Data Breach Policy

In a nutshell

Unauthorised a Data Breach is a disclosure or loss of personal data.

Community Council for Somerset (CCS) is required under the General Data Protection Regulation (GDPR) and the UK Data Protection Act, 2018 to ensure the security and confidentiality of all the personal and sensitive personal data it processes, including that processed by third parties acting on its behalf. Every care should be taken by employees (current, past and prospective), trustees, volunteers, clients, consultants and suppliers to protect the personal data they work with and to avoid the unauthorised disclosure or loss of personal data.

Legislative framework

There are eight Data Protection Principles contained in the General Data Protection Regulation (GDPR) and the UK Data Protection Act, 2018 which must be complied with when processing personal data. Failure to comply with any of these Principles is a breach of Data Protection.

Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless: (a) at least one of the legal bases in Schedule 2 is met, and (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Personal data shall be obtained only for one or more specified and lawful purposes and shall not be further processed in any manner incompatible with that purpose or those purposes.
Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
Personal data shall be accurate and, where necessary, kept up to date.
Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes
Personal data shall be processed in accordance with the rights of data subjects under this Act.
Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

This policy is concerned with the seventh Data Protection Principle: ‘Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.’

Examples of a breach of this Principle would include:

personal data accidentally being sent to someone (either internally or externally) who does not have a legitimate need to see it;
databases containing personal data being compromised, for example;
being illegally accessed by individuals outside the CCS;
loss or theft of laptops, mobile devices, or paper records containing personal data;
paper records containing personal data being left unprotected for anyone to see, for example:-

— files left out when the owner is away from their desk and at the end of the day;

— papers not properly disposed of in secure disposal bins that can then be extracted or seen by others;

— papers left at photocopying machines;

staff accessing or disclosing personal data outside the requirements or authorisation of their job , for example:-

— using a third-party database where permissions have been granted, to see any personal data records including special/sensitive data categorise of either the employee, a family member or close friend Unauthorised access of any data (where permissions have not been granted and where a data sharing agreement is not in place) is a criminal offence, and will be treated as an act of gross misconduct resulting in dismissal.

being deceived by a third party into improperly releasing the personal data of another person; and the loss of personal data due to unforeseen circumstances such as a fire or flood.

A data breach relates to the loss of personal data and should be notified following the procedure described below. A security breach relates to the loss of equipment containing personal data. Where a security breach has been notified that also involves personal data staff must also follow the data breach policy.

Action to be taken in the event of a data breach

On discovery of a data breach, the following actions should be taken by CCS:-
Evaluation and response by CCS Management Team
Assessing the risk and notifying the individual(s) the breach may relate to without undue delay
Containment and recovery
Contact your Data Protection Officer who has 72 hours to contact Information Commission Officer if reportable

Containment and recovery

Who is responsible for action? On discovery of a data breach, the individual must notify their line manager as soon as possible who will then be required to contact the DPO IG Smart and senior management team. Please see emergency contacts on Breath & office notice board.

Records of Data Breaches
All data breaches are recorded on a data breach log.

Action to be taken

The immediate priority is to contain the breach and limit its scope and impact.
Where personal data has been sent to someone not authorised to see its staff should:
tell the recipient not to pass it on or discuss it with anyone else
tell the recipient to destroy or delete the personal data they have received and get them to confirm in writing that they have done so;
warn the recipient of any implications if they further disclose the data, and inform the data subjects whose personal data is involved what has happened so that they can take any necessary action to protect themselves.

The line manager responsible for the employee, volunteer/trustee where the breach occurred must be notified and they must immediately report it to the DPO and provide the following information:

date and time of the breach;
date and time breach detected;
who committed the breach;
details of the breach;
number of data subjects involved; and
details of actions already taken in relation to the containment and recovery.

Assessing the risk

The DPO is responsible for assessing the risk and whether it needs reporting to ICO and any remedial action. The subsequent report will follow the ICO’s guidance on Breach Management and will consider the following:
How the breach occurred.
The type of personal data involved.
The number of data subjects affected by the breach.
Who the data subjects are.
The sensitivity of the data breached.
What harm to the data subjects can arise? For example, are there risks to physical safety, reputation or financial loss?
What could happen if personal data is used inappropriately or illegally?
For personal data that has been lost or stolen, are there any protections in place such as encryption?
Notifying the ICO
Responsibility for notifying the ICO rests with the DPO. They will complete a breach notification form.

Related Policies:
• Data Protection Policy
• Privacy Policy

Responsibility
Overall responsibility for this policy lies with the CCS Board of Directors / Trustees and its implementation with the Senior Management Team.

Relevant Contact Information
• DPO IG Smart email:info@ig-smart.com Tel: 0207 167 4268
• https://ccslovesomerset.org/about-us/ccs-leadership-team/

Disclaimer
This policy is intended as guidance for management and employees. It does not confer any contractual rights on individuals.