Information Commissioner fines Charity £200,000
The Information Commissioner has fined a charity, the British Pregnancy Advisory Service (BPAS), the astonishing sum of £200,000 for a data breach which is said to have revealed the personal details of almost 10,000 people.
Many will wonder how on earth BPAS could be guilty of what appears, on the face of it, to be a serious breach.
The answer is simple: BPAS was the victim of a crime!
An investigation by the Office of the Information Commissioner found that BPAS had failed to realise its website was storing the name, address, date of birth and telephone numbers of people who had asked to be called back for advice on pregnancy issues.
It is said that “vulnerability in the website’s code” allowed a hacker to access the system and discover the information around two years ago.
When the hacker threatened to publish the details of those people he had discovered by his criminal conduct, BPAS acted responsibly and obtained a court injunction to prevent him from doing so.
Furthermore, the police then recovered the information, the hacker was prosecuted and sentenced to 32 months’ imprisonment.
If your organisation is holding data beware of the reported comments of David Smith, the Deputy Commissioner and Director of Data Protection at the Information Commissioner’s Office: “Data protection is critical and getting it right requires vigilance.”
He added that the British Pregnancy Advice Service didn’t realise their website was storing this information, didn’t realise how long it was being retained for and didn’t realise the website wasn’t being kept sufficiently secure.
Those remarks were followed by this pompous conclusion: “But ignorance is no excuse. It is especially unforgivable when the organisation is handling information as sensitive as that held by BPAS.”
BPAS Chief Executive Ann Furedi points out that BPAS is a charity that spends any proceeds on the care of women who need its help and upon improving public education and knowledge on contraception, fertility and unplanned pregnancy.
She adds, with some force, “This fine seems out of proportion when compared with those levelled against other organisations who were not themselves the victims of a crime.”
One wonders whether the Office of the Data Commissioner is operating in some parallel universe and just what planet Mr David Smith might be living on.
Or are their heads just so far up their own backsides that they cannot sympathise with a charitable organisation which is itself the victim of a serious crime?
Are we as a society now so consumed by political correctness and the need to be seen to be doing something that we have not only to punish the criminal but everyone who the criminal appears to have contaminated with his wrongdoing?
And where is this fine to come from? From monies otherwise to be used for the charitable aims of BPAS, of course. What humbug!
BPAS’s Chief Executive has indicated that her charity will appeal this swingeing fine. The sooner this gross injustice is remedied, the better.