Child sexual abuse inquiry fined £200,000 for exposing victims

IICSA replied-all to participants, then shared their email addresses with an IT company without their consent

The Independent Inquiry into Child Sexual Abuse (IICSA) has been fined 200,000 for a data leak that identified possible abuse victims.

With a remit to investigate historic allegations of sexual abuse, the IICSA has been penalised after a staff member sent a mass email to 90 participants in its inquiry, by mistakenly entering their email addresses into the 'to' field instead of the 'bcc' field.

The incident occurred on 27 February 2017 - prior to the introduction of the General Data Protection Regulation (GDPR), which came into force on 25 May - meaning UK data watchdog the Information Commissioner's Office (ICO) delivered the penalty under the Data Protection Act 1998. Under GDPR the fine could have been much higher.

"This incident placed vulnerable people at risk, which is concerning. IICSA should and could have done more to ensure this did not happen," said the ICO's director of investigations, Steve Eckersley.

Advertisement
Advertisement - Article continues below

"People's email addresses can be searched via social networks and search engines, so the risk that they could be identified was significant."

Informing the inquiry participants about a public hearing, an IICSA staff member initially sent an email containing an error, with all 90 addresses marked in the 'bcc' field. Attempting to correct the error, the staff member sent a follow-up email, but this time marked all recipients in the 'to' field - meaning their identities were exposed to all.

Of the addresses revealed, 52 contained the full names of the participants or had a full name label attached - many of whom may have been victims of child sexual abuse. The IICSA was alerted to the mistake by a recipient who added two further email addresses into the 'to' field before pressing 'reply all'.

The IICSA attempted to rectify the breach by asking all recipients to delete the initial email and to resist circulating the email any further. According to the ICO, one of these messages generated 39 'reply all' emails.

The investigation concluded that the abuse inquiry failed to use an account capable of sending separate emails to each participant, and it had not adequately trained staff on the importance of double-checking into which field an email address was entered.

The ICO also found that the IICSA should not have relied on advice from an IT company it had hired to manage the mailing list, which claimed that it would prevent individuals from replying to the exposed list. Most concerningly, however, the abuse inquiry breached its own privacy notice by sharing participants' email addresses with the IT company without their consent.

A total of 22 complaints came the ICO's way following the incident, with one complainant remarking that he was "very distressed" by the breach.

"The inquiry takes its data protection obligations very seriously and we have apologised to those affected by the data breach," IICSA secretary John O'Brien said.

"After a wide-ranging review by external experts, we have amended our handling processes for personal data to ensure they are robust and the risk of a further breach is minimised."

The 200,000 fine represents one of the largest fines handed to an organisation for a breach in the UK, with the maximum fine that can be levied under the DPA worth 500,000 - Facebook received this for its recent Cambridge Analytica data-sharing scandal.

Advertisement
Advertisement - Article continues below

If the case had been adjudicated under GDPR, however, the IICSA would have found itself open to a maximum fine of 20 million.

Picture: Shutterstock

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019
Visit/backup/33385/arcserve-udp-9240dr-review-beef-up-your-backups
backup

Arcserve UDP 9240DR review: Beef up your backups

4 Apr 2019

Most Popular

Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/business/business-strategy/354252/huawei-takes-the-us-trade-sanctions-into-its-own-hands
Business strategy

Huawei takes the US trade sanctions into its own hands

3 Dec 2019
Visit/hardware/354237/five-signs-that-its-time-to-retire-it-kit
Sponsored

Five signs that it’s time to retire IT kit

29 Nov 2019
Visit/mobile/mobile-phones/354273/pablo-escobars-brother-launches-budget-foldable-phone
Mobile Phones

Pablo Escobar's brother launches budget foldable phone

4 Dec 2019