Speaking of charity organizations and breaches, here’s the flip side of an external hack: an insider who doesn’t follow the rules of data protection. From the Information Commissioner’s Office:
People working with personal information have been warned they have to obey strict privacy laws after a charity worker was prosecuted for making his own copies of sensitive data.
Robert Morrisey, 63, sent spreadsheets containing the information of vulnerable clients to his personal email address without the knowledge of the data controller, his employer the Rochdale Connections Trust.
The defendant sent 11 emails from his work email account on 22 February 2017, which contained the sensitive personal data of 183 people, three of whom were children. The personal data included full names, dates of birth, telephone numbers and medical information. Further investigation showed that he had sent a similar database to his personal account on 14 June 2016.
Morrisey, of Milnrow, Rochdale, appeared at Preston Crown Court and admitted unlawfully obtaining personal data in breach of Section 55 of the Data Protection Act 1998. He was given a conditional discharge for two years and was also ordered to pay prosecution costs of £1,845.25, as well as a victim surcharge of £15.
Steve Eckersley, Head of Enforcement at the Information Commissioner’s Office, which brought the prosecution, said:
“People have a right to expect that when they share their personal information with an organisation, it will be handled properly and legally. That is especially so when it is sensitive personal data.
“People whose jobs give them access to this type of information need to realise that just because they can access it, that doesn’t mean they should. They need to have a valid legal reason for doing so. Copying sensitive personal information without the necessary permission isn’t a valid reason.”
Note that I’m not seeing anything that really suggests he had a criminal motivation such as misuse as the data. Was he just prosecuted for violating data protection laws without any evil motivation? It appears that might be the case, unless someone can point me to other information on this case…?