Since the first appearance of General Data Protection Regulation (GDPR), I’ve strenuously avoided any direct interaction with it if at all possible. In particular, I’ve been careful to ensure that nobody is under any illusion that my role involves any responsibility for our company’s implementation of GDPR. In this I have been largely successful. I say largely, because the people who send spam don’t seem to have noticed: I suspect that anybody with the word “security” in their title has had a similar experience.
[ See our related story: What is GDPR? 8 things leaders should know. ]
Of course, I have a decent idea what GDPR is supposed to be about: Making sure that data that organisations hold about people is only used as it should be, is kept up to date, and that people can find out what exactly what information relating to them exactly is held. (For more detail, read Being open about data privacy.)
This week, I got more involved GDPR than I’d expected: I ended up reporting a possible breach of data. My data. As it happens, my experience with the process was pretty good – so good, in fact, that I think it’s worth giving it as an example.
Breach!
A bit of scene-setting. I live in the UK, which means that, like pretty much all companies and organisations here, it is subject to the GDPR. Last week, I had occasion to email a department within local government about an issue around services in my area. Their website had suggested that they’d get back to me within 21 days or so, so I was slightly (and pleasantly) surprised when they replied within five.
The email started so well: The title referred to the village in which I live.
It went downhill from there. “Dear Mr Benedict”, it ran. I should be clear that I had used my actual name for the purposes of this enquiry, so this was something of a surprise. (I have changed the name they used for this article, for obvious reasons.) “Oh, well,” I thought to myself, “they’ve failed to mail merge the name field properly.” I read on. “Here is the information you have requested about Ambridge (again, I am protecting the real village name)…”. I do not live in that village. So far, this was just annoying: clearly the department had responded to the wrong query. But it got worse. “In particular regards to your residence, Willow Farm, Ambridge...”
The department had sent me information which allowed me to identify Mr. Benedict and his place of residence. They had also failed to send me the information that I had requested. What worried me more was that this might well not be an isolated event. There was every chance that my name and address details had been sent to somebody else, and even that there was a cascade effect of private details being sent to email address after email address. I mentioned this in annoyance to my wife – and she was the one to point out that it was a likely breach of GDPR. “You should report it,” she said.
So I went to the local government office website and had a quick look around it. Nothing obvious for reporting GDPR breaches. I phoned the main number and got through to enquiries. “I’d like to report a possible data breach, please,” I said. “Could you put me through to whoever covers GDPR?”
To be honest, this was where I thought it would all go wrong. It didn’t. The person on the enquiries desk asked for more information. I explained what department it was, about the email, and the fact that somebody else’s details had been exposed to me, I strongly suspected in breach of GDPR.
“Let me just see if I can find someone in our data team,” she said, and put me on hold.
I don’t know if you’ve ever been put on hold by someone in a local government office, but it’s rarely an event that should be greeted with rejoicing. I prepared myself for a long wait, and was surprised when I was put through to someone fairly quickly.
The man to whom I spoke knew what he was doing. In fact, he did an excellent job. He took my details, he took details of the possible breach, he reassured me that this would be investigated. He was polite, and seemed keen to get to the bottom of the affair. He also immediately grasped what the problem was, and agreed that it needed to be investigated. I’m not sure whether I was the first person ever to call up and so this was an adrenaline-fuelled roller coaster ride into uncharted territory for him, or whether this was a routine conversation in the office, but he pitched his questions and responses at exactly the right level.
I offered to forward the relevant email to him so that he had the data himself. He accepted. The last point was the one that impressed me the most. “Could you please delete the email from your system?” he asked. This was absolutely the right request. I agreed and did so.
And how slowly do the wheels of local government grind? How long would it take me to get a response to my query?
I received a response the next day, from the department concerned. They assured me that this was a one-off problem, that my personal data had not been compromised, and that there had not been a widespread breach, as I had feared. They even sent me the information I had initially requested.
Two lessons learned
My conclusions from this:
From an individual’s point of view: Yes, it is worth reporting breaches. Action can, and should be taken. If you don’t get a good response, you may need to escalate, but you have rights, and organisations have responsibilities: Exercise those rights, and hold the organisations to account. You may be pleasantly surprised by the outcome, as I was.
From an organisation’s point of view: Make sure that people within your organisation know what to do if someone contacts them about a data breach, whether it’s covered by statutory regulations (like GDPR) or not. This should include whoever answers your main enquiry line or receives messages to generic company email accounts, and not just your IT or legal departments.
Educate everybody in the basics, and make sure that those tasked with dealing with issues are as well-trained and ready to respond as the people I encountered.
[ Where will GDPR affect your organization? See our related story: GDPR: Biggest pain points, now and later. ]
This article originally appeared on Alice, Eve, and Bob – a security blog and is republished with permission.
