Posts

Careless Talk Causes Breaches

…(and can be costly too!)

 

GDPR is not normally associated with parties, but recently I heard the end of a conversation about an office Christmas party and it set me thinking about the impact that a misplaced sentence can have. Friendships and working relationships can be badly damaged, in some cases, irreparable.

If I choose to pass on my unvarnished opinion about a colleague during the Christmas bash, then I can find myself in a lot of trouble. If on the other hand, I whisper information that has come from the data controller then not only am I in hot water, but I’ve also given the extra present of a data breach.

Paragraph 4, Article 32 of the GDPR says:

“The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.”

Put more simply, you must ensure that people are given clear guidance about what they can and can’t do with personal data and you must ensure they stick to those rules.

Bear in mind that it doesn’t matter how information is disclosed for it to be a breach. Whether you’ve been hacked, sent an email to the wrong person, lost a paper file or repeated information to someone who shouldn’t know it, a breach has occurred.

With verbal disclosure the situation is often made worse by the fact that our natural desire is to share more ‘interesting’ information, which is also usually more confidential and leads to greater upset.

We’ve seen examples where incidents have been dealt with from a disciplinary standpoint but have gone unrecognised as a data breach. Obviously, if you need to report the breach to the ICO, you’ll have to explain why you missed the 72-hour deadline for reporting. It is difficult to say that you have a sound regime for data protection but missed this high-profile target.

What steps should you take to avoid these issues:

Training
  • All your staff need to know about the risks of verbal disclosure. Include it in your normal GDPR training but you may need to provide a special briefing. As well as knowing that they need to notify your DPO or GDPR lead, it’s a great time to remind people of the perils of letting information slip.
Easy reporting
  • Take away any barriers that prevent staff from alerting you to an issue. Have an email address just for staff to alert you of issues or consider an online form.
A response procedure
  • If people do report issues then you need to have a well-established procedure to deal with them. Get it recorded and you can even practice to make sure the 72-hour deadline can be met.
Joined up processes
  • Issues which trigger disciplinary procedures may relate to data protection issues and vice-versa. Make sure that there is a section in the guidance for both areas that highlights the risks and include this in your general training and particularly induction training.

So, as you contemplate the upcoming festivities, it may be worth a timely reminder to everyone that we have to consider what we’re saying just as much a what goes into an email.

/by

How the Department for Education ran into trouble with the ICO

Being as clear as mud when it comes to Data Protection

A key principle of data protection is transparency. You must be upfront about what you plan to do with personal data.

A failure to be transparent has recently brought the Department for Education into the Information Commissioner’s Office’s sights. Information from the annual census returns was apparently shared with Immigration Officials, without the data subjects being informed. This is the opposite to what you should be doing.

According to an article in the Guardian the ICO position is that:

“Our view is that the DfE is failing to comply fully with its data protection obligations, primarily in the areas of transparency and accountability, where there are far reaching issues, impacting a huge number of individuals in a variety of ways.”

It’s not clear yet what the consequences for the DfE will be from these findings.

Just a few days before the news about the DfE broke, the Information Commissioner felt compelled to ensure that political parties understood their data protection responsibilities as we head towards the election in December.

In addition to telling the parties that they needed to follow the principles of data protection, she also specifically addressed the controversial issue from the Brexit Referendum and subsequent elections – advertising on social media.  You can read the Commissioner’s full statement here.

These concerns are about transparency. How do you know what someone is doing with your personal data and how that usage might affect your rights and freedoms? The GDPR is very clear about the information that should be provided especially when your personal data is being used. It’s not always clear how well individuals understand the information presented to them, if they are given any at all.

The principle of transparency doesn’t just apply to political parties and government departments. It should be the cornerstone of the data protection policies and practices for every organisation.

So, what does Transparency mean for an organisation in the Education sector?

  • You must be clear about why you are processing personal data
  • You must be able to show you’re using the minimum data necessary
  • You must be able to show you have a legal basis for your processing and sharing of data
  • You must take action to inform individuals about how their data is being processed

How can you demonstrate that you’re meeting these requirements?

Your data mapping, providing it follows the model set out by the ICO will address the first three and your privacy notices should address the last item.

Our experience is that many schools and colleges haven’t mapped their use of personal data to the level of detail that the regulation expects, and this could become a problem if a complaint is raised by a data subject.

You may know in detail how data is collected, stored, updated and shared, but the legislation requires that this is documented. Does your documentation fully cover the movement of personal data around the organisation?

Do your privacy notices strike the balance of informing individuals about how their data is used while being accessible and unambiguous.

While you try and figure out the fake news from the real around the election it may be a good time to ensure that you’re being properly open about the way you collect and use personal data.

If you are unsure how you process data, or would like some guidance on how to document this, please contact our GDPR experts on 0113 804 2035 or click here.

/by

Schoolboy branded ‘Harry2’ to comply with Data Protection

With the ‘Harry2’ story recently hitting the headlines, we ask, how far do Schools really need to take data protection?

Newhey Community Primary School have branded Harry Szlatoszlavek with a number 2 as his surname, so they can differentiate between him and another boy with the same first name.

