Exploring fines for data breaches

Charities fined

The penalties for failing to keep data secure in breach of regulations such as the GDPR can be significant. Marriott International was fined £18.4 million in October 2020 for failing to keep millions of its customers’ personal data secure, for example. And British Airways was fined £20 million for failing to protect the personal and financial details of more than 400,000 of its customers.

These are large companies, but small charities can and have been fined for data breaches. The British and Foreign Bible Society was fined £100,000 in 2018 after the personal data of supporters were obtained by hackers in a data breach. And in 2017, 11 charities including Oxfam, Cancer Research UK, and The Royal British Legion were fined between £6,000 and £18,000 for misusing information about millions of past donors for fundraising purposes in breach of the Data Protection Act.

Hidden costs

Looking at the impact of a fine following a data breach can be a useful exercise for charities. In purely financial terms, there is the monetary cost of the fine, as well as the costs associated with remediation: contacting those affected, hiring cyber security consultants to work out what went wrong and how to prevent it happening again, and so on.

But it’s also important to consider the longer-term costs to a charity following a fine. Although it is hard to be precise, it is not unreasonable to estimate that the cost to a charity due to falls in fundraising receipts could be as much as ten times higher than the fine itself.

Mitigating the risks

So what can charities do to mitigate the risks of being fined for data breaches, and indeed to mitigate the risks of data breaches in the first place? To avoid the risk of being fined, charities need to ensure that they comply with all relevant data protection regulations, which in practice is likely to be the UK GDPR, as well as the EU GDPR if dealing with personal data about people in the EU.

The ICO offers many resources to help charities ensure that they comply with the UK GDPR, as well as a data protection self assessment toolkit. The ICO has also recommended 12 steps that organisations should take to fulfil GDPR requirements, including:

• Make sure key people in your organisation appreciate the importance of GDPR and compliance with it
• Make sure you have procedures in place to detect, report, and investigate a personal data breach
• Designate someone to take responsibility for data protection compliance and consider whether you are required to formally designate a Data Protection Officer

Breach avoidance

When it comes to avoiding data breaches themselves, charities should ensure that they have made a cyber security risk assessment and then take appropriate actions to mitigate the risk of a breach due to a cyber security incident.

Avoiding accidental breaches is more difficult in many ways, but there are a number of steps charities can take. You can ensure all data on laptops or USB sticks is encrypted to keep it secure even if the hardware is lost or stolen, for example, and also ensure the right steps are taken to dispose of unwanted laptops and other IT equipment isecurely.