Global Data & Privacy Update - February 2017

Welcome to the February Global Data & Privacy Update. This update is dedicated to covering the latest legislative developments affecting the way data is managed and protected, as well as reporting on the most recent news governing data breaches and industry developments.

ICO fines RSA for data protection breach

The ICO has issued a penalty of £150,000 to Royal & Sun Alliance Insurance PLC (RSA) for failing to prevent the accidental loss or damage to personal data, breaching the seventh data protection principle.

It was found that between 18 May and 30 July 2015, a person permitted access to RSA's data server room stole a portable 'Network Attached Storage' device, which included the names, bank account details and sort codes of nearly 60,000 individuals. The device was password protected but unencrypted, and there has been no recovery since the theft. The lack of encryption and the failure to properly restrict access to the server room were highlighted by the ICO as particular reasons why it found there had been a breach of the seventh data protection principle in this case.

The ICO found that the contravention was one likely to cause substantial damage or substantial distress to those affected.

Click here to view the ICO's monetary penalty notice.

ICO fines charities for mishandling donors' personal data

The ICO has fined the RSPCA and British Heart Foundation £25,000 and £18,000 respectively for screening their donors to target them for further fundraising. This was held to be handling personal data in a way inconsistent with the data protection rules. Since the judgment, the Charities Commission has also opened up its own...