GDPR: One year on 19 June 2019 Gareth Yates & Nathan Bilton Newcastle | Leeds | Manchester
2 Housekeeping Guest WiFi email: guest@wardhadaway.com | Guest WiFi password: F1rew0rk$ Newcastle | Leeds | Manchester
3 Introduction • ICO Decisions • Accountability • Data Breaches and Reporting Obligations • Subject Access Requests Newcastle | Leeds | Manchester
ICO Decisions • The majority of enforcement actions have concerned the Data Protection Act 1998 • The ICO received 14,072 breach notifications between May 2018 and May 2019, 4 times more than it received the previous year • Between 25 May 2018 and 24 May 2019: • The ICO issued 34 monetary penalties • The ICO issued 15 enforcement notices • The ICO made 9 prosecutions Newcastle | Leeds | Manchester
5 HMRC • HMRC launched a voice recognition system which requested callers to use their voice to confirm their identity, approximately 7 million callers were enrolled on this service • Callers were not given the choice to opt out of the service • The ICO investigation found that HMRC had failed to give callers sufficient information about the processing of their biometric data and had not given them the opportunity to give or withhold consent • The ICO held that the system represented a significant breach of the GDPR due to: • the large number of individuals affected; and • the significant power imbalance between HMRC and its customers • HMRC was issued with an enforcement notice and was required to delete all biometric data it held under the voice recognition system which it did not have explicit consent for Newcastle | Leeds | Manchester
6 London Borough of Newham • Newham Council was fined £145,000 after a Council employee sent a police intelligence database to 44 recipients • The database recorded information relating to more than 200 gang members including their home address and associated gang • Rival gang members obtained photographs of the database • When issuing the fine, the ICO placed emphasis on the fact that: • there was a real risk that the loss of control over the database would result in physical harm; • the Council failed to notify the ICO; • the investigation carried out by the Council was limited; and • the Council provided inaccurate and misleading responses to the ICO Newcastle | Leeds | Manchester
7 True Visions Productions • The ICO fined TVP £120,000 for unlawfully filming at a maternity clinic • TVP placed CCTV-style cameras and microphones in examination rooms, for use in a Channel 4 documentary • TVP posted notices near to the cameras and left letters on waiting room tables • The ICO investigation found that despite having the permission to be on site, TVP did not adequately inform patients that they would be filmed and nor did TVP get prior explicit consent from the patients affected by the filming Newcastle | Leeds | Manchester
8 Uber • The ICO fined Uber £385,000 for failing to protect its customers’ personal data during a cyber attack • Due to a series of avoidable security flaws, cyber attackers were able to access and download the names, email addresses and phone numbers of approximately 2.7 million UK customers and the records of around 82,000 UK drivers • The ICO found that the security arrangements adopted by Uber US (who acted as a processor on behalf of Uber) were inadequate • Uber did not notify the ICO or the affected individuals either at the time of the attack or when it first became aware of the attack • Uber also failed to take mitigating measures such as monitoring accounts or offering fraud protection until 12 months later Newcastle | Leeds | Manchester
9 Facebook Ireland Ltd and Facebook Inc • The ICO fined Facebook £500,000 for failing to protect its users’ personal data • Between 2007 and 2014, Facebook allowed third parties to operate apps on its platform and to obtain Facebook users' personal data without their consent • The third parties had access to the personal data of: • Facebook users who installed the app; • their Facebook friends who had not installed the app; and • those who exchanged Facebook messages with app users • One app, which was used by 300,000 Facebook users worldwide, harvested approximately 87 million user profiles. The data was shared with various organisations, including SCL Elections Ltd which controls Cambridge Analytica, and was used to target voters in political campaigns Newcastle | Leeds | Manchester
