Did you attend a training course? Whoopee, lets share your details!

I have been on a couple of business training courses over the last week. Both of them were signed up to online and neither told me what they would do with my information, so that's the first mistake!

When I got to the training courses, both provided an attendee list which showed name, business name and a brief outline of what the business does.

A few days later I received an email from the training company asking if they can share my contact details with the other attendees. If I do not wish to share my information I have 24 hours to send an email opting out. Mistakes 2 and 3.

The email requesting that I share my contact details does not tell me which contact details they are planning to share. They may have my postal address but definitely have my email address and mobile number as a minimum so are they planning on sharing all my contact details or just some of them and if so which ones?

Also by requesting that you respond by opting out, they run the risk of sharing someone's contact details who may not have had time to review their emails and respond within the timescale laid down but who doesn't want to share their information. They should have asked people to opt in.

So how could this have been done more effectively?
1 - When they collected the information, they should have said how they are going to hold that information and for how long.
2 - Will I be on a mailing list?
3 - Stating that it will be on an Attendee list.
4 - What information they plan to share with other delegates and seeking permission to do so.
All of this could have been completed at the time of sign-up.

It would have been more straightforward to tell all the attendees to find each other on LinkedIn and connect that way. Needing no facilitation by the training company. 

So with a bit of planning and some knowledge of Data Protection requirements, life could have been a lot easier for the training company. 

What is your process for checking outgoing email attachments?

This case really showcases the importance of keeping track of all of the information that comes from your business!

On 2 August 2011 a member of the public reported that they had received an email from HMP Cardiff with a file accidentally attached that contained the details of 1,182 inmates. As if that wasn’t bad enough, it wasn’t the first time the mistake had been made - on 4^th and 5^th July 2011 the prisoner details had been sent to two other unintended recipients who hadn’t yet contacted the data controller or the prison. 

A total of three emails with the attachment had been sent to three different individuals, after a new prison booking clerk had been arranging the prison visits. The clerk had only meant to email a family member about a visit but had accidentally pasted the text file as an attachment. All three mistakes were made by the same clerk, doing the same thing by accident. Because the file had to be manually cut and pasted on a daily basis onto a disk, and then saved onto a database, the paste action had picked up the last file from the clipboard instead of the correct one and accidentally sent the sensitive data - three times.

Once the mistake had been discovered, the police became involved and each recipient was asked to confirm in writing that the message had been deleted and not shared. The police even accessed their email accounts to make sure that it had been fully deleted. 

HMP Cardiff has since put in place measures to stop this ever happening again; existing training and on-going support is now topped up with monthly checks and the data transfer procedure has been changed so that rather than a disc, an encrypted memory stick is used for data transfer. And instead of copying and pasting it to the stick, staff are told they have to locate the text file and use the ‘send to’ function, which stops it being left on the clipboard to be pasted where it ought not to be.

Most of us would cringe, just thinking about a mistake like this - how many times have you attached the wrong document to an email or not attached it at all? When you’re dealing with sensitive data though, the repercussions can be extremely serious. The National Offender Management Service was fined £140,000 for the breach.

This error, made by an inexperienced member of staff, would not even have come to light if the third person who had received it hadn’t realised the seriousness of the mistake and reported it. Is it possible that this sort of thing could happen to you? What measures do you have in place to prevent sensitive data being accidentally shared with the wrong people?

Do you have a contingency plan in place for emails, and for protecting sensitive information? If you need advice on procedures and policies that keep your information safe, contact me and I will be delighted to provide you with guidance and advice.

You've got to love her

My daughter came home from school the other day and as she was telling me about her day she made me laugh. Apparently at some point during the day they were to act as evacuees and so each child was given a cardboard tag and asked to write their name, age and address on the tag. Now my husband and I have both completed the Data Protection Act training and been auditing for more years than I would care to say, so she has been brought up in an environment where you always check the information you are being provided with. So my darling daughter told the teacher that she would not be completing the cardboard tag until she was told what they were going to do with the information as required by the Data Protection Act!

I have no idea how this went down with the teacher but I know that my daughter is trying to protect her information and privacy. Good for her.

Data Protection - your access rights.

I have been giving some talks recently on the Data Protection Act and something that is mentioned frequently is when the Data Protection Act is used as an excuse not to provide information requested. Often people do not realise that they can request to see the information held on file from any organisation and the most the organisation can charge for this service is £10. So when you think a company has inaccurate information about or you want to know where they collected your information from, make the request.

An organisation then has 40 days to respond to your request. If the information is particularly difficult to collate they should explain this to you, they may also ask which specific information you are requesting. If the request is soon after a previous request they can refuse to provide the information on the basis that there would be no fundamental change.

If you need any advice, give me a call at Audit & Risk Professionals on 07828 124588 and I'll do what I can to help.