UK playing central role in Facebook data misuse probe

Building a security community

On the conference theme of “building a security community”, Denham said the ICO plays a role in building and maintaining four equally important communities of practice and interest.

These are the international community, where the ICO works with other countries to enhance privacy protection for the UK public; the UK protective community, where the ICO works with other regulators and official bodies to ensure the UK is the safest place online; the UK protective community, where the ICO works with other regulators and official bodies; and the internal community of the ICO and organisations.

Commenting on Brexit in the context of data protection, Denham said the final legal relationship between the EU and the UK is “one for the politicians” – but “there is no doubt that achieving a treaty arrangement or an adequacy decision with the EU represents the simplest way of ensuring the continued frictionless flow of data between the EU and the UK”.

She added: “There is equally no doubt that having domestic laws that achieve a high standard of data protection and are broadly consistent with EU ones will be a significant advantage.” 

As the UK’s independent data protection regulator, the ICO works alongside the National Cyber Security Centre (NCSC), the NCA’s National Cyber Crime Unit, DCMS, Action Fraud and other agencies, said Denham, commenting that “government and regulatory bodies are working together in a way which, I believe, is unmatched anywhere in the world”.

“We are aligning our playbooks and testing them through the national exercises,” she said. “We are coordinating our communications, guidance and incident responses with them, so that we can respond to large-scale data breaches appropriately.”

Turning to some of the “data protection myths” the ICO has been working to dispel, Denham said keeping individuals safe online should not invoke panic.

“I have spent a lot of the past year busting some data protection myths, and reassuring organisations that our approach as a regulator is not to fetter innovation, while making sure it’s still hard for criminals and chancers to thrive online,” she said.

Despite challenges such as tight budget constraints and fast-moving technology changes, Denham said data protection law need not be onerous if organisations adopt privacy by design and sound cyber security at the outset of projects.

Breach reporting

One of the myths the ICO has worked hardest to dispel, she added, is around data breach reporting under the GDPR.

“Organisations will not need to report every single personal data breach to the ICO,” said Denham. “But you will have to report a personal data breach if it’s likely to result in a risk to people’s rights and freedoms. And you must do that within 72 hours of discovering it.

“You should all by now be developing a sense of what constitutes a serious incident in the context of your data and your own customers. You also need to consider whether a breach triggers notice, not just to the ICO, but to affected individuals as well.”

On the topic of breach reporting, Denham urged organisations to contact the ICO as soon as possible.

“Our focus will be on working with you, and bringing in whoever else we need to involve, to help you make the right decisions in those crucial first few days,” she said. “Tell it all, tell it fast and tell the truth. Work with us and you will find the ICO to be a proactive and reasonable regulator.”

As a proactive regulator, Denham said the ICO recognises that innovation is essential in the digital economy.

“We are establishing a ‘regulatory sandbox’ for you to develop innovative digital products and services, while engaging with us to make sure the right safeguards are in place,” she said, adding that this service is scheduled to launch in 2019.

According to Denham, the digital economy is the fastest-growing area of the UK economy. “But, while new technologies bring new opportunities, it’s the people designing, creating and managing them that count,” she said.

“Low-tech breaches are frustratingly common in our enforcement work. So many of the breaches we investigate are down to human error.  And it’s here that building your internal community can really pay off.”

Denham added that organisations’ chief technology officers and chief information security officers should never be strangers, and boards should approach every decision with an awareness of its impact on the security of the organisation’s technology and information assets.

In conclusion, she said that data protection is about increasing the public’s trust and confidence in the way their data is handled.

“The revelations of recent weeks involving Facebook and Cambridge Analytica and others have been a wake-up call,” said Denham. “People care about what happens to their data. Defending their information from attack is your battle – it must be one you are prepared to fight.”