphasise the importance of data protection in the digital age, I am not going to make the argument for the world revolving around GDPR.

What I will try to do is highlight some of the opportunities and challenges GDPR brings for organisations.

Ultimately, of course, GDPR is an indicator of change as much as it is an instigator. And no sector is more relevant to that rapidly changing landscape than yours.

GDPR is part of the response to the challenge of upholding information rights in the digital age. Of protecting the rights and interests of the individual in the context of an explosion in the quantity and use of data and in an environment of extremely rapid technological change.

So I feel it is particularly relevant to mark One Year To Go in dialogue with the tech sector in particular.

I should be clear early on that this is not a speech about Brexit or an exploration of the UK’s possible post-Brexit data protection framework.

In a pre-election period, and with the need to adhere to the guidance on purdah, I hope you will understand that I am not in a position to speculate about the post-Brexit environment, nor indeed to comment on proposals in political party manifestos.

I apologise in advance if there are questions, or elements of the panel discussion, where I am limited by the caution that purdah requires.

What we can safely say however, is that one way or another, GDPR is going to be an important part of the global data protection landscape over the years ahead, with great relevance to UK organisations, the public and their data.

Fit for the digital age

The moment at which GDPR takes effect in the UK on 25 May 2018 will of course mark a change. In delivering legislation fit for the digital age GDPR confers new rights and responsibilities and organisations need to be working now to prepare for them.

I assume that this audience has a familiarity with the core features of GDPR and the key requirements it places on organisations. I hope you have already deployed our ’12 steps to take now’ guidance and our ‘Overview to GDPR’ and that you are drawing on our wider resources.

One consistent feature of our outreach with organisations is a high demand for granular guidance – often people will say to us: “tell us what we need to do”.

We are working at pace to produce detailed guidance, both at national level but also European level guidance produced by the Article 29 EU Working Party to which we are making a major contribution.

I will flag up some particular pieces of guidance in a minute, and the pipeline of guidance will continue to flow.

But I urge you not to wait, nor to take a reactive approach to your GDPR preparations, motivated solely by a mindset of compliance or risk management.

Those organisations which thrive under GDPR will be those who recognise that the key feature of GDPR is to put the individual at the heart of data protection law.

Thinking first about how people want their data handled and then using those principles to underpin how you go about preparing for GDPR means you won’t go far wrong.

Transparency and accountability

It can be boiled down to two words: “transparency” and “accountability”.

Being clear with individuals how their personal data is being used.

And placing the highest standards of data protection at the heart of how you do business.

An issue for the boardroom

That means this is an issue for board level, whatever the size of your business.

Not least because under GDPR the regulator wields a bigger stick. For the most serious violations of the law, the ICO will have the power to fine companies up to twenty million Euros or four per cent of a company’s total annual worldwide turnover for the preceding year.

And as we’ve seen in well-publicised examples the cost to business of poor practice in this area goes above and beyond any fine we can impose. Losing your consumers’ trust could be terminal for your reputation and for your organisation.

We would all prefer a win-win outcome. A model where organisations take an approach to data protection which earns the trust of consumers in a more systematic way. And where that trust translates into competitive advantage for those who lead the charge.

Nowhere does that feel more relevant than for your sector.

GDPR and the tech sector

The UK tech industry is at the forefront of our vibrant digital economy, changing how we live our lives and offering huge potential for positive change and wide social benefit.

Data is the fuel that powers that economy and tech companies are involved at every level.

GDPR is a response to this evolving landscape, building on previous legislation but bringing a 21st century approach and delivering stronger rights in response to the heightened risks.

The right of an individual to be informed about use of their data; their right to access their information and move that information around; the right of rectification and erasure of data where appropriate; the right to remove consent; and the right to enable automated decisions to be challenged.

Good practice tools that the ICO has championed for a long time – such as privacy impact assessments and ensuring privacy by design – are now legally required in certain circumstances.

The ICO covers privacy impact assessments in its existing Privacy by Design guidance and the European Article 29 Working Party has also issued draft guidelines.

Being transparent and providing accessible information to individuals about how you will use their personal data is another key element of the new law and our privacy notices code of practice is GDPR-ready.

Increased responsibilities for data processors are another feature. Data processors, companies using personal data on behalf of others, will have specific legal obligations to maintain records of personal data and processing activities.

Data breach reporting will also change under the GDPR. You’ll be obliged to notify the ICO, within 72 hours, of a breach where it is likely to result in a risk to the rights and freedoms of individuals.

The widespread availability of personal data on the internet and advances in technology, coupled with the capabilities of big data analytics mean that profiling is becoming a much wider issue.

People have legitimate concerns about surveillance, discrimination and the use of their data without consent.

Data protection can be challenging in a big data context and some types of big data analytics, such as profiling, can be intrusive.

We explore many of these issues in detail in our recently updated paper on big data, artificial intelligence, machine learning and data protection.

We’ve also recently published a consultation paper on profiling under GDPR to which TechUK has responded. We’ll be using this to feed into the European Article 29 Working Party guidelines.

Harnessing the benefits of big data, AI and machine learning, as it relates to healthcare for example, will be sustained by upholding the key data protection principles and safeguards set out in GDPR.

Whilst the means by which personal data is processed are changing, the underlying issues remain the same. Are people being treated fairly? Are decisions accurate and free from bias? Is there a legal basis for the processing? These will remain key questions for us as a regulator under GDPR as they have been under the DPA.

The GDPR is a principles based law well equipped to take on the challenges of 21st century technology.

It aims to be flexible – protecting individuals from harm while enabling you to innovate and develop services that consumers and businesses want.

Data analytics

As data becomes the fuel powering the modern economy, so it becomes a key element of many of the debates in modern society.

Take the announcement last week by Elizabeth Denham of her opening of a formal investigation into the use of data analytics for political purposes.

Given the big data revolution I have mentioned it is understandable that political campaigns are exploring the potential of advanced data analysis tools to help win votes. The public have the right to expect that this takes place in accordance with the law as it relates to data protection and electronic marketing.

This is a complex and rapidly evolving area of activity and the level of awareness among the public about how data analytics works, and how their personal data is collected, shared and used through such tools, is low.

What is clear is that these tools have a significant potential impact on individuals’ privacy. It is important that there is greater and genuine transparency about the use of such techniques to ensure that people have control over their own data and the law is upheld.

We will provide an update on that investigation later in the year.

Rising to the challenge

I’ve talked about some of the challenges and opportunities GDPR brings for organisations. Likewise it is a moment for us at the ICO to reflect on how we do our work.

Clearly there are practical aspects such as preparing for a higher volume of activity given enhanced breach notification requirements.

But we are thinking more widely than that.

One example, again with particular relevance for the tech sector, is how we might be able to engage more deeply with companies as they seek to implement privacy by design.

How we can contribute to a “safe space” where companies can test their ideas. How we can better recognise the circular rather than linear nature of the design process.

Separate but related we need to become more comfortable about recognising good practice and drawing on exemplars.

We should be able to find ways to give credit where credit is due without that translating into a free pass for an individual organisation or practice. GDPR explicitly foresees wider use of tools such as codes of conduct and certification schemes, which potentially have an important role to play.

To deliver on the above and more broadly we also need to build our own tech know-how and capability. We are working on a new Technology Strategy which will outline our means of adapting to rapid technological change as it impacts information rights.

We are also committed to exploring innovative and technologically agile ways of protecting privacy.

And of course we need to exercise global reach and influence. Effective protection of the UK public’s personal information becomes increasingly complex as data flows across borders.

The ICO will continue to develop and deepen effective relationships with our international partners, reacting to changes in the global regulatory environment.

These goals among others feature in our new Information Rights Strategic Plan, being launched today by Elizabeth Denham, which sets out the ICO’s plan for the coming four years.

The tech sector will be a priority for our engagement as we look to seize these opportunities set out in the strategy.

Conclusion

With 12 months to go until GDPR takes effect in the UK, I hope I have offered a brief insight into some of the implications and impacts of GDPR on UK businesses.

I hope I have also signposted key actions you should be taking and key tools on which you can draw to rise to the challenge.

GDPR brings big changes, important changes. But GDPR is an evolution of the existing rules, not a revolution.

And as I said at the outset it is also a mirror of the changes in the practices and environment it seeks to regulate.

It is not GDPR which is pushing data protection up the public, political and media agenda. It is the changing nature of the world in which we live, and the ubiquity of data, which is causing society to reflect on the consequences for our personal information and for privacy itself.

You are at the heart of that change. Your response to the challenges and opportunities of GDPR will set a marker for other sectors.

You have a major stake in the enterprise of increasing data trust and confidence among the UK public. By putting the individual in genuine control of their own data you can help achieve that goal, delivering benefits for your consumers, your business and society as a whole.

Thank you.

ICO statement on recent cyber attacks on the NHS

The ICO has released the following statement concerning the recent cyber attacks on the NHS:

“All organisations are required under the Data Protection Act to keep people’s personal data safe and secure.

“Following the news on Friday afternoon that many organisations had been the subject of a cyber attack, the ICO made contact with both NHS Digital and the National Cyber Security Centre (NCSC).

“Our enquiries will continue this week and we note that NHS England have said they have no evidence that patient data has been accessed.

“Any appropriate next steps for the ICO will decided once these initial enquiries are complete.

“The ICO has published a useful blog on how to prevent ransomware attacks.”

More fines next year for nuisance call companies

Companies making nuisance calls have been warned to expect more fines in 2016.

The ICO imposed more than a million pounds worth of penalties for nuisance calls and text messages in 2015, with the same amount in the pipeline for early 2016.

The fines included:

  • £295,000 of fines for companies offering call blocking or nuisance call prevention services
  • A £80,000 fine to a PPI claims firm that sent 1.3million text messages
  • A £200,000 fine to a solar panels company that made six million nuisance calls
  • A £130,000 fine to a pharmacy company that was selling customer details to postal marketing companies

Total fines related to nuisance marketing in 2015:

  • £400,000 fines for nuisance texts (Help Direct UK Ltd; Oxygen Ltd; UKMS Money Solutions Ltd)
  • £575,000 fines for nuisance calls (Direct Assist Ltd; Point One Marketing Ltd; Cold Call Elimination Ltd; Home Energy & Lifestyle Management Ltd (HELM); Home Energy & Lifestyle Management Ltd;  Nuisance Call Blocker Ltd; Telecom Protection Service Ltd)
  • £130,000 fine for selling customer records for marketing (Pharmacy 2U Ltd)
  • £30,000 fine for sending marketing email (Telegraph Media Group Ltd)

Total: £1,135,000. 

Andy Curry, ICO Enforcement Group Manager, said:

Nuisance marketing calls frustrate people. The law is clear around what is allowed, and we’ve been clear that we will fine companies who don’t follow the law. That will continue in 2016. We’ve got 90 ongoing investigations, and a million pounds worth of fines in the pipeline

The ICO received around 170,000 concerns in 2015 from people who’ve received nuisance calls and texts, a similar number to the previous year (2014: 175,330). PPI claims prompted the most complaints, followed by accident claims. Areas identified as emerging sectors for nuisance calls and texts included call blocking services, oven cleaning services and industrial hearing injury claims.

The following are examples of complaints showed the level of distress that calls can cause:

Telecom Protection Service:

“I was recovering from major surgery at the time and the call caused me distress. The caller was very smooth talking and did not make it clear that he was selling a commercial service that was nothing to do with the TPS. The call was frankly misleading.”

HELM:

“I am receiving daily updates regarding a friend in hospital, and am expecting the worst. When these calls come in I expect it to be from the hospital.”

Cold Call Elimination:

“This company has ‘conned’ my mother out of £84.99 for an unnecessary service … my parents are 87 and 86 respectively; my father is suffering from dementia.”

“I am looking after my elderly mother who has terminal cancer. She initially answered and I could see I needed to intervene as I could hear the sales guy not giving up. I took the phone and asked him who he was and what he wanted. He got quite annoyed that I had intervened and I told him we were not interested.”

Point One Marketing:

“Very upset and angry that my mum, who has dementia, was talked into giving credit card details when it would have been obvious to the caller that she had dementia. This caused my mum distress because I had to explain why her debit card had to be cancelled and what she had done. This has caused both of us great distress. Had I not checked her call log and … the number that had called her I would not have known it had happened at all.”

ICO response to ECJ ruling on personal data to US Safe Harbor

The ICO has issued a statement in response to the European Court of Justice ruling about the legal basis for the transfer of personal data to businesses that are members of the US Safe Harbor

Deputy Commissioner David Smith said:

“Today’s ruling is clearly significant and it is important that regulators and legislators provide a considered and clear response. This ruling is about the legal basis for the transfer of personal data to businesses that are members of the US Safe Harbor. It does not mean that there is an increase in the threat to people’s personal data, but it does make clear the important obligation on organisations to protect people’s data when it leaves the UK.

“The judgment means that businesses that use Safe Harbor will need to review how they ensure that data transferred to the US is transferred in line with the law. We recognise that it will take them some time for them to do this.

“It is important to bear in mind that the Safe Harbor is not the only basis on which transfers of personal data to the US can be made. Many transfers already take place based on different provisions. The ICO has previously published guidance on the full range of options available to businesses to ensure that they are complying with the law related to international transfers. We will now be considering the judgment in detail, working with our counterpart data protection authorities in the other EU member states and issuing further guidance for businesses on the options open to them. Businesses should check the ICO website for details over the coming weeks.

“Concerns about the Safe Harbor are not new. That is why negotiations have been taking place for some time between the European Commission and US authorities with a view to introducing a new, more privacy protective arrangement to replace the existing Safe Harbor agreement. We understand that these negotiations are well advanced.”

Personal data in leaked datasets is still personal data – ICO

By Simon Rice, Group Manager for Technology at the Information Commissioners Office (ICO).

Personal data in leaked datasets is still personal dataThey say ‘no publicity is bad publicity’, but after spending most of the week trending on Twitter, I wonder if the users of the Ashley Madison site might disagree.

Having already prompted a flurry of news stories when the online attack of the Ashley Madison servers was first revealed, this week we’ve seen another wave of coverage as the personal data was published online.

Wherever your sympathies might lie in relation to the people identified in the published data set, the fact remains that such details are personal information, with certain protections in law.

Like many online attacks, the data protection response is international. In this case, we’re liaising with our counterparts in Canada, where the company is based.

But with cases like this, there is still a domestic aspect to consider.

Anyone in the UK who might download, collect or otherwise process the leaked data needs to be aware they could be taking on data protection responsibilities defined in the UK’s Data Protection Act.

Similarly, seeking to identify an individual from a leaked dataset will be an intrusion into their private life and could also lead to a breach of the DPA.

Individuals will have a range of personal reasons for having created an account with particular online services (or even had an account created without their knowledge) and any publication of further personal data without their consent can cause them significant damage or distress.

It’s worth noting too that any individual or organisation seeking to rely on the journalism exemption should be reminded that this is not a blanket exemption to the DPA and be encouraged to read our detailed guide on how the DPA applies to journalism.

This is not the first time an online service has suffered such an attack and unfortunately it’s unlikely to be the last. But it’s important people don’t assume that the law and the protections it affords to UK individuals don’t apply online.

Have your details been published in a dataset?

If you find your personal data being published online then you have a right to go to that publisher and request that the information is removed. This applies equally to information being shared on social media. If the publisher is based in the UK and fails to remove your information you can complain to the ICO.

ICO publishes it’s annual report

The Information Commissioner has released its annual report.

Christopher Graham points to the strengthening of his regulatory powers to show how the legislation continues to develop. In the past year, the ICO was given powers to compulsorily audit NHS bodies for their data handling, while forcing a potential employee to make a subject access request for, for example, their spent criminal record was also made an offence. A law change also made it easier to issue fines to companies behind nuisance calls and texts.

