Search

Brian Pennington

A blog about Cyber Security & Compliance

Tag

Privacy

Elizabeth Denham’s speech at the Data Protection Practitioners’ Conference 2017

6th march Manchester, UK.

Good morning, and welcome to Manchester. It’s cold and it’s grey, but for those of us who live around here, we kind of like it, and we’re proud it’s where the biggest data protection conference of the year takes place.

We’ve got a busy schedule today. Lots on GDPR, of course. Trevor Hughes from IAPP talking about the role of the data protection officer internationally. Practical workshops on everything from breach notification to consent. And a very engaging information market – the speakers’ corner looks sure to be a conversation starter, and don’t miss our experts talking about the law enforcement directive too.

So lots to engage you. Let’s get started by getting your grey matter warmed up: a quick general knowledge quiz. One question:

What links the following:

  • the Labour Party;
  • international weightlifting;
  • the music you heard when I entered the room; and
  • the ICO?

The answer is right before your eyes: all have performed right here at this venue. I’m not sure which of the four had the rowdiest audience…!

Manchester Central has been the home of the Data Protection Practitioners Conference for the best part of a decade, and I’m sure you’ll agree it’s an excellent venue. It was converted from a railway station built more than 125 years ago by Sir John Fowler, the architect famed for his work on the Forth Railway Bridge.

Sir John once said: “Engineers are not mere technicians and should not approve or lend their name to any project that does not promise to be beneficent to man and the advancement of civilization.”

DPOs in the mainstream

I think there’s something in that comment for us here today. About not merely being technicians. About looking to see how the projects we contribute to can be beneficial to citizens. How we can put the customer first.

I don’t think that’s too grand an aim. This is an exciting time to be in data protection. Like many of you, I’ve worked in this sector a long time. I remember when we were a back office function. When we often were seen as “mere technicians”. That seems a very long time ago.

My colleague Rob Luke, who you’ll hear from shortly, is speaking before an advertising conference later this week. Fifteen years ago, which advertiser would have invited the data protection regulator to their annual event? Who thought data protection when they booked a slot in the ad break during Coronation Street? But today, data protection is central to their work. Making the most of customer data. Combining big data sets. Finding new ways to better understand what consumers want, to track how they act or predict what they will do next.

Last week, we opened an inquiry into privacy risks arising from the use of data analytics for political purposes following public reports about the role of private firms in the Brexit referendum. We often find ourselves at the heart of many debates of modern society.

It’s an exciting time to work in data protection, whatever your sector, with real opportunities. We’ll talk a lot today about the practical aspects, from how GDPR will change things at your organisations, to the steps you can take to use the coming change in the law as an opportunity to inform your practices.

But let’s not lose sight of what good data protection can achieve. We have an opportunity to set out a culture of data confidence in the UK. We just need to keep in mind that when we lend our name to projects, we should think about how they can be of benefit to citizens.

Review of last 12 months

I think it’s fair to say that a recap of the files we’ve been involved in over the past twelve months can be characterised by organisations failing to put customers first.

Our work with WhatsApp and Facebook springs to mind. We all rely on digital services for important parts of our lives. But my office felt these apps were not taking enough responsibility for data protection. Companies have legal responsibilities to treat people’s data with proper care and transparency – to give them persistent control and choice.

Similarly the record fine we issued to TalkTalk. You could write an essay discussing the technical detail of the cyber-attack itself, but fundamentally, not enough respect – not enough care – was being given to the type of protection consumers would have expected of their personal information.

And without rehearsing the conversations we’ve had with parts of charity sector, there’s a similar theme: insufficient thought about the level of transparency donors would want, expect, or support.

They’re examples of organisations getting it wrong under the current Data Protection Act. GDPR is going to put even more of an onus on organisations to understand and respect the personal privacy rights of consumers.

GDPR

Because while the General Data Protection Regulation builds on the previous legislation, it provides more protections for consumers, and more privacy considerations for organisations. It brings a more 21st century approach to the processing of personal data.

