ICO fines council worker for 'stealing' vulnerable people's personal info

[elsiegee40]

This one might be useful for training staff in your establishment... an actual real person being fined by the ICO for using his private email for personal data

 

My bold in the quotes

During an initial investigation, the council found the defendant had sent 34 emails to a private email account in February 2016, prior to him leaving the organisation.

 

It was later discovered that the personal information of 349 individuals were sent to his personal email address including sensitive personal data in relation to service users including medical conditions, details of care and financial details and records of debt.

 

ICO Press Release here:

 

Ex-council worker fined for stealing vulnerable people’s personal information - ico.org.uk

Edited September 30, 2017 by ZeroHour

[enjay]

I haven't read the article, but from your extracts it sounds like they're not being fined solely for using a personal email account (unlike Hillary Clinton!), the issue here is they sent things they shouldn't have to the address shortly before leaving.

[elsiegee40]

I haven't read the article, but from your extracts it sounds like they're not being fined solely for using a personal email account (unlike Hillary Clinton!), the issue here is they sent things they shouldn't have to the address shortly before leaving.

They got them for data theft. But data theft was because it had been taken to a private email account. The fact that they had left was circumstantial. I guess it's whichever charge is easiest to pin on the offender.

 

The moral of the story is don't use your private email for data that's subject to the DPA... better still, don't use it all for business purposes

[pcstru]

They got them for data theft. But data theft was because it had been taken to a private email account. The fact that they had left was circumstantial. I guess it's whichever charge is easiest to pin on the offender.

It is not entirely clear from the press release but it is likely not quite as simple as just sending email to a private address; the implication is he did it with the intent to use that data in another enterprise where processing of the data would be performed for his own purposes. It is common behaviour for sales people to take customer contact lists with them - every had a call from your friendly account manager only to find they have started working for a new company? They were quite likely committing a criminal offence to do that.

 

As a slight aside, many people don't realise that with a subject access request under DPA, not only are you entitled to know what data a company holds about you, you are entitled to know how/where they got hold of that data.

 

The moral of the story is don't use your private email for data that's subject to the DPA... better still, don't use it all for business purposes

Yep.

[elsiegee40]

It is not entirely clear from the press release but it is likely not quite as simple as just sending email to a private address; the implication is he did it with the intent to use that data in another enterprise where processing of the data would be performed for his own purposes. It is common behaviour for sales people to take customer contact lists with them - every had a call from your friendly account manager only to find they have started working for a new company? They were quite likely committing a criminal offence to do that.

 

As a slight aside, many people don't realise that with a subject access request under DPA, not only are you entitled to know what data a company holds about you, you are entitled to know how/where they got hold of that data.

 

 

Yep.

 

I think you're right, but it's still useful to have an actual real case study involving a fine in your armoury when trying to scare the pants off educate colleagues on why they must use only their school email account