The Rochdale based Primary School says they are complying to data protection regulations by not including surnames on notebooks, just in case they are taken out of the classroom.

Harry Szlatoszlavek’s mum Tanya had contacted the Information Commissioners Office and been informed this policy is not necessary.

Tanya strongly believes the School are taking away Harry’s own identity by branding him ‘Harry2’, she said ‘he even received a Christmas card saying ‘Harry2 from Jack2’

With this recent story, we thought it worth considering how far Schools need to go with compliance

The GDPR is a large piece of legislation which many find overwhelming. Schools have to deal with hundreds, sometimes thousands of students and their personal data.

We have outlined below some ‘GDPR Myths’ and the true situations;

  • All data breaches must be reported to the ICO

Truth: If a breach is likely to result in a risk to people’s rights and freedoms then it must be reported to the ICO within 72 hours. Not all breaches need to be reported and this decision ultimately lies with your Data Protection Officer to make the judgement as to report the breach or not.

  • Personal data can’t be processed without consent

Truth: Most of the personal data processed by schools and colleges is done on the basis of performing a public task, or under a contract. Consent is only really used where the data is not obligatory. Good examples are the consent to use photographs and giving information about ethnic origin.

  • All student records must be deleted once they have left the School

Truth: When a student moves school, it is a legal requirement that their main pupil file move with them, this applies to transfers between schools as well as the transition between primary and secondary school. Schools can keep information about the registration of pupils.

  • It is against data protection regulations to take photos of students

Truth: The key word we always need to consider here is “necessary”. If you need photos to demonstrate a pupils’ progress, for example, this can be considered necessary. A photo to be used on a Management Information System is a standard requirement. In other circumstances you may need to gain consent to use photos. Providing you have considered your justification, there is no prohibition on using photos.

  • No surnames should be on any documentation which could be removed from the school premises

Truth: This comes back to the same question of something being necessary. If you have 20 children in a school called Emily, then a surname will be essential to differentiate between them. The GDPR is interested in ensuring that data is protected appropriately when it is being used, not trying to determine how is can be used.

 

If you are unsure on how to be fully compliant with the GDPR, please feel free to get in touch with our Education GDPR specialists here.

/by

Deal or No Deal; How Will Brexit Affect GDPR?

Among the political turmoil as we approach the deadline of the 31st October for leaving the European Union, data protection is now being mentioned. Some schools have received guidance about actions that may need to be taken.

The essentials of the situation are these. Despite us having gone to considerable effort to implement GDPR and to enshrine it within UK law, in the event of a No-Deal Brexit, the UK will not be considered an acceptable country for storing personal data about EU citizens under the GDPR.

It would have been expected that a Brexit deal would have included this ‘Adequacy’ decision.

The question is about the how the GDPR regulates International Transfer of information. It applies when an organisation inside the European Economic Area (EEA) sends data to an organisation in the UK. It does not apply when the data is being provided directly by the data subject themselves.

So, for example if a school in France is providing information about a group of students coming on an exchange trip then this would be a transfer between two data controllers. In contrast, if a student from France registers to attend a college in the UK, that would not count as an international transfer.

What needs to be done?

If we have a No-Deal Brexit you need to consider if a data controller in an EEA country is transferring personal data to you. Examples might be getting funding information about international students or receiving references about members of staff from organisational in the EEA.

The Information Commissioners Office has provided a handy tool to create a contract between controllers to enable this transfer to continue. You can find the tool here and you should definitely consult your data protection officer, who can provide more details.

If you would like further information on GDPR, and how it may affect your education facility, please contact us via our contact form or call 0113 804 2035.

/1 Comment/by
data breaches

Managing Data Breaches

Data Breaches Happen

How will you deal with one?

 

Breaches come in many shapes, sizes, and severities. It’s critical to recognise that an integrity breach with a single inaccurate word can be as serious as a classic confidentiality breach.

Part of your training for all staff needs to be about recognising when a data breach has happened. For schools’ breaches often involve misplaced papers or devices or emails sent to the wrong person. Although hacking does occur it represents a small fraction of the breaches reported by educational establishments.

Staff should know to look for:

  • Information being put in the hands of the wrong people
  • Paperwork or devices being lost or stolen
  • Significant errors in information – including being out of date
  • Issues with email both recipients and content

Handling a breach effectively is practical, preventing breaches is nearly impossible

 

Here are some elements you’ll need in your breach plan:

 

INVESTIGATION

The fundamentals

You’re in the 72 hour window.

  • Get the facts, don’t look for blame
  • Involve the person who discovered the breach
  • Make records, you’ll need them later

Critical things to know.

  • How many people might be affected
  • What sort of data is affected and how much of it
  • An initial understanding of how the breach happened
  • Has anyone been affected by the breach
  • How might people be affected

Difficult, but must be done.

  • If you think criminal action is involved report it to the police
  • You might have to initiate disciplinary action

 

MITIGATION

Where possible;

Depending on the nature of the breach, there may be little that can be done

  • The type of breach governs what can be done
  • The objective is to minimise the harm that may come from the breach
  • By acting quickly then it’s possible to stop any harm

There is no rocket science here.

