Category Archives: Private sector

Tameside Energy Services Ltd

Posted on by

Breach details

What Serious breach of the Privacy and Electronic Communications Regulations (PECR).
A high volume of unsolicited marketing calls to consumers that had registered with the Telephone Preference Service (TPS) that continued despite customer complaints and requests to unsubscribe.
How much An unknown number of direct marketing calls resulting in 1,010 TPS complaints and 60 complaints directly to the ICO (8 of which were duplicates), making a total of 1,062 complaints.
When 26th May 2011 to 31 January 2013.
Why Failed to screen calls effectively against a current Telephone Preference Service (TPS) list or maintain an opt-out register.

Regulatory action

Regulator ICO
Action Monetary penalty of £45,000.
Enforcement notice issued to ensure that Tameside does not make unsolicited marketing calls to individuals registered with TPS, or who have notified Tameside that they do not want to receive further calls, within 28 days.
When 5 July 2013.

Why the regulator acted

Breach of act Breach of Regulation 21: repeatedly ignored provisions that marketing calls should not be made to individuals who had registered with TPS.
Known or should have known Concerns over PECR obligations were first raised by the Commissioner in May 2012. The volume of complaints made before and after the Commissioner’s letter of May 2012 would have made the company aware that they were continually breaching regulations.
Likely to cause damage or distress. The overall level of distress was assessed as substantial due to the very large numbers of individuals affected. A small number of individuals also personally suffered substantial levels of distress.

Links

View PDF of the Tameside Energy Services Ltd Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Tameside Energy Services Ltd Monetary Penalty Notice (Via ICO Website)
View PDF of the Tameside Energy Services Enforcement Notice Ltd (Breach Watch Archive)
View PDF of the Tameside Energy Services Ltd Enforcement Notice (Via ICO Website)

Nationwide Energy Services and We Claim You Gain

Posted on by

Breach details

What Breach of the Privacy and Electronic Communications Regulations (PECR).
A high volume of unsolicited marketing calls from two companies both owned by “Save Britain Money Ltd” to consumers that had registered with the Telephone Preference Service (TPS) that continued despite customer complaints and requests to unsubscribe.
How much An unknown number of direct marketing calls resulting in over 2,700 complaints to the TPS or ICO.
When May 2011 – December 2012
Why Did not screen outbound calls against the TPS register.

Regulatory action

Regulator ICO
Action Nationwide Energy Services: Monetary penalty of £ 125,000

We Claim you Gain: Monetary penalty of £ 100,000
When 17 June2013

Why the regulator acted

Breach of act Breach of Regulation 21: repeatedly ignored provisions that marketing calls should not be made to individuals who had registered with TPS.
Known or should have known Both companies had been repeatedly contacted by the TPS and ICO and were made aware they were in contravention of the Act. The TPS contacted Nationwide Energy Services on 1,601 occasions and We Claim You Gain 1,070 times.
Likely to cause damage or distress The sheer volume of complaints should have indicated that distress would be caused and individual complaints to the ICO detailed varying degrees of actual distress.

Links

View PDF of the Nationwide Energy Services Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Nationwide Energy Services Monetary Penalty Notice (Via ICO Website)
View PDF of the We Claim You Gain Monetary Penalty Notice (Breach Watch Archive)
View PDF of the We Claim You Gain Monetary Penalty Notice (Via ICO Website)

News Group Newspapers

Posted on by

Breach details

What Customers’ personal data, some several years old.
How much ‘Thousands’ according to some press reports , a ‘large amount’ described in the undertaking and TechEye claimed 500,000.
When July 2011
Why A server hosting part of The Sun newspaper’s website had, unnoticed by the data controller, been repurposed several years earlier, and was subsequently compromised by a malicious attacker (Lulzsec). Further weaknesses had also been identified but remained unrectified prior to the attack.

BW Comments

It is surprising that a large organisation such as News Group Newspapers made such simple information security mistakes. Firstly in retaining data they no longer needed when they re-built a server for a new role, but more worryingly that they had previously had a penetration test but had not rectified the vulnerabilities identified by the tester.

Regulatory action

Regulator ICO
Action Undertaking to comply with the fifth and seventh data protection principles
When 9 November 2011
Details Along with the usual staff awareness and training, technical security controls on the web server were to be improved and implemented by 31 December 2011 (i.e. compliance with the seventh principle), and any customer data collected to be cleared regularly according to a defined retention and disposal policy (compliance with the fifth principle).

BW Observations

This undertaking was not released until the criminal trial of the UK-based Lulzsec hackers was concluded. It is interesting that the ICO didn’t see fit to consider a monetary penalty notice as the breach appears to meet the right criteria.

  • There was a breach of the fifth and seventh principles.
  • There had been a previous penetration test, so the Sun knew of the vulnerability.
  • It seems that a significant volume of data was lost and then circulated on the Internet. Although it wasn’t sensitive personal data, the volume of the data should be enough to pass the ‘likely to cause distress’ test especially given the data was posted to the Internet — i.e. the breach of confidentiality happened, it was not something that might happen if the lost data were exposed.

This undertaking should be contrasted with the Sony MPN that was also the result of Lulzsec’s activities and it will be informative to see if the ICO’s choice of an undertaking for the Sun is mentioned at Sony’s appeal to the Information Tribunal. Less charitable commentators may view this soft approach to News Group Newspapers as another example of the Commissioner’s fear of the UK press.

Links

View PDF of the News Group Newspapers Undertaking (Breach Watch Archive)
View PDF of the News Group Newspapers Undertaking (Via ICO Website)

The Burnett Practice

Posted on by

Breach details

What Names and email addresses.
How much About 175 records.
When 3 October 2012 or earlier
Why The email service provider that the practice used wasn’t suitable to send sensitive medical results because it didn’t provide the appropriate technical security measures. As a result the practice’s email account was hacked.

BW Comments

Organisations should view this as an indication that if cloud-based, web-email services are used, services that offer two-factor authentication (e.g. Google Authenticator) should be selected.

Regulatory action

Regulator ICO
Action Undertaking to comply with the seventh data protection principle
When 26 April 2013
Details The practice must use secure means of communication for test results – email can only be used if its security can be guaranteed. A security policy that is adequate to transfer patient data securely must be put in place, and staff must be made aware of this and trained.

BW Observations

Based on previous decisions, the loss of 175 medical records would seem to be a candidate for a Monetary Penalty rather than an undertaking. However, in this case the Commissioner would have struggled to satisfy the ‘known or should have known’ test given that most people (incorrectly) assume their email is generally safe from third party attack.

Links

View PDF of The Burnett Practice Undertaking (Breach Watch Archive)
View PDF of The Burnett Practice Undertaking (Via ICO Website)

Follow Up

The ICO conducted a follow up assessment on 17 October 2013.
View PDF of the Burnett Practice Undertaking Follow Up (Breach Watch Archive)
View PDF of the Burnett Practice Undertaking Follow Up (Via ICO Website)

DM Design Bedrooms

Posted on by

Breach details

What Serious breach of the Privacy and Electronic Communications Regulations (PECR).
A high volume of unsolicited marketing calls to consumers that had registered with the Telephone Preference Service (TPS) that continued despite customer complaints and requests to unsubscribe.
How much An unknown number of direct marketing calls resulting in 1,945 TPS complaints and an unspecified number of complaints directly to the ICO.
When June 2011 to November 2012
Why Ignored requirement to screen call lists against the Telephone Preference Service (TPS) or maintain an opt-out register.

BW Comments

After initial contact from the ICO, the unsolicited calls continued and some reported to the Commissioner were described as aggressive.

Regulatory action

Regulator ICO
Action Monetary penalty of £90,000
When 20 March 2013

Why the regulator acted

Breach of act Breach of Regulation 21: repeatedly ignored provisions that marketing calls should not be made to individuals who had registered with TPS.
Known or should have known Concerns over PECR obligations were first raised by the Commissioner in 2004. The volume of complaints made before and after the Commissioner’s letter of May 2012 would have made the company aware that they were continually breaching regulations.
Likely to cause damage or distress The overall level of distress was assessed as substantial due to the very large numbers of individuals affected. A small number of individuals also personally suffered substantial levels of distress.

BW Observations

That DM Design breached the PECR by not screening against the the TPS register and maintaining their own opt-out list is not debatable. The volume of calls and complaints are significant (although we are not told what the average or maximum level of complaints are to the TPS in respect of a company other than “they [DM Design] were one of the organisations about which the most complaints were received”). What’s interesting is the ICO again used the same justification as the Tetrus Telecommunications MPN to determine the s55A(1)(b) ‘substantial damage or distress test’ – that although the distress in each individual case was not considerable, the cumulative effect of the distress caused by the totality of all calls made in contravention of PECR met the Commissioner’s threshold of substantial distress.

Links

View PDF of the DM Bedroom Design Ltd Monetary Penalty Notice (Breach Watch Archive)
View PDF of the DM Bedroom Design Ltd Monetary Penalty Notice (Via ICO Website)

Sony Computer Entertainment Europe

Posted on by

Breach details

What Loss of personal data (names, addresses, email addresses, dates of birth, poorly-protected account passwords). Customers’ payment card details also potentially at risk.
How much Redacted. Information Week stated 77 million records.
When Detected 19 April 2011
Why In what was perhaps one of the most infamous breaches in recent times, attackers deliberately breached the Sony Playstation Network Platform security and compromised the confidentiality of the information stored.

