Tag Email

HIV Scotland has been fined £10,000 after the charity sent out an email containing the personal details of dozens of people.

The data protection breach involved an email to 105 people. Recipients included patient advocates representing people living in Scotland with HIV. 

All the email addresses were visible to recipients, and 65 of the addresses identified people by name.

The Information Commissioner’s Office (ICO) issued the penalty after a probe.

The watchdog said an assumption could be made about individuals’ HIV status or risk from the personal data disclosed.

HIV Scotland runs projects aimed at preventing the disease and raising awareness about it. It also offers support in getting treatment. 

New interim chief executive Alastair Hudson said the charity took full responsibility. He apologised unreservedly to anyone who had been affected by the data breach.

A similar incident occurred in June of 2019. You can read that article from the BBC here.

ICO Investigation

The ICO said its investigation of the incident in February this year found shortcomings in the Glasgow-based charity’s email procedures. 

These included inadequate staff training and incorrect methods of sending bulk emails. This was further aggravated by an inadequate data protection policy.

It also found that despite the charity’s own recognition of the risks and the procurement of a more secure system for bulk messages, it was continuing to use a less secure method seven months later.

Ken Macdonald, head of ICO regions, said, “All personal data is important but the very nature of HIV Scotland’s work should have compelled it to take particular care. This avoidable error caused distress to the very people the charity seeks to help.”

Mr Hudson, of HIV Scotland, said a new team and board of trustees had taken “robust steps” to improve information security.

He added, “For a small charity, financially, I cannot deny that this is a heavy blow. However, we will find a way to pay the £10,000 fine to the ICO. As an organisation, HIV Scotland would like to re-iterate its commitment to providing a safe and supportive space. Our stakeholders and networks can contribute to better health and wellbeing for those impacted by HIV and improving sexual health for all.”

How and Why?

This is the same old story. A charity or any business believes it is compliant but never checks! A simple audit could have resolved this and revealed problems before revealing data! Yet another CEO apology though it does sound like there is new management in place. All too late for those affected however.

Donors give to charity to help those in need, not to pay fines. The charity will pay I have no doubt but, it is the responsible directors who should pay. The money should not come from the charity’s funds. The ICO needs to get tougher with those who choose to ignore or disrespect the law.

Emails are one of the easiest ways to commit a data breach. The BCC field should be as standard on all clients and staff should be trained and also warned of the consequences of getting his wrong. West Ham United made this mistake in 2018 as reported by City AM. The Premier League Club has had further problems this week with its website leaking fan information.

How to avoid this

Your business, be it a charity or a commercial entity, should take data protection seriously. Simply saying we have a Privacy Policy isn’t enough and downloading templates will also not suffice. “HIV Scotland fined £10,000” is not a good headline. However, place your business name instead of HIV Scotland and see how it looks.

GDPR and DPA2018 is not as expensive as you might think. It certainly doesn’t cost £10,000!

Why not call us today and ask for a quote. You might well be surprised that unlike others, we don’t charge ridiculous consulting fees. We charge a fixed fee so there is no budget creep and no nasty surprises at a price that will please you. We don’t cut corners or use templates. You can call us on 03333 22 1011 where your call will be answered by a human being with no menus. Or, contact us here.

Why you should educate your employees on email misuse

Yet another example of an email misuse using the Cc (carbon copy) field instead of the Bcc (blind carbon copy) field. This time, it was Premiership side West Ham United Football Club.  

The email was sent to a group of supporters regarding their ticket allocations for an away game.   

Once they (The Football Club) discovered the error, they attempted to recall the email – but the follow-up email apologising for the error resulted in the email addresses being shared, yet again. 

Their email read: 

You may have received an email that included a segment of email addresses of those who were also successful in the ballot […] The Club apologises that this information was inadvertently included and has reported this matter to the Information Commissioner’s Office (ICO). 

The email was recalled, and where possible we ask that if you did receive this email to please disregard it immediately. Beyond your email address, no other information has been shared. 

The ICO is aware of the incident and is “making enquiries”. 

While this incident was undoubtedly caused by human error, it is a reminder that an organisation’s employees can pose a significant threat to data security. In this instance, no personal information other than email addresses was leaked, but it just goes to show how easy it is to make mistakes – errors that could quite easily compromise other, more sensitive personal information. 

What can you do?

To combat and prevent these mistakes and other careless actions, consider educating your employees on the risks and potential consequences of misusing the CC and BCC fields. It sounds straightforward, but data breaches caused by human error are a common occurrence. 

The GDPR: Email Misuse Staff Awareness E-Learning Course has been designed to help employees who handle and communicate sensitive data do so securely and legally. By educating your staff, you can reduce the risk of your organisation suffering an avoidable data breach.