  • Lost devices may be able to be remotely locked or wiped
  • Credentials can be forced to be changed (even if that’s everyone)
  • Incorrectly distributed material can be recovered
  • Inaccurate information can be updated

But remember:

  • Keep records of all the actions you take
  • Don’t create a new breach by updating with inaccurate information
  • Rushing to tell affected individuals may make the situation worse

 

NOTIFICATION

A need to know basis:

This is where you need a level head and good advice

  • You need the initial investigation and know that mitigation is underway
  • This is a judgement about the risk to the data subjects
  • You don’t have to have evidence of harm before reporting

The basic decision seems simple.

  • What might happen because of the breach
  • How likely are those consequences?
  • What might the emotional impacts of the breach be
  • What might people need to do to protect themselves from further harm

Reporting requirements:

  • All the information gathered in the investigation is required
  • If you can, report by calling the ICO – have the paperwork ready
  • The report is often not the end of the process

 

REPAIR

Stopping it happening again.

The reason why you need to keep a breach record:

  • Record the details of every breach
  • Patterns can tell you something is wrong
  • Having no breaches logged probably means you’re not spotting them

Delivering a long-term fix can require several actions, for example:

  • Identifying that there is a need for additional training
  • Implementing additional protections to existing situations (having lockable drawers for example)
  • Introducing new working methods (cloud storage rather than USB storage)

Sometimes more detailed work is required.

  • If a particular system or process has been involved in more than one breach, you need to understand why
  • Undertaking a Data Protection Impact Assessment will help you isolate the weaknesses
  • This may lead to significant changes to the way you process personal data.

 

For further information on managing breaches, speak to our team today.

/by

Why Schools Should Do Their Homework Too

With so much confusion and little understanding around GDPR, we were always expecting some interesting headlines.

This week, The BBC reported how a local authority in Sweden incurred a large fine, after trialling facial recognition on students to keep track of attendance.


The Swedish Data Protection Authority (DPA) fined Skelleftea Municipality  200,000 Swedish Krona (£16,800) for flouting a privacy law.

The trial took place in autumn 2018 and had been so successful, the school considered extending it. The DPA noted that, if the trial had been carried out for longer, the fine would have been significantly higher.

The reasons behind the fine…

The GDPR, which came into force last year, classes facial images and other biometric information as being special category personal data (we used to call it sensitive data), with added restrictions on its use.

Although the Swedish local authority did receive parental consent for such actions, the local authority still needed to show it was necessary to use biometric data rather than an alternative.


The local authority had broken the third principle of data protection by using personal data beyond that which was necessary to manage the task of tracking and monitoring attendance.

As a result, the DPA found that Skelleftea’s local authority had unlawfully processed sensitive biometric data, as well as failing to complete an adequate impact assessment, which would have included consulting the regulator and gaining prior approval before starting the trial.

From the school’s point of view, they may have seen this as a great management initiative, a safe and secure way of tracking attendance, thus reducing the time teachers spend monitoring this, but unfortunately for them, they had not done their homework on GDPR.

Read the full story here

/by

New Term, New Data, New Risks?

We are all guilty of shuddering a little when hearing the words ‘GDPR’, right? This is especially true when facing the beginning of the new academic year. The maze of legislation, the do’s and don’ts of data, what to do when a data breach occurs? These are common concerns for many education providers around the UK.

The bad news is, data breaches need to be taken seriously and dealt with appropriately, the good news, there is support available to help you deal with them.

Any organisation within the Education sector, dealing with the personal data of students and staff must be compliant. It is also a legal requirement for schools and colleges in the state sector to have a data protection officer (DPO).

What does ‘being compliant’ mean?

You should be able to answer the questions below confidently, but also show how you do them – where do you keep a record of all data breaches? How do you know when these should be reported to the ICO?

• How does personal data flow across your school, trust or college?

• Having does your organisation deal with data breaches?

• What happens if someone makes a subject access and other requests?

• Who has data protection expertise within the organisation?

• Have all your staff been trained?

Breaches come in many shapes, sizes, and severities. It’s critical to recognise that an integrity breach with a single inaccurate word could be as serious as a confidentiality breach.

We have put together a ‘To Do’ list when dealing with a data breach;

• When dealing with a breach, you should always start with the assumption that you’ll be notifying the ICO, in which you only have 72 hours to do so.

• Get the facts, don’t look for blame and always involve the person who discovered the breach.

• You’ll need records later, so begin making records now with every action you take.

• Get the initial investigation going and know that mitigation is underway.

• You must make a judgement about the risk to the data subjects.

• You don’t have to have evidence of harm to make a report, gather all the information for the investigation. If you can, report by calling the ICO with the paperwork ready. Remember, the report is often not the end of the process

The above outlines a simple checklist for dealing with a data breach, but as we all know, data breaches are just a small percentage of compliance.

As practicing Data Protection Officers, we can provide support and advice on data breaches as well as SAR’s, DPIA’s, processes, supplier data and more. Speak with our team today.

/by