News

This week the IAPP published a set of AI privacy risks in the wake of concerns over how AI should be regulated.  There are moves to regulate AI, such as the EU AI Act, however  because AI remains quite an unknown quantity, there is a lot of unease and uncertainty around it's use, ethics, privacy and intellectual property.

If you think someone is trying to trick you into handing over money, personal details or a change of salary information........ there is a way to report this with Stop Scams UK.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting. 

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

The ICO has recently published a new set of resources for schools.  They are for teachers to use when discussing privacy issues and the value of personal data.  The kit includes lesson plans which explain what counts as personal data and why it is valuable and how to keep it safe.  The resources are free to download and use.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

REPRIMAND

The reprimand
The Commissioner has decided to issue a reprimand to North Pole Enterprises in respect of the following alleged infringements of the UK GDPR:

• Article 5(1)(f) which states:

• Article 32(1) which states:

The reasons for the Commissioner’s findings are set out below. 

Article 5(1)(f) and Article 32(1)(b)
Technical and Organisational Measures

• You have been collecting and storing vast amounts of personal information without proper consent from the data subjects. This includes but is not limited to, names, addresses, wish lists, and even behavioral assessments of children across the globe. While we acknowledge the festive nature of your endeavors, it is crucial to remember that the General Data Protection Regulation (GDPR) applies universally, even in the magical realm of the North Pole.

• The use of "naughty" and "nice" lists to categorize children based on their behavior raises serious concerns about profiling and discrimination. We would like to remind you that individuals have the right to fair and transparent processing of their personal data, and labeling a child as "naughty" without providing clear criteria for such judgment falls short of these principles.

• Your mode of data transfer, namely the use of reindeer-drawn sleighs and chimneys, lacks the necessary encryption measures, posing a significant risk to the confidentiality and integrity of the information you handle. We highly recommend a thorough review of your information security protocols to ensure compliance with contemporary standards.

Aggravating factors

Moreover, your recent practice of leaving such information unattended in sacks labelled "Happy Christmas" whilst eating mince pies and drinking sherry is alarming. Not only does this constitute improper disposal of sensitive information, but it also raises questions about the security of your data handling processes as it blatantly encourages the investigation of the contents of the sack. We recommend implementing secure and GDPR-compliant disposal methods, such as shredding or incineration, to safeguard the confidentiality of the information you collect. Or at a minimum, use bags labelled "Confidential Waste" and keep them in a securely locked cabinet.

Decision to issue a reprimand

Taking into account all the circumstances of this case, including the aggravating factors and remedial steps, the Commissioner has decided to issue a reprimand to North Pole Enterprises in relation to the alleged infringements of Article 5(1)(f) and Article 32(1) of the UK GDPR set out above.

Please provide a written response outlining the steps you intend to take to rectify these concerns by no later than January 15, 2024. Failure to do so will leave us with no choice but to escalate this matter and consider further enforcement actions.

We wish you a Merry Christmas and a GDPR-compliant New Year.

Yours sincerely,

D. P. Adi-Humbug
Chief Information Commissioner
Information Commissioner's Office North Pole Division

The City of London Police is warning schools across the UK to be vigilant against phishing attacks targeting school networks. Multiple schools have reported receiving suspicious emails containing malicious attachments that have infected their networks with malware.

Once infected, the school's email systems are used to send malicious attachments to other schools.




Help and Advice against Phishing:

Types of Cyber Attacks: Phishing

Read more …

NCSC Guidance Phishing Attacks: defending your organisation

The ICO has recently published a reprimand for a multi academy trust.  The reprimand was issued in respect of Articles 5 (1) (f) and 32 (1) (b).  An unauthorised third party utilised compromised credentials to access and encrypt their systems.

We have released a new document: Guidance for the use of school email and applying email retention in schools.

The US Cybersecurity and Infrastructure Security Agency (CISA) and the UK National Cyber Security Centre (NCSC) have announced the release of the Guidelines for Secure AI System Development.

The ICO has recently published some guidelines/tips for early years settings.  They have created five practical data protection top tips for nurseries, pre-schools, child minders and other early years settings.

The IAPP recently wrote an article about how organisations and lawmakers are striving to protect the online safety of children and teens in today's advance digital environment.  They find themselves working to solve a 'puzzle' that tries to balance varying legal jurisdictions and cultural considerations.

The Trust Initial Plan Checklist has been updated to include a notes area for each section. This will allow you to record any ongoing tasks or actions for each section.

We have previously reported how the Rhysida Ransomware has focused on attacking the education sector.  Recently the CISA, FBI and MS-ISAC have released a new joint Cyber Security Advisory to disseminate known Rhysida ransomware indicators of compromise, detection methods, tactics, techniques and procedures identified through recent investigations.

An updated version of the Data Retention Workshop Powerpoint slides has been uploaded to the Records Management Best Practice Area:

As a data protection officer we are seeing a rise in the number of cyber attacks on organisations.  We often find that the fact an actual crime has been committed is sometimes overlooked in the panic and need to recover data and get operations back up and running.  According to the National Crime Agency (NCA) cyber crime continues to rise in scale and complexity, affecting essential services, businesses and private individuals.  Cyber crime costs the UK billions of pounds, causes untold damage and threatens national security.

We are often asked to help and advise when it comes to redaction as part of a subject access request.