The GDPR gives specific new obligations for organisations, for example around reporting data breaches and transferring data across borders.

But the real change for organisations is understanding the new rights for consumers.

Consumers and citizens will have stronger rights to be informed about how organisations use their personal data. They’ll have the right to request that personal data be deleted or removed if there’s no compelling reason for an organisation to carry on processing it, and new rights around data portability and how they give consent.

On that subject, do take a look at the guidance on consent that is now out for consultation, and will be discussed at our workshop later today.

Accountability and breadth

At the centre of the GDPR is the concept of broader and deeper accountability for an organisation’s handling of personal data. The GDPR brings into UK law a trend that we’ve seen in other parts of the world – a demand that organisations understand, and mitigate – the risks that they create for others in exchange for using a person’s data. It’s about a framework that should be used to build a culture of privacy that pervades an entire organisation. It goes back to that idea of doing more than being a technician, and seeing the broader responsibility and impact of your work in your organisation on society.

Making it matter to the boardroom

I’ve already spoken to some of you this morning, and I hear what you’re saying. You understand why having your organisation accept more accountability for data protection matters. You want to change the culture of your organisation. But in many cases, you need to convince your senior management first. So, what can I give you today to help you make that case when you go back to your offices tomorrow?

The fines are the obvious headline. The GDPR gives regulators greater enforcement powers. If an organisation can’t demonstrate that good data protection is a cornerstone of their business policy and practices, they’re leaving themselves open to enforcement action that can damage their public reputation and possibly their bank balance. That makes data protection a boardroom issue.

But there’s a carrot here as well as a stick, and as regulators we actually prefer the carrot. Get data protection right, and you can see a real business benefit.

Accepting broad accountability for data protection encourages an upfront investment in privacy fundamentals, but it offers a payoff down the line, not just in better legal compliance, but a competitive edge. Whether that means attracting more customers or more efficiently meeting pressing public policy needs, I believe there is a real opportunity for organisations to present themselves on the basis of how they respect the privacy of individuals. Over time this can play a real role in consumer choice.

What the ICO is doing

Gandhi said the future depends on what we do in the present. So let me talk a little about what my office is doing now, to help you prepare for the future.

I’ve worked as a regulator in this field for more than twelve years and my focus has always been on making sure the regulator is relevant. On making sure we’re taking on that challenge of not being mere technicians but instead are making a difference to the organisations we regulate through education. Making a difference to the public, through giving them an avenue to file a complaint and by sanctioning the bad actors.

Each of us in the information rights field, on a daily basis, tries to make a difference to the public. Collectively, we do a good job: I think people have never been more aware of their rights, of what they can expect of the businesses and organisations they trust with their data. But consumer trust hasn’t followed that. An ICO survey last year showed only one in four UK adults trust businesses with their personal data. And I don’t believe the figure would be much higher for the public sector. As a regulator, it’s one of my jobs to give you the tools and the support to turn that around.

I want to see comprehensive data protection programs as the norm, organisations better protecting the data of citizens and consumers, and a change of culture that makes broader and deeper data protection accountability a focus for organisations across the UK. I think that’s achievable.

We’ll be shortly announcing work we’ll be doing to contribute to that. We want to support independent research that helps people better navigate the digital world. Our research and grants programme will dedicate funds over the next five years to engaging the research community in finding ways to help consumers. More details in due course.

Post Brexit

And of course we need to be looking to the horizon, to what might exist beyond GDPR.

Fourteen months ago I was writing a speech for a different audience, in a different role. My appearance was at the Canadian annual privacy and security conference, as information and privacy commissioner for British Columbia. I was talking about the challenges of a digital economy that required data to flow across borders, where different legal systems and cultural norms about privacy make this a complicated undertaking. More specifically, I spoke about how changes within the EU affect those outside of it, particularly around adequacy.

