On 18 May 2020, the Ministry of Housing Communities and Local Government (MHCLG) wrote to all social housing residents in England (residents).
With all the uncertainty around Brexit following the defeat in Parliament for the Prime Minister’s proposed deal, it would be good to focus on something more straightforward just now.
You might think data protection isn’t straightforward, and we don’t deny it can be a complex topic, what with the GDPR (General Data Protection Regulation) to contend with, and the DPA 2018 (Data Protection Act 2018) on top of that, with all their legal conditions, exemptions, derogations (and other -ions!)
However, some elements of good data protection are, or should be, very straightforward and simple. Unfortunately, the Heathrow Airport data breach has shown us what can happen when organisations overlook these simple steps. So, let’s remind ourselves of what went wrong and what lessons can be learned.
In October 2018, it was reported that Heathrow Airport Ltd (HAL) had been fined £120,000 by the Information Commissioner’s Office (ICO) for failing to keep personal data secure. The data in question was found in October 2017, by a member of the public, on a USB memory stick that had been lost by an employee of HAL. You may well wonder what hacking skills this member of the public happened to have, to be able to view the personal data on a USB that must, surely, have encryption and password protection. But no hacking skills were required; they were able to pop the USB into a computer at a local library and view the contents, which included 76 folders and over 1,000 files, because it was not encrypted or password protected!
Reportedly, only a small percentage of the total amount of data on the USB was personal data, but the ICO particularly highlighted a training video that was on it, which they said contained information about ten people, including their names, dates of birth, and passport numbers. The USB also contained details of up to 50 HAL employees described as aviation security personnel.
What had gone wrong?
The ICO investigated the incident and found that HAL did have policies and guidance that banned the use of removable media. However, it was clear that staff were not following these rules, as the ICO found “widespread use of removable media”. There was also a lack of effective controls that would prevent downloading of data onto unencrypted removable media, such as the lost USB stick. The investigation also found that only two per cent of HAL’s 6,500 employees had received data protection training, which would likely contribute to the non-adherence of policies and guidance.
There’s also the training video that contained the real details of ten people, which seems strange content for training in the first place.
What can we learn from this?
This breach shows that it doesn’t really matter what you write in your data protection or security policies if you don’t follow through with training and controls to ensure employee awareness and compliance. The GDPR requires both ‘technical and organisational measures’ regarding security, and HAL failed on both counts. Technical measures could and should have prevented the use of unencrypted USBs, and organisational measures include training, which should have communicated to all employees what they should and shouldn’t be doing with personal data, in line with the policies.
Even if your organisation can’t implement all the technical controls available, you should still ensure that data protection and security policies are not only written but clearly communicated to all employees, through training and regular updates.
The ICO’s 'A practical guide to IT security' provides helpful advice on areas to focus on, including:
- access control and strong passwords;
- anti-virus software;
- software updates and patch management;
- monitoring your systems for breaches;
- the risks of mobile working and using ‘the cloud’;
- the importance of being able to trust your IT suppliers; and
- the importance of training your employees.
For anyone who is currently restrained from holding their General Meeting or have held such in breach of their governing documents, help is on the way!
Social landlords may be surprised to learn that “landlords should be able to carry out routine as well as essential repairs for most households”.
Many housing providers are now re-thinking about gathering information to complete their data return to the Regulator of Social Housing, with the initial exercise having been delayed by Covid-19.
With many premises being left unoccupied (or minimally occupied) during the lockdown, both Public Health England and the Health and Safety Executive have warned of the increased risks of Legionella.
The Court of Appeal judgement in Booth and another v R  EWCA Crim 575 will be welcome news for local authority prosecutors and their investigation teams.
The Local Authorities and Police and Crime Panels (Coronavirus) (Flexibility of Local Authority and Police and Crime Panel Meetings) (England and Wales) Regulations 2020 came into force on 4 April.
The purpose of this 30-minute free webinar is to address how employers navigate homeworking; supporting employees whilst also ensuring that their organisation stays financially viable.
As we make our first tentative steps out of strict lockdown, many of us have been thinking about what the future will look like for charities, both in the short and long term.
The UK Government has, in the last few weeks, introduced a multi-billion-pound package of measures and financial support for businesses and institutions that experience issues with their cash flow.
To receive invitations to our events, as well as information and articles on legal issues and sector developments that are of interest to you, please sign up to Newsroom.