Information Commissioner Christopher Graham said:
“It’s thirty years since this office was established in Wilmslow. We’ve seen real developments in the laws we regulate during that time, particularly over the past year. Just look at the EU Court of Justice ruling on Google search results, a case that could never have been envisaged when the data protection law was established.

“Our role throughout has been to be the responsible regulator of these laws. More than that, we work to demystify some of this legislation, making clear that data protection isn’t to be seen as a hassle or a duck-out, but a fundamental right.

“A good example of that is our role in the new data protection package being developed in Brussels. We’ve been asked for our advice, based on our experience regulating the existing law, while we’ve also provided a sensible commentary on proceedings for interested observers.

“That role will continue this year, in what promises to be a crucial twelve months. The reform is overdue, but it is vital that we get the detail right on a piece of legislation that needs to work in practice and to last.”

“It is striking to see how decisions that were so hard fought in the early years have resulted in routine publication of information. Publication of safety standards of different models of cars, for example; or hygiene standards in pubs and restaurants; and surgical performance records of hospital consultants. Publication is now expected and unexceptionable.

“It’s been the ICO’s job to help public authorities to comply with requests,” Mr Graham will say. “The ICO’s role has led to information being released that time and time again has delivered real benefits for the UK.”

“Our Annual Report is our claim to be listened to in the debates around information rights. It shows the ICO knows what it is talking about.”

The ICO annual report reflects on the financial year 2014/15. Key stats include:

  • 14,268 – data protection concerns received
  • £1,078,500 – total CMPs issued, £386,000 of which were for companies behind nuisance calls or texts
  • 195,431 – helpline calls answered
  • 11.4% – rise in number of concerns raised about nuisance calls and texts (to 180,188)
  • 41 – audits conducted of data controllers (as well as 58 advisory visits to SMEs)
  • 1,177 – Information requests responded to
  • 4.9 million – number of visits to our website

The full report can be found here.

.

A review of websites and apps targeted at children is underway

The UK Information Commissioners Office (ICO), the enforcer of the Data Protection Act, has begun a review of websites and apps used by children as part of an international project to consider privacy concerns around the type of personal information services collect.

The ICO will look at 50 websites and apps, looking particularly at

  • what information they collect from children
  • how that is explained
  • what parental permission is sought

The websites and apps will include those specifically targeted at children, as well as those frequently used by children.

The same approach will be taken by 28 other privacy enforcement authorities from around the world, with a view to publishing a combined report in the autumn. The ICO will also consider action against any website or app that it finds to be breaking the Data Protection Act.

Steve Eckersley, ICO Head of Enforcement, said:

Anyone with children knows how many websites and apps are now targeted at them, and how popular they are with children. That’s true from Canada to Columbia, and the same concerns exist around what information the companies behind these services are gathering.

In the UK, we’re clear that apps and websites should not gather more personal data than they require, and operators should be upfront about how and why they collect information and how they use it. . These principles are true whatever the audience, but they are especially true where children are concerned. This research should give us a valuable insight into whether companies in the UK are operating compliantly, as well as how that fits with what is happening around the world

The work is coordinated by the Global Privacy Enforcement Network, and follows previous reports on website privacy policies, and how apps collect personal data. This year’s focus was chosen after privacy enforcement authorities identified a growing number of websites and mobile apps targeted at, or popular among, children.

Information Commissioner launches Corporate Plan setting out priorities for 2015-18

The Information Commissioner, Christopher Graham, says companies must do more to inform consumers about the way their information is being shared.

The Commissioner’s comments come as new figures show that 85% of people are concerned about how their personal information is passed or sold to other organisations.

The survey also shows 77% of people are concerned about organisations not keeping their personal details secure.

The UK Information Commissioner Christopher Graham said:

Providing people with enough information to understand how their details will be used is a basic principle of data protection. While the vast majority of companies are meeting the letter of the law, figures released today show that most people remain concerned about how their information is being shared. This situation is not good for consumers, or for businesses.

We are set for a new data protection framework in the next three years, but there are still basic things that organisations can be doing today, not only to comply with the current legislation, but also to prepare for the future regulatory landscape.

Businesses should take the results of our survey as a prompt to address consumers’ concerns and provide clearer information to explain when people’s details will be shared and with whom. Getting these basics right today will not only improve consumer trust but also help a business along the road to future compliance

Mr Graham’s comments come as the Information Commissioner’s Office (ICO) published its corporate plan. The plan sets out the ICO’s priorities for 2015-18.

These priorities include:

  • preparing for a period of substantial change with the implementation of a new EU data protection framework and the outcome of the Ministry of Justice’s Triennial Review;
  • developing and promoting an ICO privacy seal scheme as a means of demonstrating a commitment to good data protection practices; and
  • engaging with transparency and Open Data initiatives to ensure a balanced information rights perspective.

The ICO’s Annual Track survey was undertaken by ComRes on behalf of the ICO. The survey involved carrying out online interviews with1,575 individuals for their views on data protection matters.

The survey also involved asking 1,422 people for their thoughts on freedom of information issues. The key findings from this section of the survey were:

  • 75% of respondents think it’s important that private companies acting on behalf of public authorities should be subject to the Freedom of Information Act.
  • 79% of people think it’s important that the regulator is independent of government.

