The spotlight in data protection issues is usually shone on cyber attacks and other electronic data breaches. But it’s important to remember that physical data held within an organisation is also vulnerable.
If you need guidance regarding data protection and privacy, contact our data protection and confidentiality solicitors London on 0203 983 8278 or contact us online.
In its 2016/2017 annual report, the Information Commission (the ICO) acknowledged that cyber incidents were on the rise. But the most common data breaches reported to the ICO still arose from the following types of incident:
The Information Commissioner says that when her office investigates these incidents an organisation will usually blame human error. But the mistake of one individual will rarely be the underlying reason for a breach. Instead the human error will usually be the last link in the chain that has led to the breach.
Ultimately the responsibility for data security lies with an organisation and its data controllers. So rather than focusing in an individual’s mistake the ICO will look for evidence of mechanisms in place within the company that should have prevented the breach ever occurring.
At Nath Solicitors in London we work with companies in the UK and overseas to ensure they have processes and practical staff training in place that minimise the risk of human error and workplace behaviour that can lead to serious data breaches.
Personal data is now a valuable commercial commodity. The way your staff treat the information they have access to will have a long-term impact on your business.
The importance of effective staff training can’t be underestimated. Building an atmosphere where good data protection practice is seen as a key responsibility – part of the job – will reduce the risk of costly data breaches.
You can have all the processes in place you like but if you haven’t trained staff to understand the value and sensitivity of the personal data they handle the potential for serious data breaches will still be there.
The ICO recommends refresher training once a year. It’s also important to tailor the training to each job role. Employees in different parts of the business will have different data protection obligations.
As we have seen data breaches can arise just as easily from carelessly stored physical data – on notepads, paper filing systems and other traditional information storage systems as from cyber attacks and electronically stored information. The legislation specifies that protected information covers:
“personal data processed in a non-automated manner which forms part of, or is intended to form part of, a ‘filing system’ (that is, manual information in a filing system).”
Information that’s left exposed at a workspace or in a conference room is a real risk. Consider a disgruntled employee copying personal information that’s visible on a desk and making that information public. Or an external contractor accessing personal information after an employee has forgotten to remove his or her smartcard from a work computer.
So post GDPR, a company-wide tidy desk policy really does matter.
This could include:
At Nath Solicitors we provide tailor-made audits to help clients get an accurate impression of the data they process, identify risks and introduce appropriate compliance protocols. Following a breach the ICO will immediately look at the preventative processes you had in place. A tidy desk and other appropriate policies will provide helpful evidence that your organisation takes data protection seriously.
At Nath Solicitors we offer comprehensive GDPR training and advice. Call us now on 0203 983 8278 or contact us online.