How familiar does that sound today? The UK EU referendum decision means we’re facing the same challenges. The UK’s digital economy needs data to flow across borders: how do we make sure that can happen? How can we foster economic growth while still respecting citizen’s rights?

When the government comes to answer those questions beyond the implementation of GDPR in 2018, we expect to be at the centre of many conversations, speaking up for continued protection and rights for consumers, and clear laws for organisations. And addressing the strong data protection laws we’d need if we want to keep the UK’s approach at an equivalent standard to the EU.

Conclusion

Which brings us back to today. The GDPR is a strong data protection law. It gives consumers more control over their data. And it includes new obligations for organisations.

Today is about learning more about those obligations, more about data protection best practice, more about how to get it right.

Today is about helping you make the best use of tomorrow.

DataMotion_IG4_BriefHistoryofHCDataBreaches_092915

ICO response to ECJ ruling on personal data to US Safe Harbor

The ICO has issued a statement in response to the European Court of Justice ruling about the legal basis for the transfer of personal data to businesses that are members of the US Safe Harbor

Deputy Commissioner David Smith said:

“Today’s ruling is clearly significant and it is important that regulators and legislators provide a considered and clear response. This ruling is about the legal basis for the transfer of personal data to businesses that are members of the US Safe Harbor. It does not mean that there is an increase in the threat to people’s personal data, but it does make clear the important obligation on organisations to protect people’s data when it leaves the UK.

“The judgment means that businesses that use Safe Harbor will need to review how they ensure that data transferred to the US is transferred in line with the law. We recognise that it will take them some time for them to do this.

“It is important to bear in mind that the Safe Harbor is not the only basis on which transfers of personal data to the US can be made. Many transfers already take place based on different provisions. The ICO has previously published guidance on the full range of options available to businesses to ensure that they are complying with the law related to international transfers. We will now be considering the judgment in detail, working with our counterpart data protection authorities in the other EU member states and issuing further guidance for businesses on the options open to them. Businesses should check the ICO website for details over the coming weeks.

“Concerns about the Safe Harbor are not new. That is why negotiations have been taking place for some time between the European Commission and US authorities with a view to introducing a new, more privacy protective arrangement to replace the existing Safe Harbor agreement. We understand that these negotiations are well advanced.”

UK Businesses unprepared for changes to the Data Protection Act

Crown Records Management survey of IT decision makers reveals companies are woefully unprepared for EU General Data Protection Regulation.

European politicians met on the 24th June 2015 in a bid to ratify huge changes in data protection regulation, but a survey has revealed UK businesses are woefully unprepared.

The EU General Data Protection Regulation aims to unify data protection across Europe with a single law and will be fine-tuned in Brussels at a ‘trilogue’ meeting of the EU Commission, European Parliament and the Council of the EU.

Once passed, it will bring with it huge fines (up to 100m Euros or 2% of global turnover) for companies that breach the regulation – as well as a raft of new rules about collecting, editing and processing the personal data of European citizens. Many companies will also be compelled to employ at Data Protection Officer for the first time.

Experts predict it will affect every single company that operates from within the EU, does business with companies inside the EU, stores its data in EU member countries or handles the personal data of European citizens.

A Crown Records Management Censuswide survey of IT decision makers at UK companies with more than 200 employees revealed businesses here are painfully unprepared – and one in five hasn’t even heard of the Regulation.

Results include:

  • 19.6% are totally unware of the changes
  • 29.4% of decision makers aged 55+ know nothing about the challenges ahead
  • 25.3% will wait for the final details of the Regulation before taking any action at all
  • 52% who know about the Regulation still aren’t currently reviewing policies
  • 42.5% of decision makers in companies with a turnover of more than £500m are ‘not really concerned’ or ‘not concerned at all’ about the impact of the new structure.
  • 63% have not yet appointed a Data Protection Officer, which will soon become compulsory for many companies
  • 59% have no plans in place to train staff despite the changes looming

Reproduced from Crown Records Management.

Read my 2012 review of the Proposed European Data Protection Act here 

Who breached the Data Protection Act in 2014 (UK)? Find the complete list here.

Who breached the Data Protection Act in 2013(UK)? Find the complete list here.

Who breached the Data Protection Act in 2012(UK)? Find the complete list here.

ICO, Michael McIntyre and the Data Protection Act

ICO response to police force tweeting Michael McIntyre’s picture:

Police forces like all other organisations must comply with the Data Protection Act. The police especially must ensure that they have legitimate grounds for processing personal data and disclosing images of this nature without a justifiable policing purpose could potentially breach the Data Protection Act. We will follow this up with the Force concerned

I have often wondered about the sharing of images and how in certain circumstances it could lead to the wrong person or a known person being identified e.g. a photo-fit image created by a Police Artist often looks like everyone’s next door neighbour.

Equally if a person in the public spot light cannot have their image shared by a public body then how can a media outlet, who is also governed by the Data Protection Act, show images that people do not want sharing.

It will be interesting to see what the outcome will be and if Michael McIntyre complains.

DMA Privacy

Shadow Cloud Services 20 Times More Prevalent than Sanctioned Cloud

Skyhigh Networks released its new “Cloud Adoption & Risk in the Government Report.” The Q1 2015 report reveals that shadow IT is prevalent in government agencies.

The average public sector organization uses 742 cloud services, which is about 10-20 times more than IT departments expect. Despite the security initiatives in place, such as FedRAMP, FISMA, and FITARA, many government employees are unaware of agency rules and regulations or simply ignore them and use cloud services that drive collaboration and productivity.

As agencies grapple with how to manage shadow IT and securely enable sanctioned IT, they need visibility into the real usage and risk of cloud services as well as the ability to detect threats and seamlessly enforce security, compliance, and governance policies,” said Rajiv Gupta, CEO of Skyhigh Networks. “Skyhigh manages shadow IT and securely enables sanctioned IT, allowing public sector organizations to use hundreds of cloud services while providing robust data protection services, thereby meeting data privacy requirements and conforming to regulations

Despite clear benefits of cloud services Federal agencies are slow to migrate to the cloud due to security concerns. As a result, employees adopt cloud services on their own, creating shadow IT. Under FITARA, Federal CIOs must oversee sanctioned cloud services as well as shadow IT. This new requirement underscores the uncertainty about how employees are using cloud services within their agencies.

Understanding Shadow IT
The average public sector organization now uses 742 cloud services, which is about 10-20 times more than IT departments report. What agencies don’t know can hurt them. When asked about insider threats, just 7% of IT and IT security professionals at public sector organizations indicated their agency had experienced an insider threat. However, looking at actual anomaly data, Skyhigh Networks found that 82% of public sector organizations had behavior indicative of an insider threat.

Agencies cannot rely on the security controls offered by cloud providers alone. Analyzing more than 12,000 cloud services across more than 50 attributes of enterprise readiness developed with the Cloud Security Alliance, the report found that just 9.3% achieved the highest CloudTrust Rating of Enterprise Ready. Only 10% of cloud services encrypt data stored at rest, 15% support multi-factor authentication, and 6% have ISO 27001 certification. Skyhigh Networks helps Federal agencies address these security gaps and gain control over shadow IT by providing unparalleled visibility, comprehensive risk assessment, advanced usage and threat analytics, and seamless policy enforcement.

Password Insecurity
Compromised credentials can also mean disaster for Federal agencies. According to a study by Joseph Bonneau at the University of Cambridge, 31% of passwords are used in multiple places. This means that for 31% of compromised credentials, attackers can potentially gain access not only to all the data in that cloud service, but all the data in other cloud services as well. The average public sector employee uses more than 16 cloud services, and 37% of users upload sensitive data to cloud file sharing services. As a result, the impact of one compromised account can be immense.

The Skyhigh “Cloud Adoption & Risk in the Government Report” reveals that 96.2% of public sector organizations have users with compromised credentials and, at the average agency, 6.4% of employees have at least one compromised credential.

Cloud Services in the Public Sector
Most cloud services deployed in the public sector are collaboration tools. The average organization uses 120 distinct collaboration services, such as Microsoft Office 365, Gmail, and Cisco Webex. Other top cloud services are software development services, file sharing services, and content sharing services. The average employee uses 16.8 cloud services including 2.9 content sharing services, 2.8 collaboration service, 2.6 social media services, and 1.3 file sharing services. Shockingly, the average public sector employee’s online movements are monitored by 2.7 advertising and web analytics tracking services, the same services used by cyber criminals to inform watering hole attacks.

The report also reveals the top cloud services used in the public sector.

Top ten enterprise cloud services are:-
1. Microsoft Office 365
2. Yammer
3. Cisco WebEx
4. ServiceNow
5. SAP ERP
6. Salesforce
7. DocuSign
8. NetSuite
9. Oracle Taleo
10. SharePoint Online

Top ten consumer cloud services are:-
1. Twitter
2. Facebook
3. YouTube
4. Pinterest
5. LinkedIn
6. Reddit
7. Flickr
8. Instagram
9. StumbleUpon
10. Vimeo

The “Cloud Adoption & Risk in the Government Report” is based on data from 200,000 public sector employees in the United States and Canada.

Most Healthcare Organisations Have Experienced A Data Breach

The Fifth Annual Benchmark Study on Privacy & Security of Healthcare Data reveals that the majority of healthcare organizations represented in this study have experienced multiple security incidents and nearly all have faced a data breach. Despite the universal risk for data breach, the study found that many organizations lack the funds and resources to protect patient data and are unprepared to meet the changing cyber threat environment.

The 2015 study was expanded beyond healthcare organizations to include Business Associates.

Represented in this study are 90 covered entities (hereafter referred to as healthcare organizations) and 88 business associates (hereafter may be referred to as either business associates or BAs). A BA is a person or entity that performs services for a covered entity that involves the use or disclosure of protected health information (PHI), according to the U.S.

Department of Health & Human Services. The inclusion of BAs provides a broader perspective of the healthcare industry as a whole and demonstrates the impact third parties have on the privacy and security of patient data. Respondents were surveyed about their privacy and security practices and experiences with data breaches, as well as their experiences with both electronic and paper security incidents.

Data breaches in healthcare continue to put patient data at risk and are costly. Based on the results of this study, they estimate that data breaches could be costing the industry $6 billion.

  • 90% of healthcare organizations represented in this study had a data breach
  • 40% had more than five data breaches over the past two years

According to the findings of this research, the average cost of a data breach for healthcare organizations is estimated to be more than $2.1 million. No healthcare organization, regardless of size, is immune from data breach. The average cost of a data breach to BAs represented in this research is more than $1 million. Despite this, half of all organizations have little or no confidence in their ability to detect all patient data loss or theft.

For the first time, criminal attacks are the number one cause of data breaches in healthcare. Criminal attacks on healthcare organizations are up 125% compared to five years ago. In fact, 45% of healthcare organizations say the root cause of the data breach was a criminal attack and 12 % say it was due to a malicious insider. In the case of BAs, 39% say a criminal attacker caused the breach and 10% say it was due to a malicious insider.

The percentage of criminal-based security incidents is even higher; for instance, web-borne malware attacks caused security incidents for 78% of healthcare organizations and 82% for BAs. Despite the changing threat environment, however, organizations are not changing their behaviour, only 40% of healthcare organizations and 35% of BAs are concerned about cyber attackers.

Security incidents are part of everyday business. 65% of healthcare organizations and 87% of BAs report their organizations experienced electronic information-based security incidents over the past two years.