The ICO has to find the right balance of the public interest – between openness to the outside and necessary frankness inside organisations. These decisions are not straightforward and are sometimes controversial, but as guardians of the public interest we are properly accountable to Parliament and the courts

Office agrees it must do more to protect customer data

The UK Information Commissioner Office (ICO) has warned shoe retailer Office after the personal data of over one million customers was hacking.

The hacker accessed customers’ details and website passwords via an unencrypted database.

Sally-Anne Poole, Group Manager at the Information Commissioner’s Office said:

The breach has highlighted two hugely important areas of data protection: the unnecessary storage of older personal data and the lack of security to protect data.

“All data is vulnerable even when in the process of being deleted, and Office should have had stringent measures in place regardless of the server or system used. The need and purpose for retaining personal data should also be assessed regularly, to ensure the information is not being kept for longer than required.”

“Fortunately, in this case there is no evidence to suggest that the information has been used any further and the company did not store any bank details.”

The data breach also highlights the risks associated with customers using the same password for all their online accounts.

Sally-Anne Poole added:

“This one incident could potentially have given the hacker access to numerous accounts that the clients held with other organisations, as passwords were included on the database in question. It’s important to use a unique, strong password for each separate account; preferably a combination of numbers and letters – not a name or dictionary word.”

Office has agreed to an “undertaking under the Data Protection Act 1998”, the details are here.

85% of mobile apps fail to provide basic privacy information

A survey of over 1,200 mobile apps by 26 privacy regulators from across the world has shown that a high number of apps are accessing large amounts of personal information without adequately explaining how people’s information is being used.

The survey by the Global Privacy Enforcement Network (GPEN) examined the privacy information provided by 1,211 mobile apps. As a member of GPEN, the UK’s Information Commissioner’s Office examined 50 of the top apps released by UK developers.

Today GPEN has published the results of its research. The key findings are:

85% of the apps surveyed failed to clearly explain how they were collecting, using and disclosing personal information.

More than half (59%) of the apps left users struggling to find basic privacy information.

Almost 1 in 3 apps appeared to request an excessive number of permissions to access additional personal information.

43% of the apps failed to tailor privacy communications to the small screen, either by providing information in a too small print, or by hiding the information in lengthy privacy policies that required scrolling or clicking through multiple pages. .

The research did find examples of good practice, with some apps providing a basic explanation of how personal information is being used, including links to more detailed information if the individual wants to know more. The regulators were also impressed by the use of just-in-time notifications on certain apps that informed users of the potential collection, or use, of personal data as it was about to happen. These approaches make it easier for people to understand how their information is being used and when.

ICO Group Manager for Technology, Simon Rice, said:

“Apps are becoming central to our lives, so it is important we understand how they work and what they are doing with our information. Today’s results show that many app developers are still failing to provide this information in a way that is clear and understandable to the average consumer.

 

“The ICO and the other GPEN members will be writing out to those developers where there is clear room for improvement. We will also be publishing guidance to explain the steps people can take to help protect their information when using mobile apps.”

The ICO has published ‘Privacy in Mobile Apps’ guidance to help app developers in the UK handle people’s information correctly and meet their requirements under the UK Data Protection Act. The guidance includes advice on informing people how their information will be used. Research carried out last year to support the guidance’s launch showed that 49% of app users have decided not to download an app due to privacy concerns.

From the UK Information Commissioners post which is here.

Travel company fined £150,000 after losing 1,163,996 Credit and Debit Card records

An online travel services company called Think W3 Limited, has been fined £150,000 after it breached the Data Protection Act.

Think W3 Limited was hacked in December 2012 after using insecure coding on the website of a subsidiary business, Essential Travel Ltd.

A hacker extracted a total of 1,163,996 Credit and Debit Card records. Of these records 430,599 were identified as current and 733,397 as expired.

Cardholder details had not been deleted since 2006 and there had been no security checks or reviews since the system had been installed.

Stephen Eckersley, The ICO’s Head of Enforcement, said:

This was a staggering lapse that left more than a million holiday makers’ personal details exposed to a malicious hacker.

“Data security should be a top priority for any business that operates online. Think W3 Limited accepted liability for failing to keep their customers’ personal data secure; failing to test their security and failing to delete out-of-date information.

“The public’s awareness of the importance of data protection is rising all the time. Ignorance from data controllers is no excuse. They must take active steps to ensure the personal data they are responsible for is kept safe or face enforcement action and the resulting reputational damage

The Information Commissioner’s fine will be in addition to the costs levied by the Credit Card schemes under PCI and the banks.

SMEs are putting larger customers at risk of security breaches

According to Shred-it’s third annual Security Tracker survey SMEs in the UK are putting their own businesses at risk and could also be damaging larger firms they supply services to by not taking enough preventative measures of confidential data.

It’s good business sense for larger companies to ask whether their suppliers have a data protection partner and an information security system in place – not only to prevent sensitive information being lost by a third party but also because the financial and reputational damage of a breach could put that supplier out of business and cause havoc in the supply chain,” warns Robert Guice, Vice President Shred-it EMEA.

The survey reveals SMEs are 10 times less likely to have an information security system set up than is the case with larger businesses.