10 Heathrow Airport Limited • The ICO fined Heathrow Airport £120,000 for failing to ensure that the personal data held on its network was properly secured • A member of the public found a USB stick belonging to a Heathrow Airport employee which contained over 1,000 files • The USB stick was not password protected or encrypted and contained sensitive personal data including the name, nationality, date of birth, passport details and phone numbers of various individuals • The USB stick was handed to a national newspaper who made copies of the file • The ICO investigation found a "catalogue of shortcomings in corporate standards" and that only 2% of the workforce had been trained in data protection Newcastle | Leeds | Manchester
11 Equifax Ltd • The ICO fined Equifax Ltd £500,000 for failing to ensure that its US parent and processor protected UK customers' personal data • Equifax suffered a data breach which affected 146 million individuals, including 15 million UK citizens • The affected personal data included names, dates of birth, addresses, passwords, and financial details • The ICO's investigation revealed serious inadequacies which resulted in data being retained for longer than necessary and vulnerable to unauthorised access • When issuing the fine, the ICO placed emphasis on the fact that: • the loss of personal data by a credit rating agency is likely to cause individuals particular stress; • some of the personal data had the potential to be misused in the furtherance of fraud; and • the significant scale of the data breach is likely to undermine trust in the wider financial system Newcastle | Leeds | Manchester
Bounty • Bounty (UK) Limited fined £400,000 for illegally sharing personal information belonging to more than 14 million people. • Bounty’s “pregnancy and parenting club” collected personal information for the purpose of membership registration through its website and mobile app, merchandise pack claim cards and directly from new mothers at hospital bedsides. • Bounty also operated as a data broking service until 30 April 2018, supplying data to third parties for the purpose of electronic direct marketing. • Bounty breached the Data Protection Act 1998 by sharing personal information with a number of organisations without being fully clear with people that it might do so. • The company shared approximately 34.4 million records between June 2017 and April 2018 with credit reference and marketing agencies, including Acxiom, Equifax, Indicia and Sky. • The personal information shared was not only of potentially vulnerable, new mothers or mothers-to-be but also of very young children, including the birth date and sex of a child. Newcastle | Leeds | Manchester
13 Jayana Morgan-Davis • Former administration assistant at a used car dealership • Prosecuted for unlawfully obtaining the personal data of customers and other employees • Ms Morgan-Davis forwarded several work emails to her personal email account which contained personal data of customers and employees • Admitted 3 offences of unlawfully obtaining personal data in breach of s.55 DPA 1998 • Penalties: • £200 fine • £590 costs • £30 victim surcharge Newcastle | Leeds | Manchester
14 Kevin Bunsell • Former senior local government officer • Prosecuted for sharing the personal information of rival job applicants with his partner who had applied for a job at the Council • Mr Bunsell accessed the recruitment system and emailed the personal information of 9 shortlisted candidates to his partner’s email account • Penalties: • £660 fine • £713.75 costs • £66 victim surcharge Newcastle | Leeds | Manchester
15 Hannah Pepper • Former doctor’s surgery employee • Prosecuted for inappropriately accessing records of patients and staff members • Ms Pepper accessed the records of 228 patients and 3 staff members outside of her role • Penalties: • £350 fine • £643.75 costs • £35 victim surcharge Newcastle | Leeds | Manchester
Wendy Masterson • A former customer service advisor at Stockport Homes - prosecuted for accessing records relating to anti-social behaviour without authorisation. • An internal investigation found that she had inappropriately accessed cases without any business reason to do so - the records related to victims, witnesses and perpetrators of anti-social behaviour. • Penalties: • fined £300 • £364.08 costs • victim surcharge of £30 Newcastle | Leeds | Manchester
What can be learnt from these cases? • Make sure you understand all the types of data you are processing • Have you identified the correct lawful base for processing? • Are you only processing data you actually need? • Can you justify why you are processing the data? • Have you clearly notified individuals what you are doing with their data? • Has appropriate training been given? • Do you share data? Have you carried out a data protection assessment? Have you reviewed the Data Sharing Code? Newcastle | Leeds | Manchester
Recommend
More recommend
