Data Breach Procedure

Version number:	1.0
Date effective:	31 May 2018
Issued by:	[ X ] Information Governance Manager / Data Protection Officer
Review date:	31 May 2020

Document Control Information

Version	Date	Description
0.1	30/04/2018	First draft
0.2	17/05/2018	Minor changes in response to feedback from GDPR Project Team
1.0	31/05/2018	Approved by CMT

Contents

Section	Description	Page
1.0	Introduction	3
2.0	Reporting Data Breaches / Near Misses	3
3.0	Data Breach Team Actions	4
4.0	Internal reporting and lessons learned	5
5.0	Definitions	5
Appendix 1 – Data Breach / Near Miss Reporting Form	7

Data Breach Procedure

Introduction

This document sets out the procedure for reporting personal Data Breaches/Near Misses and how these incidents will be managed.

Personal Data Breaches that meet a certain threshold must be reported to the Information Commissioner’s Office (ICO) within 72 hours; therefore all Data Breaches must be reported internally to the Data Breach Team within 24 hours.

The Council is obliged to document any and all Data Breaches that occur, regardless of whether we are required to notify the ICO. Accordingly, it is mandatory for all staff to report Data Breaches to the Data Breach Team, even if the Breach might seem relatively minor (see Section 2.0 – Reporting Data Breaches / Near Misses).

The aim of this process is to minimise the impact of a Data Breach on the individual(s) affected and to learn from such events to prevent a repeat. All reported incidents will be handled promptly and sensitively.

Reporting Data Breaches / Near Misses

Recover and contain: If you discover a Data Breach has occurred, your first actions should be to recover the data and contain the incident, i.e. prevent any further Breaches. The person who discovers the Breach is the person responsible for ensuring that appropriate action is taken; you should not wait for another department or member of staff to notice and/or take action.

Report: Once you have taken steps to contain the incident, you should immediately report the incident to the Data Breach Team at [ X ]. This applies equally to incidents that occur outwith normal office hours. The Data Breach/Near Miss Reporting Form in Appendix 1 of this procedure should be used for this purpose.

Personal Data Breaches that meet a certain threshold must be reported to the Information Commissioner’s Office (ICO) within 72 hours, or the Council could be penalised with a substantial fine; therefore all Data Breaches must be reported internally to the Data Breach Team within 24 hours.

When emailing regarding a Data Breach, you should mark the email with ‘high importance’.

Responsibility: Heads of Service are responsible for ensuring that all their staff are aware of the Data Breach reporting procedure and have access to the relevant contact details. Service Managers are responsible for ensuring that appropriate arrangements are in place for out-of-hours Breach reporting, and that all their staff are aware of these procedures.

Risk and repercussions: Not reporting a Data Breach correctly or in good time will increase the potential risk to the privacy of those affected and the likelihood of the Breach becoming a major incident. Deliberate failure to report known Data Breaches could be considered misconduct and as such may become subject to disciplinary procedures.

Assessment: All reported Data Breaches will be immediately assessed by the Data Breach Team, which will convene to discuss the incident if appropriate. Those directly involved in the incident may also be asked to attend.

Examples: Some examples of Data Breaches are listed below:

Loss or theft of data or equipment on which personal data is stored

Sending personal information to the wrong address, including email

Inappropriate access to personal information

Unauthorised access to information systems

Sharing information with other agencies without appropriate protections (e.g. Police)

Using or sharing information for a purpose other than it is intended

Obtaining personal information by deception

Human error

Cyber attacks

Corruption of personal data/information

Any security weakness in process – suspected or otherwise

Destroying information inappropriately

Data Breach Team Actions

The initial priority of the Data Breach Team is to contain and recover from the situation, and assess the impact and risks to the individuals affected. Where a Data Breach /Near Miss Reporting Form has been received by the Data Breach Team, the information provided should guide and inform the Data Breach Team’s assessment.

The Data Breach Team will assess whether it is necessary to inform the individual(s) impacted by the Data Breach. This will be done where there is a high risk of harm, for example, resulting in discrimination, identity theft, fraud, or financial loss. This is important to allow the individuals to take immediate action to protect themselves against the effects of a Breach.

Individual members of staff must not notify affected individuals directly: the decision to notify individuals and external organisations will be taken by the Data Breach Team.

Even if a Breach is determined not to meet the threshold for informing the data subjects, it may still be notifiable to the ICO unless we can demonstrate that the Breach is unlikely to result in a risk to rights and freedoms.

Where individual/s are advised of a Data Breach the following information must be provided:

A description of the nature of the Breach, including what data was involved and associated timelines;

The name and details of the Data Protection Officer or other contact point;

A description of the likely consequences of the Breach; and

A description of the measures taken or proposed to be taken by the Council to address the Breach, including, where appropriate, measures to mitigate its possible adverse effects.

The Data Breach Team will assess if it is necessary to inform the ICO of the Data Breach. The

decision to report will be based on the reporting guidance issued by the ICO. According to current guidance, if the Breach results in a ‘likely risk to the rights and freedoms of individuals’, it is notifiable to the ICO. If the Council takes the decision not to report to the ICO, we must be able to demonstrate that the Breach does not pose a likely risk.

In some cases, it may be necessary to provisionally report an incident to the ICO pending further or continued investigation.

If the Data Breach Team’s assessment concludes that the Breach is notifiable to the ICO, this will be immediately communicated to appropriate senior managers. Likewise, if the Team concludes that individuals concerned must be informed, the senior managers will be notified.

Internal reporting and lessons learned

Following the Data Breach Team’s initial assessment of the Breach / Near Miss, they will consult with the parties involved to identify lessons learned and support the Service in establishing a plan to prevent a repeat. The Data Breach Team will then make a written recommendation to the relevant Team or Service Manager. Where appropriate, these recommendations will be made to all Services, not just the one affected.

The Data Breach Team will maintain a log of all Data Breaches / Near Misses and retain such logs in line with the Council’s Retention Schedule – currently 3 years.

All Data Breaches will be reported quarterly to the Corporate Management Team (CMT).

Depending on the severity of the incident there may also be a requirement to report the matter to the Police, National Cyber Security Centre or other agencies, including the press.

Definitions

Personal data: any information relating to a person who can be directly or indirectly identified. This includes identifiers including names, identification numbers, location data, online identifiers or any other information that identifies an individual.

Special category/sensitive personal data: Information which falls under specific definitions under the General Data Protection Regulation (GDPR). This includes racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data; health data; sex/gender, sex life or sexual orientation.

Data subject: the individual whose personal information is being processed.

Data Breach: the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to personal data. Examples include (but are not limited to) access by an unauthorised third party; sending personal data to the wrong recipient; records or computer equipment being lost or stolen, including mobile devices; inappropriate alteration of personal data; loss of availability of personal data. Personal Data Breaches that meet a certain threshold must be reported to the Information Commissioner’s Office (ICO) within 72 hours; therefore all Data Breaches must be reported internally to the Data Breach Team within 24 hours.

Serious Data Breach: a Data Breach in which there is a ‘likely risk’ to the data subject(s)’ ‘rights and freedoms.’ Serious Data Breaches must be reported to the Information Commissioner’s Office within 72 hours of detecting the Breach. In determining whether a Data Breach is ‘serious’, the likelihood and the severity of the Breach’s impact should be considered.

High risk: the threshold for informing individuals (‘data subjects’) about a Breach involving their personal information. The threshold for informing individuals is higher than that for notifying the ICO. In determining whether a Breach results in a ‘high risk to the rights and freedoms of individuals’, the likelihood and the severity of the Breach’s impact should be considered.

Likely risk: the threshold for reporting a Data Breach to the Information Commissioner’s Office. If it is likely that a Breach will result in a risk to the rights and freedoms of individuals, it must be reported to the ICO within 72 hours. Examples include physical / material damage or emotional distress, loss of control of their data or limitation of their rights, discrimination, identity theft, fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality protected by professional secrecy or any other significant economic or social disadvantage.

Near miss: any security incident involving personal data which results in a risk to that data short of an actual Data Breach. There is no time limit for the reporting of near misses, however they should be reported as soon as possible to the Data Breach team to allow for appropriate response and analysis of lessons learned.

Information Commissioner’s Office: the national regulator for data protection in the United Kingdom. The Information Commissioner has the power to impose financial penalties, perform audits and otherwise monitor compliance with data protection legislation.

Appendix 1 – Data Breach Reporting Form

Part 1 – Incident Report

For immediate submission to the Data Breach Team

Date(s) incident took place	Date incident reported
Your name	Your department
Email	Phone
I am reporting a (delete as appropriate): DATA BREACH / NEAR MISS

INCIDENT DETAILS – Essential information about how the breach occurred, what data was involved, and who is affected.

Incident timeline: how and why the incident occurred. Provide as much detail as possible about the incident itself (add rows if necessary). If you don’t know the full details, provide as much information as you have available.

Date/time	Incident details	Actioned by

Who are the individuals that have been affected by the breach? Tick all that apply.

☐	Clients	☐	Vulnerable adults
☐	Children	☐	Staff
☐	Other; explain _____________________________________________________________

Please describe the type(s) of personal data affected (e.g. name, address, DOB, NI number, bank details, etc.):

Did the data include any 'special categories of data', such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health (or medical), sex life or sexual orientation?

YES / NO

Did the data include any ‘high risk’ types of data, such as financial details or other similar confidential information?

YES / NO

In what format is the data concerned? Tick all that apply.

☐	Paper	☐	Video
☐	Email	☐	Audio (e.g. voicemail)
☐	Electronic file	☐	Photograph
☐	Other; explain ___________________________________________________________

CONTAINMENT – What steps have you taken to contain and recover the situation?

Actions timeline (actions taken to contain the breach). Provide as much detail as possible.

Date/time	Actions taken	Actioned by

What other staff members does the incident concern, if any?

Name	Role	Service

What specific containment actions have been taken?

Containment	Response	Comments
Has the information been recovered or confirmed as destroyed?	YES / NO / UNSURE
Is the initial breach likely to result in any additional breaches? For example, if someone was sent a client’s personal information by mistake, have they or are they likely to share that information with others, resulting in further breaches?	YES / NO / UNSURE
Have you conducted a thorough search for anything that may be missing?	YES / NO / UNSURE
Have steps been taken to prevent an immediate repeat of the incident?	YES / NO / UNSURE

ASSESSING THE RISK – What is the scale and impact of the incident?

In your opinion, is this breach likely to have a significant effect on the privacy of the individuals concerned? For example, this might include discrimination, damage to reputation, financial loss, physical harm, distress, identity theft, or other effects. Explain.

How many individuals' personal data has been affected by the breach?
Is the data in the hands of someone whose intentions are unknown or malicious?	YES / NO / UNSURE
Is the data in the hands of a trusted party, e.g. a Council employee or with a partner organisation we can trust to delete or return it?	YES / NO / UNSURE
Can an individual be personally identified from the data?	YES / NO / UNSURE

BREACH NOTIFICATION – Who should be told about the incident?

Have you already contacted the Data Breach Team prior to submitting this form?	YES / NO
If yes, whom did you contact in the Data Breach Team, and when?
Whom else have you contacted about this incident?
Whom else should be told?

You should now submit this form as quickly as possible to the Data Breach Team at.

[ X ]

________________________________________________________________

Part 2 - Investigation

For completion in conjunction with the Data Breach Team, following initial reporting.

EVALUATION AND RESPONSE – What could be done to prevent a recurrence of the incident?

What training did those involved in the incident receive?

Is there a Council policy/procedure/guideline that relates to the process that went wrong?

What can be done to prevent a repeat incident?

Any other information?

OFFICIAL USE – DATA BREACH TEAM

Have the Police been informed?	YES / NO
Have the affected individuals been informed?	YES / NO
Has anyone else been informed? If so, please explain.

Please list the reasons why the incident does/does not constitute a likely risk to the rights and freedoms of the individual:

Please list the reasons why the incident does/does not constitute a high risk to the rights and freedoms of the individual:

Outcome of decision whether to inform the ICO:	YES / NO
Outcome of decision whether to inform the data subject(s):	YES / NO
Senior managers informed:

Data Breach Team Recommendations: