A total of 26 personal data breaches have been reported to the Office of the Data Protection Commissioner (ODPC) in the two months up to 18 October, compared with 32 reported breaches in the previous reporting period, the three months to 18 August.
The ODPC says the increase is likely to be because organisations are becoming more aware of their legal obligation to report breaches.
Most breaches were low level, requiring no further action. However, the ODPC has many ongoing investigations into breaches and complaints that do require further action. There has also been an increase in hacking-related incidents, particularly hackers gaining control of email accounts.
Guernsey’s Data Protection Commissioner Emma Martins (pictured) commented: "The continued high levels of compliance by local organisations when reporting these incidents is to be welcomed. Taking a proactive approach in this area will help to enhance confidence in the organisations handling our personal data."
The breach reports received suggest that organisations are exposed to the greatest risk of breach when personal data leaves their direct control, either by post or email.
ODPC recommendations
When using postal or email systems for sending personal information:
• Regularly check your email security – update patches and, if you are making any significant changes, think about whether penetration testing is necessary.
• Pause, think and check before you send – remind all staff members who post or email letters/documents containing personal data to slow down and always double-check the recipients are correct and appropriate.
• Avoid complacency – consider the potential implications of the information you are handling falling into the wrong hands and take all reasonable precautions to prevent this from happening.
In addition, when informing the ODPC that your organisation has experienced a breach, beware of the secondary breach. You don’t need to send the specific evidence of the breach, just how it happened, what personal data has been put at risk, how many people’s data are affected, the category of person affected (staff members, customers, suppliers) and the category of personal information affected.
• The Office of the Data Protection Commissioner is working to improve its online breach reporting mechanism and has asked for any comments to be submitted via enquiries@odpc.gg