Emails and Data Protection (part 3)

Alasdair McWilliams Data Protection

The Right Tools for the Job

Following a number of significant data breaches, the ICO has updated their guidance to discourage the use of BCC where possible, and instead to promote the use of appropriate email management systems, and processes which guarantee the separation of recipient data, such as using mail-merge features in the Microsoft Office suite.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/email-and-security/

The ICO guidance was updated after breaches involving:

 

If you are using an appropriate bulk email management system, either as a standalone platform, or connected to a CRM platform, you should find it easy to avoid the BCC risks.

If you are a smaller organisation, working with manually updated mailing lists on spreadsheets or other documents, you can find many tutorials online to help you use the mail-merge functions that are available in Microsoft Office or Google Docs:

 

Emails and Data Protection (part 2)

Alasdair McWilliams Data Protection

The Data

Tools like Thunderbird and Outlook are mature software products, with some great built-in tools and features, and it genuinely helps make our day-to-day work run smoothly and efficiently, however that can create some risks if we're not careful.

When you start typing an email address into the "To", "CC", or "BCC" fields in an email, most software very helpfully starts to suggest people or email addresses that you've previously used.

This can be a great shortcut, particularly if you're emailing a lot of people, but it does mean that it's really easy to pick the wrong name, especially if you have a number of people with the same or similar names in your email history.

It's important to double check names and email addresses before hitting "Send" on any email, but even more important if you're using auto-completed or auto-suggested email addresses.

Recent Data

The Information Commissioner's report for 2021/2022 shows that the single largest cause of data protection breaches, is data being emailed to an incorrect recipient:

  • Data emailed to incorrect recipient 16.87%
  • Other non-cyber incident 15.64%
  • Unauthorised access 11.71%
  • Phishing 10.03%
  • Data posted or faxed to incorrect recipient 8.53%
  • Ransomware 7.17%
  • Loss/theft of paperwork or data left in… [public place] 6.79%
  • Failure to redact 4.34%
  • Failure to use bcc 3.09%
  • Verbal disclosure of personal data 3.07%
  • Other cyber incident 3.00%
  • Hardware/software misconfiguration 2.31%

https://ico.org.uk/about-the-ico/our-information/annual-reports/

Annual reports

 

ico.org.uk

View our annual reports.

Emails and Data Protection (Part 1)

Alasdair McWilliams Data Protection