Does the following sentence sound familiar?
Our customers often face the same GDPR issues around data protection and information security. These mistakes can have vastly different consequences. These range from slight inconveniences through to negative reviews on comparison sites or worse. Here are some examples:
- Incorrect email dispatches
- CV databases of head-hunters and HR departments
- Incorrect and superfluous checkboxes beneath website forms
- Lack of employee training on data protection topics
- Incorrect assignment of responsibilities between processors and controllers
- Fear of supervisory authorities
Let’s now look at each one of these mistakes and show you how to best avoid them.
Incorrect Email Dispatches
It’s one of the classic cases of data protection infringement: sending emails while cc’ing recipients who shouldn’t be there in the first place. And you might be thinking, “That won’t happen to me!” But unfortunately, our daily experiences prove otherwise. Having a visible list of recipients continues to be one of the most common data breaches in companies.
Each and every day, there are millions of emails sent with other people in the cc (carbon copy). Usually, nothing happens. The cc recipients can see the exact email addresses to which the message was sent, similar to the regular recipients. What’s more, the entire email history is visible. This can lead to problems if there are recipients who…
- should not become aware of the email addresses of the other recipients
- can access personal information that should not be shared with them from the email history.
If an email address can be assigned to a natural person, it is considered to be a piece of personal data in accordance with Art. 4 (1) UK GDPR. And such information may only be provided to a third party with either consent or with another legal basis in place. If the email address is shared, as is the case with a visible email list, this constitutes a data protection infringement.
HERE’S AN EXAMPLE OF SUCH AN ERROR
HIV Scotland deal with some very sensitive data and sadly, revealed this data. The data protection breach involved an email to 105 people. Recipients including patient advocates representing people living in Scotland with HIV.
All the email addresses were visible to recipients, and 65 of the addresses identified people by name.
The Information Commissioner’s Office (ICO) issued a penalty of £10,000 after a probe. You can read more here.
In 2018, a Premiership football club emailed 3,000 supporters informing them of ticket allocation for an away game. Unfortunately, all three thousand email addresses were in the ‘to’ box and so 2,999 email addresses were illegally shared. The club concerned reported themselves to the Information Commissioners office after sending a retraction email to the same group, again in the ‘to’ box. Oops! They were fined £20,000!
A National League side would repeat this error a year later but due to their poor financial condition a fine was not issued.
We love these…not!
Wouldn’t it be convenient to store all applicants‘ data indefinitely? This way, you’d have a bunch of suitable candidates for every vacancy. All you need to do is contact them. This is such a promising idea. Many HR departments and head-hunters create entire databases of resumes and employer references. It may sound great, but it’s not legal.
Resumes, employer references, and applicant files are classed as personal data. They can only be processed and stored if there is a legal basis (Art. 6 UK GDPR). If this legal basis no longer applies, the data must be deleted. What’s more, data subjects (applicants) must, among other things, be informed of the purpose and duration of data processing, as described in Art. 13 UK GDPR.
Article 6 of the GDPR lists the following legal basis for the processing of personal data:
- Consent of the data subject
- Performance of a contract
- Compliance with a legal obligation
- Necessary to protect the vital interests of the data subject
- Performance of a task carried out in the public interest
- Necessary for the purposes of the legitimate interests pursued by the controller
The Data Protection Act 2018 (DPA 2018) provides the legal basis for data processing during the application process. Also, the Information Commissioner’s Office (ICO) has also issued guidance on this in the form the Employment Practices Code. As a best practice, only personal data that is relevant to the recruitment decision should be collected.
After rejecting an applicant, the application documents may be stored for a certain legally permissible period, but they must be destroyed/deleted after this period expires.
Data may only be stored beyond this period with the consent of the data subject. The duty to provide information in accordance with Article 13 (UK GDPR) must always be observed. Data subjects must be informed of the data processing, among other things.
- Purposes of data processing
- The legitimate interests that underpin the legality of data processing, if these provide the legal basis for processing.
- Information on transmitting data outside the UK
- The duration of data processing
- Reference to the right to provide information, submit a complaint, and withdraw consent
How to avoid this situation.
The creation of a data retention policy, with associated schedule, will dictate how your business behaves. It must be enforced internally and reviewed in your annual GDPR audit which is a legal requirement.
As most CV’s arrive via email they can sit in inboxes, sent items and deleted items indefinitely so a policy for cleansing your email must be put in place and enforced. An understanding of how such data arrives in your business must be recorded in your Data Flow Map.
However, the greatest challenge is when recruiters change employers. I am constantly sent vacancies that might suit me from recruitment agencies I have never interacted with. How does this happen? A recruiter moves from one agency to another and takes contacts to the new employer. The recruiter moves on in the future but leaves the data behind as well as taking it with them to another employer. Now my data is with at least three recruitment companies with only one having consent. Recruitment firms must take GDPR seriously.
INCORRECT AND OR SUPERFLUOUS CHECKBOXES BENEATH WEBSITE FORM
Data processing for marketing purposes is very often underpinned by the legal basis of data subject consent. This should be great surprise as there is no legal basis for meeting to prospects. You will recall in may of 2018 that companies were hungry for your consent. However, not all consents are of any use. The important information is often left out when companies are busy creating their checkboxes.
The UK GDPR does not provide any boilerplate templates for checkbox designs. No doubt many companies would be happy to have them. What the UK GDPR does do, however, is provide clear guidelines on the process behind obtaining consent.
We recommend including at least the following elements on the form:
- Information on the purpose of data collection (principle of purpose limitation pursuant to Art. 5 (I) (b) (UK GDPR)
- Reference to the option to withdraw consent
- Voluntary checkbox for a consent to the distribution of marketing information and/or sales reaching out to the consenting party
- In accordance with Art. 7 UK GDPR, consent must be given freely and without duress to be effective.
