Does your unsubscribe work?

I have been receiving spam email, lets face it who doesn't?

So I tried to unsubscribe and the link didn't work it took me to the contact us page of the financial services company. On this page there was a complaint phone number which I called. This took me to a menu where the selections all related to credit card applications, so as well as not keen on your unsubscribing, they weren't keen on you complaining either. When I eventually got through to a human I asked to speak to their Data Protection Officer and was told they didn't have one! I asked about unsubscribing and they said they would take my details and pass them on (they weren't sure who to). Really!

Anyway while I was holding on for a person to answer the phone, I went online and reported them to the ICO for spamming me, so my time wasn't wasted ;-)

Always check that your unsubscribe function works. You don't want someone to report you to the ICO while they wait.

Make sure your staff are adequately trained and you have a named person who knows how to deal properly with the data protection queries.

Data loss - the obvious ways your business can avoid it

The top reasons cited for data loss from small businesses aren’t international hacking or grand scale cybercrime -  they are obvious, easily rectified things that would have been avoidable with a little advance attention to detail, proper training and a staff data security policy.

According to surveys, a staggering more than 78 per cent of organisations worldwide report that they have suffered from one or more data breaches in just the last two years. If you want to avoid your business being affected by careless data loss, you need to make sure that all employees - including you - are fully aware of the risks.

Surprisingly, one of the top reasons businesses lose data is that many employees (and their managers) still don’t understand the importance of not opening unexpected or suspicious attachments or clicking links embedded in spam emails. Other basic measures such as leaving systems unattended, visiting restricted websites and not changing passwords regularly also led to critical business data becoming at risk from data-stealing cybercriminals and malicious insiders.

It’s estimated that cyber criminals steal as much as US$1 billion a year from SMEs in the US and Europe. This is partly down to inadequate or poorly enforced data security policies, leaving companies at a risk of losing vital and sensitive data, as well as costing money through lost productivity, revenue and of course, if the breach becomes public, the business reputation too.

Working from home and being able to take work out of the office makes working life easier but can be a nightmare for data security. With an estimated 56 per cent of employees reporting that they either very frequently or frequently stored sensitive data on their laptops, smartphones, tablets, and other mobile devices, the chances of confidential information getting lost or into the wrong hands are very high. Protecting data on mobile devices can be as simple as encrypting it and/or password protecting it - it won’t stop the devices being lost but IT admin will be able to selectively remove sensitive encrypted data and the chances of someone using it maliciously are much smaller if it’s not possible to get straight into any files that may be sensitive.

Do you back up your data on a regular basis or just when you remember? Regular backups are a vitally important part of a good data security policy, so make it a regular daily, weekly or at least regular task. Automate it if possible so that it doesn’t get missed. Without an automated backup and recovery strategy in place, your business may well be devastated if the worst happens, and if you want to avoid unnecessary downtime, loss of revenue and more in the event of a serious incident, you need a contingency plan in place at all times.

Lastly - even if you have a top notch data security policy, it’s of no use unless you enforce it.

If you need advice on up to date data security procedures and policies that keep your sensitive data safe, or want to know more about staff training, contact me and I will be delighted to provide you with guidance and advice.

How good is your mailing company?

Just had an interesting phone call with a company about their spam emails. This company has emailed me about one of their "special offers", needless to say I never signed up to receive said offers. When I rang to ask to be removed from the mailing list, the person answering the phone said they had received lots of complaints about the emails. Apparently I have been lucky because I only have two emails, some of the people they have been emailing have been receiving 2 an hour for days! According to the company, they outsourced their email marketing to a company in China and they haven't been following the instructions they were given. A number of people who have been getting the emails have been complaining to the ICO.

So where has this company gone wrong (this is my speculation based on the phone call).

1. Breach 1 - I never gave them permission to email market to me. Never heard of them before the email came through so definitely didn't sign up. You need to have a persons permission to be able to electronically market to them. You should also record where the sign up information was gathered. Lots of people don't remember signing up and the ICO, if they investigate, will look for confirmation you have permission.

2. Breach 2 - The emails did not have an unsubscribe option on the bottom, so gave me no choice but to call to cancel it. Given the person didn't take my email address, I expect more emails from them in the future. There is certain criteria that has to be met when email marketing, one of which is that there is the ability to unsubscribe from future contact. It is an offence to fail to remove someone from your mailing list when they ask.

3. Potential Breach 3 - IF I had given them permission for email marketing, did they also ask my permission to send my details outside of the EEA (to their marketing company in China), probably not. If you are sharing personal information outside the EEA, you have to tell the provider of the information at the time of collection. 