SMEs continue to hugely underestimate the potential cost of a data breach to them. In terms of financial loss, the Information Commissioner’s Office in the UK can fine companies up to half a million pounds, enough to send many companies into insolvency”, Mr Guice said. “We believe that smaller companies maybe over-estimating the costs involved in making sure confidential information is kept safe

Whilst larger companies may be able to absorb this cost, SMEs risk a huge hit to their bottom line and a tarnished reputation which can impact relationships with customers and other business partners” Mr Guice continued.

There is a worrying gap between the protocols in place between smaller and larger businesses. Whilst companies with revenue over £1m are eight times more likely to use a professional shredding company to dispose of their sensitive documents, 37 per cent of small businesses in the UK have no information security management system in place. Moreover, three in ten (28 per cent) small business owners have never provided any information security training to their employees.

Key findings include

  • 2 in every 5 large businesses suffering a data breach have incurred losses of more than £500,000
  • The average fine is approximately £150,000 – large enough for 30% of companies to have to lay off staff as a result.
  • 77% of larger businesses have an employee directly responsible for managing information security issues at management level (66%) or board level (11%)
  • 48% of SMEs have a nominated person
  • 95% of large businesses have an employee devoted to data protection compared with only 53% of small business owners, suggesting that larger businesses better understand the potential threat of data breaches and have put control systems in place accordingly.
  • 33% of senior business executives and only 4% of small business owners use a professional shredding service
  • 88% of large businesses are more than twice as likely to be aware of the EU Data Protection Directive reforms as small businesses (43%).
  • Although the gap is closer, large businesses are still more likely to be aware of the UK Data Protection Act (92%) than small business owners (72%).
  • With more information being stored in electronic form, it is equally worrying that less than one quarter of large (23%) and small businesses (25%) crush their electronic media – which means the vast majority of UK businesses are inadvertently putting themselves and their customers at risk.
  • Businesses could be giving away private information to fraudsters by not properly disposing of or destroying hard drives. 66% of large business and 49% of small business owners wrongly think that degaussing or wiping a hard drive will remove confidential information kept on them.

.

UK’s Information Commissioner believes 2013 will the year businesses handle data correctly…!

2013 is the year that commercial imperative of good data handling will be realised

Speaking at the launch of the ICO’s annual report today, Christopher Graham will highlight that consumers have a strong awareness of how their data should be handled, and how this affects their relationship with businesses.

An ICO study into public attitudes toward data protection found that 97% of those surveyed were concerned that organisations would pass or sell-on their personal details. The survey also found more than half (53%) considered details of the products they had bought to be personal information.

Yet in spite of these consumer concerns, only 10% of businesses were aware of the legal limitations of how they could use customer’s personal data.

Information Commissioner Christopher Graham said:

Education and empowerment have been two of the key areas we’ve focused on in the past twelve months. That work is having real benefits: consumers’ awareness of their rights remains strong, and that is empowering people to demand more in return for their data.

“The result is consumers expecting organisations to handle their personal data in a proper way, and in a legal way. Businesses that don’t meet that basic requirement are going to quickly find themselves losing customers.

I think 2013 is the year that organisations will realise the commercial imperative of properly handling customer data. The stats we’ve seen about public concern around personal data show that, as does a company the size of Microsoft choosing privacy as a theme of a national advertising campaign.

“The message to business is simple: consumers understand the value of their personal data, and they expect you to too.

Find the complete report here.

Top Tips from the ICO for when you are moving premises – do not forget to check the cabinets being one

After another NHS body * decides to ignore simple Data Protection guidelines the UK Information Commissioner has repeated his Top 5 Tips to help organisations improve their approach to Data Protection, especially those moving premises:

  1. Personal information is at particular risk when moving premises – make sure its security is a priority. All but one of our monetary penalties issued under the Data Protection Act in 2012/13 were for failing to keep information secure.
  2. Don’t assume anything. This breach happened because two departments each assumed that the other was conducting a final check that all records had been removed or transferred as required. Make sure it is clear who is responsible for what.
  3. Ensure records and equipment containing personal information are moved securely. Where personal information is being moved to other premises, make sure there is a secure means of moving the information and check that it has all been received safely.
  4. Dispose with care. If moving premises requires the disposal of files or computer hardware, make sure that this is done in a secure manner. Remember you are still responsible for what happens to personal data even after it has left through the back door.
  5. Learn from your mistakes. Stockport Primary Care Trust had suffered two similar incidents before this breach, but senior management hadn’t been informed. Put a policy in place to make sure that security incidents are reported and acted upon so that you learn from your mistakes.

* The NHS Commissioning Board was been fined £100,000 by the Information Commissioner’s Office (ICO) after the dissolved Stockport Primary Care Trust left around 1,000 documents including work diaries, letters, referral forms and patient records containing personal information. Some of the documents contained particularly sensitive data relating to 200 patients, including details of miscarriages, child protection issues and, in one case, a police report relating to the death of a child.

The size of the fine reflects the serious nature of the breach and the fact it was not the first time the organisation had “lost information”.

David Smith, Deputy Commissioner and Director of Data Protection, said about the Stockport fine:

It’s crucial that organisations don’t take their eye off the ball when moving premises. This NHS trust’s efforts to keep its patients’ confidential records secure were completely undermined by its failure to properly decommission the premises it was leaving.

The highly sensitive nature of the documents left behind makes this mistake inexcusable, and there can be no doubt that the penalty we’ve served is both necessary and appropriate.

