Employee Data Leaked - Rights
Discussion
You should complain to the ICO and they will investigate and possibly fine the organisation.
From a personal point of view if you want Compo you can ask them. If they refuse to pay out you can take them to Court.
https://ico.org.uk/your-data-matters/data-protecti...
From a personal point of view if you want Compo you can ask them. If they refuse to pay out you can take them to Court.
https://ico.org.uk/your-data-matters/data-protecti...
Deliberate action? Should someone be sacked or prosecuted personally?
Not sure how it helps to have your employer fined, not exactly going to boost the remuneration pool is it?
Most useful thing might be help with getting any necessary details changed, in the firm's time at their expense?
Not sure how it helps to have your employer fined, not exactly going to boost the remuneration pool is it?
Most useful thing might be help with getting any necessary details changed, in the firm's time at their expense?
Contact the ICO as has been pointed out.
I assume there is a security department within your company, do you have a CISO? Legally data breaches have to be reported to the ICO within 72 hours of being detected (I think), so I would ensure this is adhered to.
Then it will be a case of audit against current standards and controls that the company has in place, since GDPR came about it could be jail time for CISO's depending upon how severe the breach is, although I have yet to see/hear of one.
I assume there is a security department within your company, do you have a CISO? Legally data breaches have to be reported to the ICO within 72 hours of being detected (I think), so I would ensure this is adhered to.
Then it will be a case of audit against current standards and controls that the company has in place, since GDPR came about it could be jail time for CISO's depending upon how severe the breach is, although I have yet to see/hear of one.
They will need to tell you the exact data
Possibly provide guidance on how to secure/resecure the data or change as appropriate
Consideration of provision for monitoring/protection/insurance for affected parties and over what duration. I would expect the company to pay for this.
ICO notification and potential further guidance/action
Any compensation would relate to harm/loss/damages I would think, so it depends on what data it is and what it could be used for.
Possibly provide guidance on how to secure/resecure the data or change as appropriate
Consideration of provision for monitoring/protection/insurance for affected parties and over what duration. I would expect the company to pay for this.
ICO notification and potential further guidance/action
Any compensation would relate to harm/loss/damages I would think, so it depends on what data it is and what it could be used for.
I remember Morrisons had a 'disgruntled employee' leak every other employee's data a few years back. There was a court case, Morrisons weren't found liable and there was no compo because it would've cost them too much. Maybe things have changed since.
ETA BBC article with some other links .. https://www.bbc.co.uk/news/uk-england-leeds-521249...
Looks like they were liable, then they weren't, then there was a class action that was successful, then it wasn't.
ETA BBC article with some other links .. https://www.bbc.co.uk/news/uk-england-leeds-521249...
Looks like they were liable, then they weren't, then there was a class action that was successful, then it wasn't.
Edited by bigandclever on Friday 6th May 13:03
Gassing Station | Speed, Plod & the Law | Top of Page | What's New | My Stuff