Data breaches – prevention is better than cure

Serious data breaches can be extremely costly for organisations when they occur.

Despite this, we find that many businesses are unprepared for dealing with such an event, or have neglected to invest in appropriate measures to prevent them.  It can be seen as a “It’ll never happen to us” mindset. After all, it can be easy to put off investing funds into something that you don’t envisage ever happening, whether that be our roof caving in, or a data breach at our place of work, especially when there are other competing priorities for our budgets and resources.

Failing to implement proper measures to prevent breaches and to deal with them once they have occurred can leave organisations in hot water with the regulator and your customers and wider stakeholders.

What is a data breach?

The term “data breach” has a very wide definition, essentially encompassing anything that can compromise the confidentiality, availability or integrity of personal dataInformation which relates to an identified or identifiable natural person.. Breaches come in all shapes and sizes, from simply Cc’ing instead of Bcc’ing an email recipient, to leaving an unencrypted work laptop on a train, to a huge cyberattack which exfiltrates and or encrypts data stored on an entire server network. Obviously, these different breaches present different levels of risk to both data subjects and the organisations that suffer them, and therefore warrant different levels of investment in order to protect against them.

For the more serious of breaches, those that result in a risk to the rights and freedoms of the data subjects affected, the requirement that you have to report these incidents to your supervisory authorityAn authority established by its member state to supervise the compliance of data protection regulation. (within 72 hours, as required by the GDPR) brings with it the potential for more serious consequences. This is unsurprising given you are obliged to bring your own failings to the attention of your regulator.

Further up the chain of seriousness, however, when a breach results in a high risk to the rights and freedoms of the data subjects, you must inform not only your supervisory authority of the breach but also the affected data subjects – which may well have an adverse on your brand and reputation.

Consequences of a breach – individuals

The effects that a data breach might have on the individuals impacted can range right from no effect at all, through to a slight inconvenience (e.g. having to provide deleted information again), right through to a catastrophic impact. This could include:

• Financial loss (if bank details are stolen)
• Embarrassment (if sensitive personal information is leaked)
• Discrimination (if special category dataTypes of personal data listed in Article 9(1) GDPR that are considered sensitive and thus require extra protection. Article 9(1) lists data relating to: • racial or ethnic origin • political opinions • religious or philosophical beliefs • trade union membership • genetic data • biometric data • health • sex life • sexual orientation Where these types of personal... such as sexual orientation; political or philosophical views; or disability information is publicised)
• Distress
• Identity theft or fraud
• Reputational damage
• Loss of confidentiality

These are all considerations that must be taken into account when assessing whether your supervisory authority, and possibly the data subjects themselves, need to be informed of the breach.

Consequences of breaches – organisations

In addition to the potential to cause harm to your data subjects, data breaches can also significantly harm your organisation.

• Financial damage

When people first think about the financial loss caused by a data breach, thoughts immediately spring to the potential fines to which organisations are exposed – under the GDPR this is up to €20 million (£17.4 million) or 4% of global annual turnover.

Examples of financial consequences is the Information Commissioners Office’s (ICOThe United Kingdom’s independent supervisory authority for ensuring compliance with the UK GDPR, Data Protection Act 2018, the Privacy and Electronic Communications Regulations etc.) fines of British Airways and Doorstep Dispensaree. The ICO fined British Airways £20 million for failing to protect the personal data of 400,000 customers. Following the ICO’s investigation, it was found that the breach was preventable if adequate security measures were in place.

The ICO also fined Doorstep Dispensaree £275,000 after it was discovered that documents containing names, addresses, dates of birth, prescriptions, medical information and NHS numbers were left in the courtyard and were not marked as confidential waste. Both of these cases stresses the importance of having good breach management and data protection policies and procedures in place. Doorstep Dispenaree’s case could have easily been avoided if someone was trained in handling confidential waste and they had destruction policies in place.

Even without a penalty from a supervisory authority, the administrative cost of the fallout from a breach and dealing with it can soon rack up. Financial damage can result from the inability to service customers and clients; the costs of re-building systems and networks that have been compromised; having to get expert third party advice on forensic investigations, mitigations and dealing with the breach; and even in compensation claims sought by the affected individuals.

In fact, research conducted by Ponemon Institute and IBM determined that the average financial cost of a data breach to a large business was $4.24million. In short, breaches are expensive.

• Reputational damage

Aside from the monetary value of a data breach, even relatively “cheap” breaches can cause irreparable harm to an organisation’s reputation, particularly if it claims to value security and privacy.

Thanks to the huge increase in awareness around data protection and privacy rights that has occurred since the EU GDPRRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data (General Data Protection Regulation). first came into existence, a large part of which can be attributed to the publicity that large data breaches now command, data subjects are far more critical of businesses and their data protection practices. Data subjects will not stand for the misuse of their personal data, which means organisations are held to account far more and, as we have seen time and time again, individuals are willing to take their business elsewhere if organisations prove to be unworthy custodians of their personal data.

The answer? Invest in prevention

Whilst it is impossible to reduce the risk of experiencing a data breach to zero (they are, unfortunately, just part of running an organisation), investing in measures to protect against data breaches is essential for all organisations, as well as being part of their Article 32 GDPR obligations. What this means for your organisation will depend upon your budget, the size of your organisation, the types of personal data you processA series of actions or steps taken in order to achieve a particular end. and the systems you use, but could include:

• Implementing staff policies on the appropriate handling of personal data and information security
• Providing regular staff training on how to prevent and deal with data breaches (e.g. how to spot phishingA type of scam where attackers try to deceive people into revealing sensitive information or installing malicious malware. Phishing attacks are most commonly delivered by email. emails)
• Having a robust Breach Policy and ProcedureAn approved and established way of completing a certain task. for dealing with them when they do occur
• Data security accreditations such as CyberEssentials or ISO 27001
• Implementing access controlsA series of measures (either technical or physical) which allow personal data to be accessed on a need-to-know basis. including MFA; MDM; and access monitoring
• Using firewalls; antivirus software; and spam filters
• Creating back-ups of systems and implementing a disaster recovery plan

Ultimately, whilst investing in data breach prevention at the outset may seem like a big commitment at the time, your future self may well thank you. Because when it comes to data breaches, the old adage is true – prevention really is better than cure.

The DPO Centre offers advice and support on preventing and dealing with data breaches, including the creation of bespoke policies around data breaches and wider information security. We also offer personalised data protection training, delivered both in person or remotely. For further information, please complete the contact form below.