Data Protection Laws

Question

Some Co-workers of mine have been sending customer's personal information, that includes banking details through unsecured plaintext emails. This feels to me like it is definitely breaking laws/regulations but I am not sure what ones. This is going on in the US and in the UK

Is this an illegal practice?

EDIT: By unsecured email I just mean a normal email sent between employees over outlook, this is also used to send emails externally and there is no blocker for sending attachments to external emails if someone was to mistype an email address there is nothing to stop this being sent out.

By Plaintext I mean what is sent and received is readable, no hashing, etc. I don't know if this is encrypted decrypted on the send but as the email can be sent externally and internally I doubt it

Answer 1

Article 32 of the GDPR requires companies to adequately secure their data when handling data belonging to EU citizens. This also applies to cross border scenarios where data is transferred between countries.

Technically speaking, the GDPR doesn't set a standard for security: you don't have to encrypt your data, use AES or RSA encryption, or hash and salt passwords. It is your choice on how to secure your data, though the GDPR does mandate specific ways to secure data.

However, not doing so opens yourself up to two consequences:

1. The European data protection supervisor is tasked with the enforcement of regulations. A company can be forced to increase their level security if a valid complaint alleging that inadequate security measures are in place is made

2. There is a significant amount of security risk, and if a data breach occurs, the GDPR allows authorities to levy heavy fines. Especially heavy fines may occur if it is found that the data was not securely stored.

So the answer is: A complaint to relevant authorities can force the company to take action, or they will lose access to the European market.

Answer 2

The GDPR requires the Data Controller (i.e. your company) to put in place appropriate measures for accountability. These will include appointing a Data Protection Officer (DPO) and implementing polices around the processing of personal data.

So you should be able to go to your DPO and ask to see the policies which describe the safeguards for emailing such data. These should in turn trace to the the GDPR Principles and identify a Lawful Basis for every type of processing done with the personal data. This should also cover international transfers and requests for deletion. Deletion is likely to be particularly problematic: how do you delete someone from a spreadsheet attached to an email sent last year?

If you don't know where to find your policies or who your DPO is then either you don't have one or they aren't doing their job. Either way your company is not complying with the GDPR.

The GDPR applies to records kept in a filing system or database, so an email which contains the bank details of a single individual is not necessarily covered by the GDPR (e.g. "Joe, can you add this guy to the customer DB..."). However if these emails contain spreadsheet attachments with tables of multiple customers then that would be covered.

Also it matters whether the customers are individuals or other companies. A company does not have the right to privacy that an individual has, so if all your customers are companies then you are probably in the clear, at least as far as the GDPR is concerned.

Having said all that, from a purely practical view the situation you describe sounds dangerously chaotic. Its only a matter of time until something goes badly wrong, and this could put your company on the wrong side of serious damages, regardless of whether you are in violation of the GDPR or not.

Answer 3

From my understanding, while not illegal, it is a very , not to be rude but, unintelligent practice. I can't speak on GDPR or foreign laws as an American. I've seen protected information sent via email, for example an email sent to my mother in which I was asked to look at, contained sensitive data and include an NDA covering the contents of the aforementioned email. That doesn't mean it is an intelligent action. Not to speak in an insulting tone, but I mean objectively. I noticed you stated the network is "internally".

If the email server is configured properly on the server, the practice should be as secure as storing the files on the company's computers and servers. If the data is as confidential as you say, chances are the email server is encrypted and possibly only transits mail to internal relays defined by either certificate validity or whitelists. This would be the same if everyone at the company used something like FTP to connect to remote storage instead.

If you mean cleartext as in the emails content look like this post I'm writing, that could be misleading. Cleartext is referring to the underlying data. I may be confusing something, but I don't know your technical knowledge, so I figured I'd make this point. Just because the text appears normal client-side, most email servers that are properly configured use encryption for transferring data via relays, securing the data from client to server, just like HTTPs.

Your question is a little confusing, since you say "to customers" and "internally". Internally means it says all within the private company network. However, saying it is sent to customers makes me think it is send externally, to addresses like "[email protected]". If you do mean that the data is sent externally, then while I don't believe it is illegal, it is quite irresponsible and (not to be rude) stupid. Companies like Google are well known for the fact that they read every bit of data send and received by their users, including these emails containing sensitive data.

Your question in terms of technical specificity makes it hard to answer. If you are concerned about the security of information in transit, it would be smart to bring it up with the technical department. How the underlying systems are configured for a purely internal network is important. If the emails are send externally, then I strongly am against sending sensitive data via email. Instead, store the data on a secured server, and send a link to the user, so that they may click it, on the server be authenticated and have their identity validated, then present them with the information.

Please reply to me if I misunderstood your question or such, and I'll try and append to my response.

Answer 4

It might be illegal. It's almost certainly a tort of negligence. Furthermore, assuming that the sent emails are saved on the company server, the company is now storing data insecurely probably in violation of U.S. law.

Data Protection Laws (see link below) : "(1.1) There is no single principal data protection legislation in the United States. Rather, a jumble of hundreds of laws enacted on both the federal and state levels serve to protect the personal data of U.S. residents. ... (16.2) Whether the sanctions are civil and/or criminal depends on the relevant statute."

https://iclg.com/practice-areas/data-protection-laws-and-regulations/usa

Data Breach Laws (see link below) : It might not seem like a data breach to you, so you wouldn't report it. But it might in fact be data breach. In which case you might have criminal liability. Without knowing any details, it's impossible for me to begin to guess what liability you might have.

For example, Arkansas: "Penalties: Civil or criminal penalties may result from violations."

https://info.digitalguardian.com/rs/768-OQW-145/images/the-definitive-guide-to-us-state-data-breach-laws.pdf

Keep in mind, the structure and operation of the Internet is such that you could send an email from your iPhone the iPhone of someone standing next to you and the email might be routed to Europe, then Africa, back to Europe, back to US, to Canada, to China, and finally to the recipient, with numerous computers receiving and retransmitting it along the way. At each computer, it is saved, at least temporarily, until it is retransmitted. But there's no way for you to know its path or if it was deleted everywhere or is sitting on one more computer(s) somewhere.