In the last year we have served two six figure penalties on organisations that have left large volumes of personal information behind when leaving a site. These penalties highlight the need for organisations to have effective decommissioning procedures in place and to make absolutely sure that these procedures are followed in practice

Finally a prosecution of a former employee stealing confidential information

Thousands of people everyday must copy, save or forward information for innocent or mischievous purposes but now there is a quotable case that can be used to deter such risky activities.

A former manager of a health service based at a council run leisure centre in Southampton has been prosecuted by the Information Commissioner’s Office (ICO) for unlawfully obtaining sensitive medical information relating to over 2,000 people.

Paul Hedges took the information hoping to use the data for a new fitness company he was setting up. He was prosecuted under section 55 of the Data Protection Act at West Hampshire Magistrates Court yesterday and fined £3,000 and ordered to pay a £15 victim surcharge and £1,376 prosecution costs.

Mr Hedges, who previously worked as a Community Health Promotions Manager based at Bitterne Leisure Centre, sent the information to his personal email account on 28 April 2011 after being told that he was being made redundant. The 42 year-old had previously been responsible for managing the council’s Active Options GP referral service, where patients would be referred by their GP or other health professional to attend fitness sessions, for a range of conditions including obesity, diabetes, arthritis, and cardiac and mild mental health issues.

The information included sensitive medical details relating to 2,471 patients. The council became aware of their former employee’s actions when they received complaints about patients being approached by Mr Hedges; who had since set up a similar service using the Active Options name and branding.

Christopher Graham the UK Information Commissioner was quoted as saying:

People have a right to privacy and the ICO works to maintain that right

Nobody expects that their health records will be taken and used in this way. Mr Hedges had been told by Southampton Council about the need to keep patients’ details confidential, but he decided to break the law.

This case shows why there is a need for tough penalties to enforce the Data Protection Act. At very least, behaviour of this kind should be recognised as a ‘recordable offence’ which it isn’t now. For the most serious cases the current ‘fine only’ regime will not deter and other options including the threat of prison should be available. The necessary legislation for this is already on the statue book but needs to be activated.

The government must ensure that criminals do not see committing data theft as a victimless crime and worth the risk.

Lack of guidance on BYOD raises data protection concerns

The UK Information Commissioner’s Office (ICO) has commissioned a survey into business attitudes towards Bring Your Own Device (BYOD).

The survey results shown many employers appear to have a ‘laissez faire’ attitude to allowing staff to use their personal laptop, tablets or smartphone for at work and for work business, which may be placing people’s personal information at risk.

The survey, carried out by YouGov, reveals that 47% of all UK adults now use their personal smartphone, laptop or tablet computer for work purposes. But less than 3 in 10 who do so are provided with guidance on how their devices should be used in this capacity, raising worrying concerns that people may not understand how to look after the personal information accessed and stored on these devices.

Simon Rice, Group Manager (Technology), said:

The rise of smartphones and tablet devices means that many of the common daily tasks we would have previously carried out on the office computer can now be worked on remotely. While these changes offer significant benefits to organisations, employers must have adequate controls in place to make sure this information is kept secure.

“The cost of introducing these controls can range from being relatively modest to quite significant, depending on the type of processing being considered, and might even be greater than the initial savings expected. Certainly the sum will pale into insignificance when you consider the reputational damage caused by a serious data breach. This is why organisations must act now.

“Our guidance aims to help organisations develop their own policies by highlighting the issues they must consider. For example, does the organisation know where personal data is being stored at any one time? Do they have measures in place to keep the information accurate and up-to-date? Is there a failsafe system so that the device can be wiped remotely if lost or stolen?

Today’s guidance from the ICO explains how organisations need to be clear on the types of personal data that can be processed on personal devices and have remote locate and wipe facilities in place so the confidentiality of the data can be maintained in the event of a loss or theft.

Key recommendations from the ICO’s guidance:

  • Be clear with staff about which types of personal data may be processed on personal devices and which may not
  • Use a strong password to secure your devices
  • Enable encryption to store data on the device securely
  • Ensure that access to the device is locked or data automaticaly deleted if an incorrect password is input too many times
  • Use public cloud-based sharing and public backup services, which you have not fully assessed, with extreme caution, if at all
  • Register devices with a remote locate and wipe facility to maintain confidentiality of the data in the event of a loss or theft

The survey results below shows that email is the most common work activity carried out on a personal device (55%) which consider what information can be in the body of an email or attached leaves an organisations open to many commercial, legislative and regulatory risks for example PCI DSS compliance.

All UK Adults online who use a smartphone, laptop or a tablet PC for work purposes access usage
Work email

55%

Accessing work files

35%

Storage   of work documents and work files

36%

Social networking (e.g. LinkedIn, Twitter, Facebook) for work

26%

Editing work documents

37%

Uploading   work information to a website

19%

Work video chat (e.g. skype etc.)

7%

Work related applications (Apps)

16%

Work related online banking

14%

Work related shopping

12%

Work related web browsing

35%

Other

22%

None of these

.

Nursing and Midwifery Council fined for breaching the Data Protection Act

The Information Commissioner’s Office has issued a £150,000 fine to the Nursing and Midwifery Council was for breaching the Data Protection Act. 

The Nursing and Midwifery Council lost three DVDs related to a nurse’s misconduct hearing, which contained confidential personal information and evidence from two vulnerable children. 