  • 54% of healthcare organizations suffered paper-based security incidents
  • 41% of BAs had such an incident

However, many organizations do not have the budget and resources to protect both electronic and paper-based patient information. For instance, 56 % of healthcare organizations and 59% of BAs don’t believe their incident response process has adequate funding and resources. In addition, the majority of both types of organizations fail to perform a risk assessment for security incidents, despite the federal mandate to do so.

Even though medical identity theft nearly doubled in five years, from 1.4 million adult victims to over 2.3 million in 2014, the harms to individuals affected by a breach are not being addressed. Many medical identity theft victims report they have spent an average of $13,500 to restore their credit, reimburse their healthcare provider for fraudulent claims and correct inaccuracies in their health records.

Nearly two-thirds of both healthcare organizations and BAs do not offer any protection services for patients whose information has been breached.

Since 2010, this study has tracked privacy and security trends of patient data at healthcare organizations. Although the annual economic impact of a data breach has remained consistent over the past five years, the most-often reported root cause of a data breach is shifting from lost or stolen computing devices to criminal attacks. At the same time, employee negligence remains a top concern when it comes to exposing patient data. Even though organizations are slowly increasing their budgets and resources to protect healthcare data, they continue to believe not enough investment is being made to meet the changing threat landscape.

Key Findings

In this section, they provide a deeper analysis of the findings. They have organized this report according to the two following topics:

  • Privacy and security of patient data in healthcare organizations and business associates
  • Five-year trends in privacy and security practices in healthcare organizations

To respond quickly to data breaches, organizations need to invest more in technologies.

  • 58 % of healthcare organizations agree that policies and procedures are in place to effectively prevent or quickly detect unauthorized patient data access, loss or theft.
  • 49% agree they have sufficient technologies
  • 33% agree they have sufficient resources to prevent or quickly detect a data breach.
  • 53% of organizations have personnel with the necessary technical expertise to be able to identify and resolve data breaches involving the unauthorized access, loss or theft of patient data.

Background

  • Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards.
  • A security incident is defined as a violation of an organization’s security or privacy policies involving protected information such as social security numbers or confidential medical information. A data breach is an incident that meets specific legal definitions per applicable breach law(s). Data breaches require notification to the victims and may result in regulatory investigation, corrective actions, and fines.
  • This is based on multiplying $1,067,400 (50% of the average two year cost of a data breach experienced by the 90 healthcare organizations in this research) x 5,686 (the total number of registered US hospitals per the AHA).

A review of websites and apps targeted at children is underway

The UK Information Commissioners Office (ICO), the enforcer of the Data Protection Act, has begun a review of websites and apps used by children as part of an international project to consider privacy concerns around the type of personal information services collect.

The ICO will look at 50 websites and apps, looking particularly at

  • what information they collect from children
  • how that is explained
  • what parental permission is sought

The websites and apps will include those specifically targeted at children, as well as those frequently used by children.

The same approach will be taken by 28 other privacy enforcement authorities from around the world, with a view to publishing a combined report in the autumn. The ICO will also consider action against any website or app that it finds to be breaking the Data Protection Act.

Steve Eckersley, ICO Head of Enforcement, said:

Anyone with children knows how many websites and apps are now targeted at them, and how popular they are with children. That’s true from Canada to Columbia, and the same concerns exist around what information the companies behind these services are gathering.

In the UK, we’re clear that apps and websites should not gather more personal data than they require, and operators should be upfront about how and why they collect information and how they use it. . These principles are true whatever the audience, but they are especially true where children are concerned. This research should give us a valuable insight into whether companies in the UK are operating compliantly, as well as how that fits with what is happening around the world

The work is coordinated by the Global Privacy Enforcement Network, and follows previous reports on website privacy policies, and how apps collect personal data. This year’s focus was chosen after privacy enforcement authorities identified a growing number of websites and mobile apps targeted at, or popular among, children.

Create a free website or blog at WordPress.com.

Up ↑

%d bloggers like this: