UK Information Commissioner’s Office makes orders against Alzheimer’s Society for poor privacy practices

January 21, 2016 |

It is a blessing of the digital age that charities can use information in a far more effective way than was previously the case.  Costs of administration in storing information on line should be less than maintaining bulky documents in cabinets.  Using algorithms instead of guesswork helps fund raising and using email over postage improves the bottom line.  But with those benefits comes the need to protect information.  And charities, such as the Alzheimer Society of the UK, holds very sensitive information.  Unfortunately charities are often far from compliant with privacy regulations.  That is as much the case in Australia as the UK.

The Alzheimer’s Society web site was hacked in 2015.  Sensitive data was exposed.  That brought on an investigation by the Information Commissioner’s Office (the ICO).  As a result it issued an enforcement notice against the Alzheimer’s Society for a range of poor data practices including:

  • keeping personal data for longer than is necessary for the purpose of the processing.  This is a common problem with organisations that have a poor culture in managing data and respecting privacy.
  •  it failed in its data security obligations in not  taking appropriate technical and organisational measures against the unauthorised or unlawful processing of personal data and against accidental loss or
    destruction of, or damage to, personal data.

The ICO media release provides:

The ICO has found serious failings in the way volunteers at a national dementia support charity handled sensitive personal data.

It has ordered The Alzheimer’s Society to take action after discovering that volunteers were using personal email addresses to receive and share information about people who use the charity, storing unencrypted data on their home computers and failing to keep paper records locked away.

Furthermore, volunteers were not trained in data protection, the charity’s policies and procedures were not explained to them and they had little supervision from staff.

Head of Enforcement Stephen Eckersley said:

“In failing to ensure volunteers were properly supported, this charity showed a disappointing attitude towards looking after the very sensitive information that people trusted them with.

“Volunteers form the cornerstone of many charities’ work and we all admire and appreciate their personal commitment and goodwill. They play an important role and must be given the support to handle personal data as safely as paid members of staff. Anything less is unacceptable and, considering the vulnerability of the people who use the Society’s services, we have acted.”

The failings concerned a group of 15 volunteers recruited in 2007 to help dementia sufferers and their families or carers seek NHS healthcare funding. Between them, and over a seven-year period, they handled 1,920 cases. As part of their role they drafted reports including sensitive information about the medical treatment, care needs and mental health of the people they were trying to help.

Although the charity has made improvements since the shortcomings were identified in November 2014, the ICO has issued it with an enforcement notice because it is concerned that more needs to be done.

Mr Eckersley said:

“Our investigation revealed serious deficiencies in the way The Alzheimer’s Society handles personal information. Some of these have been addressed, but the extent and persistence of the charity’s failure to do as we’ve asked means we must now take more formal action.”

As well as issues around the security of personal data, the charity’s website was hacked earlier in 2015, putting at risk around 300,000 email addresses, 66,000 home addresses, phone numbers and some birth dates.

The ICO made a series of recommendations in the wake of the attack and the Society implemented most of them. But the charity did not undertake manual checks of its website, a practice the ICO believed to be crucial in detecting vulnerability. The enforcement notice now requires them to do that.

The ICO has made other recommendations that the charity has failed to implement fully. In 2010 it agreed to a series of security measures after several unencrypted laptops were stolen during an office burglary. And it has been the subject of two audits – in March 2013 and March 2014 – which made recommendations about data security.

If the charity does not comply with the enforcement notice it could face prosecution.

Doing good works is no excuse for bad internal practices.

As is often the case the media coverage has been significant such as ICO orders Alzheimer’s Society to improve data protection, ICO Takes action against Alzheimer’s Society and Information Commissioner takes action against Alzheimer’s Society for ‘disappointing attitude’ to data use.  Charities live or die on their reputations.  This sort of coverage can be very damaging.


One Response to “UK Information Commissioner’s Office makes orders against Alzheimer’s Society for poor privacy practices”

  1. UK Information Commissioner’s Office makes orders against Alzheimer’s Society for poor privacy practices | Australian Law Blogs

    […] UK Information Commissioner’s Office makes orders against Alzheimer’s Society for poor privacy p… […]

Leave a Reply

Verified by MonsterInsights