Advice sought regarding GDPR and managing sensitive data

Question

We have a site that has very sensitive information including medical and information about children. This is on a public website with many organisations shared on one server.

There are files that are available without a login, they are not linked on main site, but they are available that share this information (excel files).

The site is vulnerable to many different attacks, including sql injection (which allows you to download all data). I have a list of about 10+ major security holes.

It is being treated as not a major issue as there has been no reported breach, and we do not know of any. It is kept being said - "has a breach been reported?".

If we keep the site up knowing it has issues and fix them "when we can", and we don't tell customers that their data has been insecurely kept for a very long time, are we breaking laws?

Or is it only really something that should take the site down and be communicated to customers if we know of a breach.

This is in the UK and we need information valid for prior to GDPR I would guess?

Answer 1

1. "We have a site that has very sensitive information including medical and information about children. This is on a public website with many organisations shared on one server."

   Whilst it's perhaps not following industry best practice, I don't think it would necessarily be considered illegal to use shared hosting for such a website provided suitable technical controls are in place and tested such as can provide a high level of confidence other users on the same server cannot access the data in your account. Issues such as this would be considered risks that need to be managed and reviewed regularly, and the technical controls implemented to be adequate and proportionate to the risks. That having been said, the Data Protection Act does say that you should "design and organise your security to fit the nature of the personal data you hold and the harm that may result from a security breach" and I find it hard to belief security has been designed and organised given the circumstances - "very sensitive information including medical and information about children". In the very least for a website like this I would be expecting an SSL/TLS certificate to be installed, dual-factor authentication, sensitive data to be encrypted in storage etc.

2. "There are files that are available without a login, they are not linked on main site, but they are available that share this information (excel files)."

   If these Excel documents you refer to are both unencrypted and contain any personal data then there are clearly insufficient technical measures taken to prevent unauthorised access to them, and this is a breach of the UK Data Protection Act's seventh principle:

   "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."

   The ICO instructs organisation to be clear about who in the organisation is responsible for ensuring information security, making sure they have the right physical and technical security, backed up by robust policies and procedures and reliable, well-trained staff and being ready to respond to any breach of security swiftly and effectively.

3. "The site is vulnerable to many different attacks, including sql injection (which allows you to download all data). I have a list of about 10+ major security holes."

   The likelihood of a breach progressively increases when vulnerabilities are left unpatched/ unfixed. Industry best practice is for known issues to be fixed with 30 days of discovery and/or the release of a suitable security patch from the software vendor if applicable. Knowingly and negligently leaving vulnerabilities unpatched on a production system with sensitive personal data when this could be prevented through exercising good information security practices is another breach of Principle 7. See the ICO's published guidance on Protecting Personal Data in Online Services: Learning from the Nistakes of Others for more information about appropriate security measures.

4. "It is being treated as not a major issue as there has been no reported breach, and we do not know of any. It is kept being said - "has a breach been reported?"."

   Do you have suitable mechanisms in place to detect if the site/data is breached? Are you monitoring access to these Excel files? The legislation is there to protect the data subjects - perhaps reporting to the ICO the breaches of compliance with the Data Protection Act is the only way to ensure necessary actions are taken to protect the data before a data breach occurs.

5. "If we keep the site up knowing it has issues and fix them "when we can", and we don't tell customers that their data has been insecurely kept for a very long time, are we breaking laws?"

   If there is currently no evidence of a data breach then I'm not certain there would be a requirement to notify your customers, however keeping their personal data insecurely is an offence under s21(1) of the Data Protection Act 1998 - as mentioned above. Additionally. under Section 61(1) when directors consent to or are complicit in negligence with regard to data protection compliance they are also personally liable for prosecution.

6. "Or is it only really something that should take the site down and be communicated to customers if we know of a breach."

   If you have exhausted pursuing resolution internally within the organisation due to systemic lack of commitment to information security and data protection, I would strongly urge you report your concerns directly to ICO for them to investigate as in the event of a breach they are perhaps more likely to attempt cover it up than address it properly. ICO have the powers to force them to comply with the law or enforce the law with penalties when appropriate. There may be way to do this anonymously, you would have to look into this.

7. "This is in the UK and we need information valid for prior to GDPR I would guess?"

   The risk to your organisation in terms of enforcement penalty will be significantly greater once GDPR is in force from 25th May 2018. Compliance with GDPR requires substantially more preparation and paperwork and includes privacy risk assessments and a formal record of actions taken to identify, reduce and review these risks. There is tons of information available now to help with GDPR compliance however I would suggest you start be reading the GDPR text itself.