In the space of two days, two stories broke about councils unintentionally leaking the personal details of their constituents over email.
The first was published on 28th July. Nottinghamshire County Council revealed the personal details of parents after a mail merge project about school bus pass payments went wrong.
Two days later, it came to light that Nuneaton and Bedworth Borough Council sent an email to voters that “accidentally contained a link to thousands of names, those individuals’ corresponding email addresses and, alongside the information, a personalised security code allowing each recipient to log in to the council’s online system”.
Constituents place their faith in councils to handle their data sensitively and securely. Not only do these breaches erode this trust, but they could lead to regulatory action over non-compliant data processing. Under UK GDPR, councils have 72 hours to report certain types of personal data breaches to the Information Commissioner’s Office (ICO). Given councils are already facing tight budgets and operational pressures, this is the last thing they need.
What these data breach stories illustrate is the importance of building a culture of data compliance that runs throughout the business and works alongside technology. Even if you have the necessary change visibility and incident detection tools in place, if users and workflows aren’t trained to handle data securely, then organisations will always run the risk of data breaches.
Here are three lessons IT leaders can take from these recent breaches.
- Reassess data handling in line with UK GDPR
IT leaders should document every repository or database where Personally Identifiable Information (PII) is stored, processed or transmitted. These repositories should be regularly reviewed to ensure that any PII that has exceeded or is about to exceed retention schedules is removed. It’s worth reviewing and monitoring who has access to this information and that only staff with permission are accessing it.
However, given these errors are likely to have come from users with permission, it’s imperative that leaders build in approval processes and checks by compliance or IT teams to ensure data won’t be exposed in any communication. One safeguard would be to encrypt data at its source and/or require a code to access it. That means even if a link was accidentally shared, like in the second news story, recipients still wouldn’t be able to access the PII it contained.
Finally, they should review how data is handled by any third parties like IT contractors. For example, we ensure personal data is protected by using “binding corporate rules”, which require all our group companies to follow the same rules when processing your personal data.
- Evaluate training procedures
The council data breaches were due to user error. And that points to the need for training to refresh staff on best practice for handling PII and performing tasks like mail merge –
system administrators and database handlers in particular will need specialised, tailored training.
Given the frequency of breaches and the range of cyber threats now facing organisations, this training needs to be carried out on an ongoing basis. Better for it to be bite-sized and frequent than conducted in one large chunk every six or twelve months. This training should also include testing on UK GDPR knowledge and understanding concepts like data encryption and multi-factor authentication.
Despite the safeguards, there is the chance that data breaches will happen again. IT teams and councils will always need remediation plans to ensure they can quickly and effectively react if they do. It’s sensible to pre-draft the documentation required to notify the ICO within the 72-hour UK GDPR window. Nuneaton and Bedworth Borough Council had to inform the ICO about their breach, and the ICO was then able to help the council manage the breach and inform them of next steps.
Communication is crucial with such events. IT teams should establish clear, immediate reporting lines to the Data Protection Officer (DPO) and senior leadership so that they understand the situation when an incident happens. To manage public trust, admin teams can also build communication templates that enable them to send out messages quickly to any affected users, the press and staff.
There are technical requirements too. A data breach can lead to other breaches and it’s worth IT leaders reviewing technical playbooks for isolating segments of the network to stop lateral movement during an active breach. They can also run realistic breach simulation drills with both technical teams and corporate leadership to ensure a smoother remediation process if they actually occur.
A culture of data compliance
According to data from earlier this year, the number of data breaches at English councils has risen by more than 50%. But this is something happening across sectors. The problem is IT leaders face challenges from both automated – and human-driven change. What they need are the tools to manage this change on an ongoing basis alongside robust training and reporting processes that mitigate user error. This partnership is crucial to building and maintaining a culture of data compliance.