BW Comments

This is the most heavily redacted monetary penalty notice published by the Commissioner. The details of the breach in the MPN are superficial, although there is much general information available elsewhere on the Internet. Essentially the attackers exploited a system vulnerability and extracted data including personal data, poorly-hashed passwords and encrypted payment card data. The MPN makes it clear that the exploited vulnerabilities were publicly known, and that ‘appropriate updates were available’.

The lessons that all organisations can learn are simple:

  1. Patch systems regularly.
  2. Run regular external vulnerability scans against systems.

Regulatory action

Regulator ICO
Action Monetary penalty of £ 250,000
When 14 January 2013

Why the regulator acted

Breach of act Breach of the seventh principle: the data controller failed to ensure appropriate technical measures were taken against unauthorised or unlawful processing of personal data stored on the Newwork Platform, such as additional cryptographic controls to protect passwords and regular patching of vulnerabilities.
Known or should have known Various Sony online networks had previously been the subjects of attacks from hacktivist organisations.
Vast amounts of personal data including financial information were stored on the Network Platform, where system vulnerabilities had not been addressed. The data controller should have anticipated a further attack and, given Sony’s technical expertise, should have put the necessary technical measures in place.
Likely to cause damage or distress It should have been obvious to the data controller that the loss of the substantial volume of personal data held on the Network Platform was likely to cause substantial harm or substantial distress to the data subjects.

BW Observations


A lack of basic security practices such as poor vulnerability management and what can only be assumed to be weak password hashes (at a guess, unsalted MD5) are sufficient to justify a MPN, especially when you consider the number of accounts and the attractiveness to an attacker. The amount could be seen as excessive given that no sensitive personal data was compromised, however it has to be remembered that some 77 million records were compromised. It is the sheer volume of the data breach that influenced the Commissioner.

The ICO correctly observed that the poorly-hashed passwords may be able to be used by the attackers to compromise customer’s accounts at other sites where the customer used the same username and password. This appeared to influence his thoughts on the size of the monetary penalty. However it is interesting to consider whether the poor password management practices of consumers should affect how an organisation chooses to value, and therefore protect, stored passwords. Should passwords be valued as a credential for just the single site, or valued (and protected accordingly) because it is known that many customers’ passwords will also be able to be used to access unrelated sites?

It has been reported that Sony intends to appeal the MPN to the Information Tribunal and although an appeal was initially launched, this was later withdrawn.

Links

View PDF of the Sony Computer Entertainment Europe Limited Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Sony Computer Entertainment Europe Limited Monetary Penalty Notice (Via ICO Website)

Prospect

Posted on by

Breach details

What Loss of sensitive personal information (Union membership).
How much About 19,000 records.
When 08 Dec 2011
Why Two files containing member data were sent as part of a tendering process to an unknown email address in error. The files were encrypted but the password was also sent seperately to the same address.

BW Comments

This breach illustrates two issues that all Data Controllers need to be aware of. The first is that test data should always be anonymised, not only does it increase the risk of breaching the seventh principle, but it will also breach the first and second principles; although interestingly the ICO only took action in respect of the seventh principle. Secondly, any encryption is only as good as the key (password) management – passwords should always be sent at a minimum by a separate channel.

Regulatory action

Regulator ICO
Action Undertaking to comply with the seventh data protection principle
When 16 Jan 2013
Details The data controller to ensure that adequate policies are in place to cover transfer of data to third parties, that such data is minimised and anonymised, that all staff receive data protection training, and that appropriate security measures are in place to protect personal data.

BW Observations

Although this was a sizeable breach of some 19,000 records of sensitive personal data, the ICO obviously decided that an undertaking was more appropriate given the potential harm that could result.

Links

View PDF of the Prospect Undertaking (Breach Watch Archive)
View PDF of the Prospect Undertaking (Via ICO Website)

Follow Up

The ICO conducted a follow up assessment on 15 May 2013
View PDF of the Leeds City Council Undertaking Follow Up (Breach Watch Archive)
View PDF of the Leeds City Council Undertaking Follow Up (Via ICO Website)

Tetrus Telecoms – Christopher Niebel and Gary McNeish

Posted on by

Breach details

What Serious breach of the Privacy and Electronic Communications Regulations (PECR).
How much Sent millions of unsolicited text messages.
When From December 2009 onwards.
Why Concealed identity and/or failed to provide a valid ‘cease’ address. Sent automated marketing without the necessary opt-in permissions.

BW Comments

Millions of spam SMS messages sent from over 16,000 SIM cards. There can’t have been anyone in the UK that didn’t receive one of Tetrus’s offers to reclaim PPI or pursue a road accident claim.