4. Potential Breach 4 - Sending the information to China, which is not an approved country, the company needed a specific clause in place to protect individuals information. As China is not an approved country for data transfers, they company needed a specific clause and contract in place. Seems unlikely in this case that they complied.  https://ico.org.uk/for-organisations/guide-to-data-protection/principle-8-international/

Needless to say this company is already getting attention from the ICO regarding the level of complaints. If you need help to avoid a similar situation, contact me to discuss how we can help. ask@audit-and-risk.co.uk

I am being spammed - the good and bad

I have a lovely new email address which is less than 10 months old and already I am receiving spam emails. Working in data protection means that I want to find out where the spammers are getting my email address so I can stop it. It also provides some insight into how little some companies understand the Data Protection Act.

Recently I have received emails from two different companies. Lets call them Good and Bad.

The first company, Good, sent me emails about advertising in the Daily Mail. They are registered with the Information Commissioners Office as a Data Controller. I contacted the company director to ask where they had got my email address and I was told they had bought my email address as part of a mailing list. To be fair, the emails they sent me did have an unsubscribe option, which I have used, and when contacted said they would remove me from that list and put a block on the email address appearing on other lists. The company director also told me that the list they buy they can use for a year but if a recipient doesn't open an email for 6 months they remove them from their list. Really good response and the company director could not have been more helpful.

The second company, Bad, sent me emails every week for 5 weeks at the same time of the same day each week, they also sent the same emails to my colleague at the same time. They are not registered with the Information Commissioners Office.  In their emails, they claim that one of their colleagues mentioned my company and they think they can help me (yeah, right). They provide IT staff. There is no unsubscribe on their emails (thereby breaching the PECR). The phone number provided on the email rings out and having rung it at various times is not answered. Really not impressed. After a bit of research on the internet (you have to love it) I managed to find an office number to call. Left a message, still awaiting a call back (not holding my breath).

So company Good responded really well to my requests and questions, very helpful and understand I don't want to be contacted again. Company Bad would "really like to work with me" according to their emails but don't answer their phone, handle my data poorly and think that sending me emails at the same time each week wouldn't be considered spam. I know who I would rather share my information with. 

Update: Company Bad have responded to my call. Apparently he noticed my missed calls but he gets lots of calls from companies wanting to sell him something so doesn't follow up, (this from someone sending me spam emails, spot the irony!). Apparently they only have 5 emails that they send out, so as I have had my five there is nothing to look forward to on Tuesdays at 8.36am (shame). They don't know where they got my information from, it could be from a colleague or LinkedIn (really?). They didn't think the Data Protection Act applied as the email address belongs to a company (wrong, as soon as that email is addressed to an individual it becomes personal information). As for being registered with the ICO, he wasn't aware who they are and had not heard of PECR. This is a worrying state of affairs given this company provides CIO's and IT Directors. Company Bad really need to up their game and do some research to comply. They had better hope that the ICO don't take an interest in their lack of registration, abuse of the PECR and inability to record where they obtain information.

Sending emails - Will the ICO be sending you to the naughty step?

On one of the forums that I belong to, a question was recently asked about what is considered a spamming email? The responses were very interesting.There was a lot of discussion about whether you can just add people to your mailing list because they gave you their business card. This really split people into two groups along the lines of "they wouldn't have given you their business card if they didn't want you to stay in touch" and "Just because I gave someone my business card, I wouldn't then expect to be out on their mailing list".

So here is the boring legal bit. Under the PECR (Privacy and Electronic Communications Regulations) people must give permission for you to add them to your mailing list, unless they have bought from you previously and the product you are promoting is something similar. If you don't do this and someone complains to the ICO, they could review your data protection practices and send you to the naughty step.

So how do you end up with spam emails? Well, someone you have given permission to have your email address has sold on their list. Yes they should have asked you first but many websites are unclear as to what they are going to do with your information and some companies have no idea that they should be getting your permission first. Many companies are now aware that we hate having our information sold to others and will make a declaration on their website that they never sell or pass on your information. My advice is always be aware when you are providing your email address what it is going to be used for and if it is used for anything else, either unsubscribe or make contact to correct their information.

So back to the business card discussion. Unless at the time you handed over your business card they asked whether you wanted to be on their list (yeah right!) and they noted your permission down, then they shouldn't have added you. More interesting is that the majority of people on the forum said they would unsubscribe immediately if someone did this. Would you?