🚨 Data Protection Updates and Alerts – October ’23 🚨

General Data Protection Updates

• The ICO has published guidance to help employers understand data protection obligations under the UK GDPR and Data Protection Act when handling employees’ health information.
  
  
• The ICO has updated their guidance around data storage and security. This includes specific guidance to reduce the risk of issues linked to the use of Bcc in emails:
  
  
  • set rules within the email system to provide alerts and warnings;
  • set a delay to allow errors to be corrected before the email is sent;
  • turn off auto-complete to remove email address suggestions;
  • use the NCSC’s email security check tool (linked above 👆).
    
    
• The ICO has fined a former social services council employee for unlawfully accessing sensitive personal data. This raises questions for all organisations that process sensitive personal data:
  
  
  • What access do staff have to your data?
  • How is that access controlled?
  • How are leavers managed to remove access?
    
    
• DarkBeam, a digital risk protection firm, has leaked billions of email and password combinations in a recent data breach. Advice to keep safe in the event of a breach like this:
  
  
  • Use an online checker to see if your data has been leaked;
  • Change your passwords if it has;
  • Enable 2FA on all accounts that you can;
  • Be on the lookout for spam emails, unsolicited texts, & phishing emails.
    If in doubt, don’t click!
    
    
• The DfE have updated their ‘Working Together to Improve School Attendance‘ guidance. They have added ‘Toolkit for schools: communicating with families to support attendance’ and ‘Annex A: example attendance letters and emails to parents and carers’.
  
  
• The DfE have also updated their ‘Share Your Daily School Attendance Data‘ guidance. They have updated ‘How this data will be used’ section with the latest versions of the ‘privacy notice’, ‘data collection principles’ and ‘data protection impact assessment (DPIA).
  
  
• The DfE have also updated the ‘Apply for Department for Education (DfE) Personal Data‘ guidance. They have updated the DfE data sharing service application form & guidance, & the individualised learner record, national pupil database & school workforce data tables. They have also updated the ‘Apply directly to ONS for other key datasets’ section with information about the further education workforce and pupil parent matched dataset.
  
  
• A Statutory Instrument (SI) will be enacted that will “amend references to ‘fundamental rights and freedoms’ in the UK’s data protection legislation.” The impacts of this are nuanced and the SI currently states that “no significant impact on the private, voluntary or public sector is foreseen.”