Regulatory action

Regulator ICO
Action Christopher Niebel: Monetary penalty of £ 300,000
Gary McNeish: Monetary penalty of £ 140,000
When 28 November 2012

Why the regulator acted

Breach of act Breach of regulations 22(2) and 23 of PECR, characterised by the ICO as “continued, repetitive and deliberate contraventions of the law.”
Known or should have known The Commissioner found evidence that the participants deliberately hid their identity and made no attempt to ensure they had the recipient’s opt-in to receive automated messages.
Likely to cause damage or distress Although most people would agree that the receipt of these unwanted text messages is annoying, the Commissioner argues that they the messages caused damage and distress.

BW Observations

That the individuals concerned deliberately flouted the Privacy and Electronic Communications Regulations is not in doubt. The Commissioner’s arguments in respect of the damage and distress caused are informative.

  1. That although the distress / annoyance caused by each individual SMS sents is small, because of the number of messages sent by Niebel and McNiesh, the cumulative distress suffered by “huge numbers of individuals” equates to substantial distress. It will be interesting to see if this is argued in Mr Nielbel’s appeal to the Information Tribunal (EA/2012/0260).
  2. Some recipients were overseas at the time messages were sent, so had to pay their mobile telecommunications provider additional fees for receiving these SMSs when overseas, resulting in real monetary damage.
  3. People receiving emails about an accident claim may worry about other family members, and such messages also had the potential to be disturbing to people who had been involved in accidents.
  4. The wording used had the potential to cause distress by raising false expectations, e.g. “we know how much you are owed” and “You are almost certainly entitled to £2,300.”

Links

View PDF of the Tetris Telecoms: Christopher Niebel Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Tetris Telecoms: Gary McNeish Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Tetris Telecoms: Christopher Niebel Monetary Penalty Notice (Via ICO Website)
View PDF of the Tetris Telecoms: Gary McNeish Monetary Penalty Notice (Via ICO Website)

Prudential Assurance Company

Posted on by

Breach details

What Data integrity – two customers’ records were merged incorrectly.
How much 2 records.
When March 2007 until 24 September 2010
Why Insufficient steps taken to ensure the accuracy of data once the problem had been reported by both customers.

BW Comments

The breach of the fourth principle was not in respect of the original erroneous merge, but that the Data Controller failed to rectify the problem.

Regulatory action

Regulator ICO
Action Monetary penalty of £ 50,000
When 6 November 2012

Why the regulator acted

Breach of act Breach of the fourth data protection principle – customers’ data must be accurate and kept up to date. Despite repeated notification from both customers, the Prudential failed to adequately investigate of rectify the problem.
Known or should have known The ICO’s view was that Prudential, as “a large company in the financial services sector with approximately six million customers” should have been aware that some customers could share the same name and so should have had processes in place to investigate and rectify such an occurrence when this was reported by a customer.
Likely to cause damage or distress The ICO’s view is that disclosure of financial information to a third party with “no right” to see the information was likely to cause “substantial distress”. Actual damage temporarily occurred in that tens of thousands of pounds, meant for an individual’s retirement fund, ending up in the wrong account and was moved away from the Prudential (although all funds have since been recovered, and compensation paid).

BW Observations

The first MPN in respect of a breach of the fourth principle. Although the ICO’s reasoning in respect of the degree of damage or distress is debateable, what is interesting is the Commissioner’s reasoning in respect of the s55A(3) ‘known or should have known’ test. The ICO’s argument is not that the Prudential should have had sufficient data integrity controls in place to prevent the problem occurring, but given such an error was probable in a company with six million customers, that there should have been robust procedures in place to properly investigate the customers’ complaints and rectify the situation.

Organisations should consider whether they have the necessary training and systems in place to recognise that what might appear as a simple change of address problem in a front-line system to be identified and investigated as a potential breach of integrity.

Links

View PDF of the Prudential Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Prudential Monetary Penalty Notice (Via ICO Website)

Norwood Ravenswood Ltd

Posted on by

Breach details

What Loss of sensitive personal data.
How much Four records.
When 5 December 2011
Why A Social Worker left background reports relating to four young children outside the home of prospective adopters in a concealed place, since they were not in. When the prospective adopters arrived home about 30 minutes later the package had disappeared..

Regulatory action

Regulator ICO
Action Monetary penalty of £ 70,000
When 10 October 2012

Why the regulator acted

Breach of act Despite an existing policy, there was no specific guidance relating to sending personal data to prospective adopters. The social worker in question had not recieved any data protection training, despite a commitment to it being provided existing in the data controller’s policy.
Known or should have known The data controller had an overarching data protection policy which staff were aware of, even if specific guidence was not given. The sensitivity of staff’s work would have been self evident.
Likely to cause damage or distress The background reports contained detailed, confidential and highly sensitive personal data relating to the children and their birth families, including medical histories and details of any abuse or neglect. At this time, the reports have not been found.

Links

View PDF of the Norwood Ravenswood Ltd Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Norwood Ravenswood Ltd Monetary Penalty Notice (Via ICO Website)