The Information Commissioner’s Office (ICO) has reprimanded two Northern Irish organisations for disclosing people’s information inappropriately via email.
Both the Patient and Client Council (PCC) and the Executive Office disclosed recipient details by using inappropriate group email options. They should have found an appropriate alternative such as mail merge.
The PCC had sent an email to 15 people across Northern Ireland, each of whom had lived experience of gender dysphoria, using the carbon copy (cc) option. Although the body of the email did not contain personal information, the people who received the email could reasonably infer that the other recipients also had experience of gender dysphoria, given their inclusion in the email. This could have been information the recipients would not wish to be shared with people unknown to them.
The Executive Office’s Interim Advocate’s Office, established following the report of the Historical Institutional Abuse (HIA) Inquiry, sent an e-newsletter to 251 subscribers using the ‘to’ field. Although only email addresses were disclosed, it can be inferred that the people included in the email were likely to be victims and survivors, as the newsletter content was tailored to survivors who were wishing to engage, or who were already engaging, with the HIA Inquiry compensation scheme.
“This type of data breach is all too common but is easily avoidable. Organisations must take responsibility for training their staff properly and for putting appropriate systems and policies in place to avoid such incidents.
“Even if the content of an email is not sensitive or confidential, identifying people who have received it could reveal sensitive or confidential information about them. That could be very distressing and potentially harmful to the people affected.”
– John Edwards, UK Information Commissioner
Under data protection law, organisations must have appropriate technical and organisational systems in place to ensure personal data is kept safe and not inappropriately disclosed to others.
The ICO’s investigation found that the email options chosen in both cases were not appropriate and that both organisations had insufficient guidance for staff about sending communications by bulk email.
The ICO recommended that PCC and the Executive Office should review and update their policies and procedures and provide appropriate guidance to staff in relation to email use. Both organisations will need to provide details of actions taken within three months of the reprimand being issued.
Notes to editors
- The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and information rights law, upholding information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
- The ICO has specific responsibilities set out in the Data Protection Act 2018 (DPA2018), the United Kingdom General Data Protection Regulation (UK GDPR), the Freedom of Information Act 2000 (FOIA), Environmental Information Regulations 2004 (EIR), Privacy and Electronic Communications Regulations 2003 (PECR) and a further five acts and regulations.
- The ICO can take action to address and change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit.
- To report a concern to the ICO telephone call our helpline on 0303 123 1113, or go to ico.org.uk/concerns.