Article 7 (4) GDPR states the following, “When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.”
Make sure you separate the necessary from the optional. If a website visitor requests to receive a checklist by email, there’s no way around data processing for exactly this purpose. More detailed marketing information, for example, such as a newsletter is, however, optional. Make sure to never mix these two purposes. Consent to a newsletter must stay voluntary. Consent must be given by choice, and not a requirement to receive a freebie such as an e-book or webinar.
LACK OF EMPLOYEE TRAINING ON DATA PROTECTION
You might have the strictest security measures for your server rooms. You may have the cleverest encryption, and most watertight Data Processing Agreement in place. No piece of data is safe if your employees become careless. Employee training is one of the key tasks of a data protection officer (DPO) under the UK GDPR.
However, the UK GDPR does not specify what such training should look like. Here too, the data protection officer has quite a bit of leeway. The law does not prescribe any given training form or course refresher cycles. Processing operations usually evolve continuously. New technologies are used and people tend to forget what they’ve learned if they don’t repeat it in their day to day activities. Training should be carried out annually as a minimum.
SOME EXAMPLES OF EMPLOYEE TRAINING TOPICS
Besides the data protection principles, employees should be instructed on the rights of data subjects. Other topics include company data protection guidelines, data protection when using mobile devices, as well as the legal basis and other specialist terms. It is particularly important to instruct employees on how to behave in the event of data breaches and data protection infringements. Employees who are in direct contact with customers, should additionally become aware of what information they may share with customers – and the conditions for sharing.
Try to make the training as interesting as possible and avoid merely ticking off topics with exhausting theory. Include examples of data protection in daily business and interactive elements to help keep employees focused during the training and raise awareness for the tasks they will later perform.
To make concepts such as Records of Processing Activities (ROPA), Technical and Organisational Measures (TOM), and other documentation obligations more tangible, it helps to run through practical exercises on specific data processing operations. Besides all this, training sessions should focus on aspects of data protection that are relevant to the specific daily activities of the employee. This helps illustrate the effects of certain processes. Those who are not only familiar with the theory of data protection, but also the practical side of things, can identify and steer clear of obstacles.
Generally speaking, internal data protection officers (DPO) often find it hard to motivate their team for training courses. This is easier for external service providers with learning platforms and interactive materials. We can train on principles, rights and role specific requirements.
INCORRECT ASSIGNMENT OF RESPONSIBILITIES
This section relates to incorrect assignments between controllers and processors and is a common amongst the six data privacy mistakes.
THE OBLIGATIONS OF THE CONTROLLER
- Making sure that the Data Processing Agreement really covers all requirements listed in Art. 28 UK GDPR. Particular care should be taken to ensure that:
- there is a well-defined performance specification that precisely illustrates which partial performances are made by the processor
- data categories are illustrated in detail; do not merely scratch the surface
- there is a list of sub-processors of the processor in place, with evidence provided on the inspection of their data protection compliance
- Check the Technical and Organisational Measures (TOM) of the processor. The TOM demonstrate how securely processors handle their customer data. These are an essential component of data processing agreements. The following aspects should be covered, for example:
- Encryption measures
- A breakdown of who has access to which data
- Information on server redundancy and server security to guarantee availabilities
- A reference to the multi-client capability of your solution
- Comments on multi-factor authentication (e.g. for admins), if available
- The purpose of the collected data, to demonstrate that only those data are collected that are necessary for the provision of the service
- Information on patch management and regular updates
- Notes on the remote maintenance process
- Whenever relevant, the creation of a Data Protection Impact Assessment. The use of new technologies – such as SaaS solutions – in processing operations, can pose risks to the rights and freedoms of your customers and employees. These might require a Data Protection Impact Assessment.
THE OBLIGATIONS OF THE PROCESSOR
The processor is responsible for processing the data in line with the instructions of the controller. The principles of the UK GDPR that also apply to other companies must be observed.
This is joined by an important and often forgotten obligation: If an instruction of the controller infringes against the UK GDPR, the processor must inform the controller accordingly (Art. 28 (3)). There is an additional obligation to report data breaches to the controller (Art. 33 (2)).
FEAR OF SUPERVISORY AUTHORITIES
This is the final of the six data privacy mistakes we will discuss. There are some letters nobody likes to receive. Letters from HMRC,. For example, letters from the courts, banks, and supervisory authorities. No news is usually good news. However, there is no reason to get worked up when the ICO gets in touch. Our advice: is to keep calm. Above all, cooperate and never shy away from communicating with the ICO. However, it might be better if you call us!
The ICO acts in an advisory and guidance role as the UK’s data protection watchdog. However, as part of this role they have several enforcement tools available implemented wihtin the Data Protection Act 2018. The powers available to them include:
Cooperation with the ICO is one of the tasks of the data protection officer, pursuant to Art. 39 UK GDPR. If the ICO reaches out to you, the DPO should take it from there.
The ICO and Data Breaches
If a data protection breach has been identified in your company, you have to independently report it to the ICO within 72 hours. If the event comes with a high risk, you additionally have to inform the data subjects without undue delay.
In our role as an external DPO, we are in continuous contact with the ICO and we can usually lay all fears to rest. The ICO are communicative and cooperative and are quick to provide a friendly response to questions you might have. However, If the ICO requests certain documents, it is important that you act in a proactive and careful manner. An open cooperation with the ICO can certainly have a mitigating effect on later rulings.
With data breaches, it is crucial to meet all deadlines. Even if you might experience a ‘deer in the headlights’ response, or are eager to sweep the incident under the carpet, this is exactly what you should never do. Immediately report incidents to the ICO to demonstrate that your company takes data protection seriously, and this helps prevent higher fines in the end.