The Office of the Data Protection Authority (ODPA) has released its latest statistics on the number of personal data breaches reported by local organisations during May and June 2021.
In total, 29 such breaches were reported from 1 May through to 30 June, of which four were cyber security related and the remainder non‐cyber incidents. Sending information about people to incorrect recipients, either by email or post, remains the most reported incident.
Overall, the latest figures are broadly consistent in totals and nature of breaches with established trends going back to when breach reporting became mandatory in 2018. 16 (55% of total reported) incidents related to information about people being either posted or emailed incorrectly, resulting in that personal data ending up in the wrong hands. 7 (24% of total reported) incidents happened because of organisations either giving access to or disclosing, information about a person when they should not have done so. These incidents can happen accidentally or deliberately.
Anyone (‘controllers’ or ‘processors’ as the Law calls them) who uses information about people must remember that mandatory breach reporting is just a small part of a much bigger picture of how to respond after someone’s information has been breached. If you use people’s data, it is your responsibility to have an appropriate breach response plan, so that you can quickly minimise any harms caused when things don’t go well. See odpa.gg/breach‐response for guidance on this.
Emma Martins, the Bailiwick’s Data Protection Commissioner, ‘’We continue to be grateful to our regulated community for the positive way in which they engage and comply with the breach reporting duties. It is our aim to be as open and transparent in all our activities as we can be and allowing our community to have accurate and meaningful information about data risks is an important part of that. The clear trends we continue to see point to the fact that there is much that we can all do to minimise risk. Building a considered breach response process into an organisation is not only a requirement of the legislation, it is also an essential part of running an effective, successful and trusted business.”