In October 2011 the DVDs, containing confidential information, was sent to a misconduct hearing via a courier and when the package arrived at the hearing the DVDs were missing and have never found 

After an investigation by the ICO it was found the information was not encrypted. 

David Smith, Deputy Commissioner and Director of Data Protection, said:

It would be nice to think that data breaches of this type are rare, but we’re seeing incidents of personal data being mishandled again and again. While many organisations are aware of the need to keep sensitive paper records secure, they forget that personal data comes in many forms, including audio and video images, all of which must be adequately protected. 

I would urge organisations to take the time today to check their policy on how personal information is handled. Is the policy robust? Does it cover audio and video files containing personal information? And is it being followed in every case? 

If the answer to any of those questions is no, then the organisation risks a data breach that damages public trust and a possible weighty monetary penalty.

The council had been couriering evidence relating to a ‘fitness to practise’ case to the hearing venue. When the packages were received the discs were not present, though the packages showed no signs of tampering. Following the security breach the council carried out extensive searches to find the DVDs, but they’ve never been recovered. 

The Nursing and Midwifery Council’s underlying failure to ensure these discs were encrypted placed sensitive personal information at unnecessary risk. No policy appeared to exist on how the discs should be handled, and so no thought was given as to whether they should be encrypted before being couriered. Had that simple step been taken, the information would have remained secure and we would not have had to issue this penalty.

.

The Information Commissioner provides an update on the European Data Protection Act

David Smith the UK’s Deputy Commissioner of the Information Commission has commented on the progress of the Revise European Data Protection Act.

Put simply, the proposals could prove to be one of the biggest changes to data protection this country has ever seen. Against that backdrop it is no surprise that we’ve been monitoring events in Europe closely, looking at how the initial reform proposals, published by the European Commission in January 2012, might be brought into law.

The process by which this proposal might become UK law is not a simple one, as our overview of the whole process shows. The crucial next step is for the European Parliament and the Council of the European Union to look at this separately before coming together to approve a final text. 

The European Parliament is where the MEPs sit, some 736 of them from across Europe. Much like our own Parliament, the MEPs will sit on several committees. There are five committees directly involved in looking at the data protection reforms: JURI (legal), ITRE (industry), IMCO (internal market and consumer protection), EMPL (employment) and LIBE (civil liberties). LIBE is the ‘lead’ committee. All committees will submit their own amendments before negotiating a consolidated Parliament view which is expected in late April. 

While that is happening, the council are also looking at the reforms. The council is made up of relevant ministers of each member state with responsibility for the issue at hand, although for practical purposes much of the work is done by government officials. For the data protection reform, the UK’s Ministry of Justice takes charge of the regulation, but works closely with the Home Office on the issue of the directive that will apply to law enforcement agencies. The subgroup of the council dealing with this issue is called DAPIX (Data Protection and Information Exchange) and is chaired by the Presidency of the Council – currently Ireland. The ICO has a key role in advising the Ministry of Justice throughout these discussions. 

At the time of writing, the parliamentary committees are well advanced in considering their compromise amendments on both parts of the package. The council, however, has not finished its first round of amendments. Nevertheless, with a timetable to adopt the new rules by the end of June – the end of the Irish Government’s presidency – this is one of the top priorities. The presidency is scheduling in more meetings to ensure that the negotiations can be completed as quickly as possible, to try to keep everything on track. 

Once both the parliament and the council have their consolidated views in what is known as the ‘First Reading’, they will need to negotiate, possibly over the summer if things go well, to get an agreement on the text. Failing this, they will move to the ‘Second Reading’ and further negotiations. 

Some of that negotiation will be around whether the reforms are in the form of a regulation, which will apply directly in every EU Member State, or a directive, which will need to be transposed in a more flexible way into national law. The proposal is for a general regulation with a directive specifically for the criminal justice sector. However there is speculation that this directive will be put on the back burner. This coupled with a move, which we and other data protection authorities are resisting, to confine the regulation to the private sector and develop a new directive to cover the public sector leave the outcome uncertain. Currently both the proposed regulation and the proposed directive allow two years for implementation following their coming into force. However experience suggests that because of its direct effect, implementation of any regulation will, in practice, come more quickly than implementation of any directive. 

In total, this means that the reform process will have taken around six years since the European Commission started its reflections on the matter. While this sounds like a long time we must remember that there are 27 Member States around the negotiating table; that’s at least 12 more than those negotiating our current framework which resulted in the Data Protection Act 1998! Even then the timescale is ambitious. Not many people expect agreement in June this year, but there is an imperative to get a package adopted by 2014 when the European Parliament and the commission are due for re-appointment. 

Crucially, the ICO has been involved throughout, and from several angles. It is extremely important that we, as the responsible regulator, pay attention at this crucial point in negotiations to what the proposals say, understand how they might affect the UK and use what influence we have to achieve a sensible outcome for individuals and businesses alike.

We recently published some of our thoughts on the latest developments which we passed to MEPs and other stakeholders. This builds on our initial analysis which we published last year to provide a core reference point explaining our views on the reforms.

In summary the Act is coming in 2013 but it is imperative that the Act comes because at the moment there are so many things missing that are essential for example mandatory disclosure of breaches and compulsory data officers for all companies over 250 employees. 

Lets hope they resolve it soon.

Create a free website or blog at WordPress.com.

Up ↑

%d bloggers like this: