0

Some Co-workers of mine have been sending customer's personal information, that includes banking details through unsecured plaintext emails. This feels to me like it is definitely breaking laws/regulations but I am not sure what ones. This is going on in the US and in the UK

Is this an illegal practice?

EDIT: By unsecured email I just mean a normal email sent between employees over outlook, this is also used to send emails externally and there is no blocker for sending attachments to external emails if someone was to mistype an email address there is nothing to stop this being sent out.

By Plaintext I mean what is sent and received is readable, no hashing, etc. I don't know if this is encrypted decrypted on the send but as the email can be sent externally and internally I doubt it

5
  • There isn't really enough information here to understand the scenario. From a GDPR perspective, the Data Controller has an obligation to protect personal data. Sending around data without reasonable controls sounds problematic, but email is not necessarily insecure – the problems are more about traceability, and that the data can easily be accidentally shared with unauthorized persons.
    – amon
    Aug 19, 2019 at 15:14
  • @amon What additional information would help?
    – Jon.G
    Aug 19, 2019 at 15:45
  • @Jon.G can you clarify what exactly you mean with "unsecured email"? Is mail sent inside a company, or also to other companies? Is a proper password policy in place? Depending on how sensitive data is, more or less security is required. But a properly configured email server and network is not inherently insecure.
    – wimh
    Aug 22, 2019 at 20:50
  • When you say "internally" and "in the US and UK", do you mean that these emails are going internationally between parts of the same company, or do you mean that there are UK-only emails with private data and separately US-only emails with private data? I ask because the GDPR has rules about international transfers, and an email with banking details sent from the UK to the US would definitely be subject to them. Aug 26, 2019 at 14:05
  • @PaulJohnson The emails are going internationally
    – Jon.G
    Aug 27, 2019 at 9:13

4 Answers 4

3
+50

Article 32 of the GDPR requires companies to adequately secure their data when handling data belonging to EU citizens. This also applies to cross border scenarios where data is transferred between countries.

Technically speaking, the GDPR doesn't set a standard for security: you don't have to encrypt your data, use AES or RSA encryption, or hash and salt passwords. It is your choice on how to secure your data, though the GDPR does mandate specific ways to secure data.

However, not doing so opens yourself up to two consequences:

  1. The European data protection supervisor is tasked with the enforcement of regulations. A company can be forced to increase their level security if a valid complaint alleging that inadequate security measures are in place is made

  2. There is a significant amount of security risk, and if a data breach occurs, the GDPR allows authorities to levy heavy fines. Especially heavy fines may occur if it is found that the data was not securely stored.

So the answer is: A complaint to relevant authorities can force the company to take action, or they will lose access to the European market.

1
  • "and when a data breach occurs" does not seem unrealistic either :)
    – dbalakirev
    Aug 23, 2019 at 6:54
1

The GDPR requires the Data Controller (i.e. your company) to put in place appropriate measures for accountability. These will include appointing a Data Protection Officer (DPO) and implementing polices around the processing of personal data.

So you should be able to go to your DPO and ask to see the policies which describe the safeguards for emailing such data. These should in turn trace to the the GDPR Principles and identify a Lawful Basis for every type of processing done with the personal data. This should also cover international transfers and requests for deletion. Deletion is likely to be particularly problematic: how do you delete someone from a spreadsheet attached to an email sent last year?

If you don't know where to find your policies or who your DPO is then either you don't have one or they aren't doing their job. Either way your company is not complying with the GDPR.

The GDPR applies to records kept in a filing system or database, so an email which contains the bank details of a single individual is not necessarily covered by the GDPR (e.g. "Joe, can you add this guy to the customer DB..."). However if these emails contain spreadsheet attachments with tables of multiple customers then that would be covered.

Also it matters whether the customers are individuals or other companies. A company does not have the right to privacy that an individual has, so if all your customers are companies then you are probably in the clear, at least as far as the GDPR is concerned.

Having said all that, from a purely practical view the situation you describe sounds dangerously chaotic. Its only a matter of time until something goes badly wrong, and this could put your company on the wrong side of serious damages, regardless of whether you are in violation of the GDPR or not.

0

From my understanding, while not illegal, it is a very , not to be rude but, unintelligent practice. I can't speak on GDPR or foreign laws as an American. I've seen protected information sent via email, for example an email sent to my mother in which I was asked to look at, contained sensitive data and include an NDA covering the contents of the aforementioned email. That doesn't mean it is an intelligent action. Not to speak in an insulting tone, but I mean objectively. I noticed you stated the network is "internally".

If the email server is configured properly on the server, the practice should be as secure as storing the files on the company's computers and servers. If the data is as confidential as you say, chances are the email server is encrypted and possibly only transits mail to internal relays defined by either certificate validity or whitelists. This would be the same if everyone at the company used something like FTP to connect to remote storage instead.

If you mean cleartext as in the emails content look like this post I'm writing, that could be misleading. Cleartext is referring to the underlying data. I may be confusing something, but I don't know your technical knowledge, so I figured I'd make this point. Just because the text appears normal client-side, most email servers that are properly configured use encryption for transferring data via relays, securing the data from client to server, just like HTTPs.

Your question is a little confusing, since you say "to customers" and "internally". Internally means it says all within the private company network. However, saying it is sent to customers makes me think it is send externally, to addresses like "[email protected]". If you do mean that the data is sent externally, then while I don't believe it is illegal, it is quite irresponsible and (not to be rude) stupid. Companies like Google are well known for the fact that they read every bit of data send and received by their users, including these emails containing sensitive data.

Your question in terms of technical specificity makes it hard to answer. If you are concerned about the security of information in transit, it would be smart to bring it up with the technical department. How the underlying systems are configured for a purely internal network is important. If the emails are send externally, then I strongly am against sending sensitive data via email. Instead, store the data on a secured server, and send a link to the user, so that they may click it, on the server be authenticated and have their identity validated, then present them with the information.

Please reply to me if I misunderstood your question or such, and I'll try and append to my response.

2
  • I'd bet money the email server doesn't encrypt mail messages. Because. The only way to do it would be to prevent anyone but the owner to decode it. That means management couldn't know what's on the company's mail servers. No way in hell I'd do that with my company's mail servers. They're company property. Company's want to have access for any number of reasons. Even if its something benign like they need information from your account when you're on vacation or sick. Aug 25, 2019 at 19:23
  • @wm-wolff-law-exam-guides By encryption I was talking in E2EE (End-To-End Encryption). Meaning from the sender to the mail server, not encrypting the data on the end-point - meaning the email server. Aug 26, 2019 at 1:36
-2

It might be illegal. It's almost certainly a tort of negligence. Furthermore, assuming that the sent emails are saved on the company server, the company is now storing data insecurely probably in violation of U.S. law.

Data Protection Laws (see link below) : "(1.1) There is no single principal data protection legislation in the United States. Rather, a jumble of hundreds of laws enacted on both the federal and state levels serve to protect the personal data of U.S. residents. ... (16.2) Whether the sanctions are civil and/or criminal depends on the relevant statute."

https://iclg.com/practice-areas/data-protection-laws-and-regulations/usa

Data Breach Laws (see link below) : It might not seem like a data breach to you, so you wouldn't report it. But it might in fact be data breach. In which case you might have criminal liability. Without knowing any details, it's impossible for me to begin to guess what liability you might have.

For example, Arkansas: "Penalties: Civil or criminal penalties may result from violations."

https://info.digitalguardian.com/rs/768-OQW-145/images/the-definitive-guide-to-us-state-data-breach-laws.pdf

Keep in mind, the structure and operation of the Internet is such that you could send an email from your iPhone the iPhone of someone standing next to you and the email might be routed to Europe, then Africa, back to Europe, back to US, to Canada, to China, and finally to the recipient, with numerous computers receiving and retransmitting it along the way. At each computer, it is saved, at least temporarily, until it is retransmitted. But there's no way for you to know its path or if it was deleted everywhere or is sitting on one more computer(s) somewhere.

2
  • Which law would be violated? Please clarify.
    – Trish
    Aug 25, 2019 at 16:47
  • I added links and descriptions to the U.S. data protection and data breach laws. For UK, it seems that Shazamo Morebucks has posted an answer. There may be additional issues arising from international law, either treaty between US and UK, or WTO, or something else. Aug 25, 2019 at 23:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .