Guernsey’s Office of the Data Protection Authority has released its latest statistics on the number of personal data breaches reported by local organisations during July and August 2021.
In total, 36 breaches were reported from 1 July through to 31 August, this is the highest bi-monthly figure since late 2019. Of the 36 breaches, 22 occurred because information about, or related to, a person was sent to the wrong recipient, either by email (13 reported incidents) or post (9 reported incidents).
The ODPA is encouraging all local businesses and organisations to take action on these preventable incidents which so often arise due to human error. In extreme cases, a personal data breach can cause lasting harm to the people whose data has been breached, not to mention the reputational damage that can be done to the organisations responsible for what went wrong. Taking steps to mitigate human error is therefore an exercise in accountability and risk management.
For an overview of the issues and some practical steps that can be taken to reduce human error click here.
One of the 36 incidents reported was from an organisation that sent a lengthy health report about a child, via post, to the wrong family. This incident should serve as a reminder of three key points.
- Firstly how important it is for local ‘controllers’ (organisations or businesses that decide how people’s data is used) to have robust governance, fit-for-purpose processes, and regular staff training around how information about people is handled.
- Secondly, where the data is particularly sensitive (‘special category data’ in legal terminology) those safeguards must be strengthened further.
- Lastly, data protection does not start and stop on an organisation’s IT systems, the protection must follow the data wherever it goes and in whatever form it takes: including documents containing information about people that are printed off and posted.
Emma Martins, the Bailiwick’s Data Protection Commissioner, commented: “We are grateful for the honesty local organisations show by self-reporting these breaches to the ODPA. Each is an opportunity for lessons to be learned, and for improvements to be made.
“Remember that at the heart of these reported incidents are human beings who have been impacted. In a lot of cases the risk to that person is successfully mitigated by the steps an organisation takes to respond to the breach, but in rare cases there is damage that simply can’t be undone. This is why we must all work to predict where damage to human beings is likely, and take action to prevent it from happening in the first place.”
