ICO (UK) - Crown Prosecution Service
From GDPRhub
| ICO - Crown Prosecution Service | |
|---|---|
 | |
| Authority: | ICO (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | S.40 Data Protection Act 2018 |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | 18.01.2024 |
| Fine: | n/a |
| Parties: | Crown Prosecution Service |
| National Case Number/Name: | Crown Prosecution Service |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | ICO (in EN) |
| Initial Contributor: | n/a |
The CPS had insufficient technical and organsational measures to ensure the security of personal data stored on personal USB devices.
English Summary
Facts
The contravention was identified following an investigation into the disclosure of an unencrypted USB device, containing personal data, to an unauthorised third party.
Holding
A contravention of the sixth data protection principle in section 40 DPA 2018 (security of processing).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
DATA PROTECTION ACT 2018
(PART 6, SECTION 149)
ENFORCEMENT POWERS OF THE INFORMATION COMMISSIONER
ENFORCEMENT NOTICE
To: The Crown Prosecution Service
Of: 102 Petty France, London, SW1H 9EA
1. The Crown Prosecution Service ("CPS") is a “controller” as
variously defined in sections 3(6) and 32 of the Data Protection Act
2018 (“DPA 2018”). The CPS prosecutes criminal cases that have
been investigated by the police and other investigative
organisations in England and Wales.
2. The Information Commissioner (“the Commissioner”) hereby
issues CPS with an Enforcement Notice under section 149 DPA
2018. The Notice is in relation to a contravention of the sixth data
protection principle set out in section 40 DPA 2018. This Notice
would accordingly be issued under section 149(2)(a) DPA 2018.
3. This Notice explains the Commissioner’s decision to take
enforcement action. The specific steps that CPS is required to take
are set out in Annex 1.
4. The Commissioner has previously served CPS with a Preliminary
Enforcement Notice ("the PEN") dated 4 July 2023. CPS provided
its written representations ("the Representations") in response to
the PEN on 26 th July 2023. The Commissioner has taken into
account the entirety of the Representations when deciding to issue
1 this Notice and refers to the Representations below when
appropriate.
Legal framework for this Notice
5. DPA 2018 contains various enforcement powers in Part 6, which
are exercisable by the Commissioner.
6. Section 149 DPA 2018 materially provides:
“(1) Where the Commissioner is satisfied that a person has failed,
or is failing, as described in subsection (2), (3), (4) or (5), the
Commissioner may give the person a written notice (an
“enforcement notice”) which requires the person—
(a) to take steps specified in the notice, or
(b) to refrain from taking steps specified in the notice,
or both (and see also sections 150 and 151).
(2) The first type of failure is where a controller or processor has
failed, or is failing, to comply with any of the following—
(a) a provision of … Chapter 2 of Part 3 … of this Act
(principles of processing);
…
(6) An enforcement notice given in reliance on subsection (2), (3)
or (5) may only impose requirements which the Commissioner
considers appropriate for the purpose of remedying the failure.”
7. Section 150 DPA 2018 materially provides:
2 “(1) An enforcement notice must—
(a) state what the person has failed or is failing to do, and
(b) give the Commissioner’s reasons for reaching that
opinion.
(2) In deciding whether to give an enforcement notice in reliance
on section 149(2), the Commissioner must consider whether the
failure has caused or is likely to cause any person damage or
distress.
…
(4) An enforcement notice may specify the time or times at which,
or period or periods within which, a requirement imposed by the
notice must be complied with (but see the restrictions in
subsections (6) to (8)).”
8. By reason of section 34(3) DPA 2018, the controller shall be
responsible for, and to be able to demonstrate compliance with the
sixth data protection principle in section 40 DPA 2018.
Background
th
9. On 18 March 2018 a CPS (" ") copied
a CPS case file case concerning historic child abuse from a CPS
computer system onto an unencrypted personal USB device. The
di this with the intention of passing the device to a colleague
who would be dealing with the case. Therefore, the used the
USB device for CPS business and for the discharge of his
employment duties. As such, at all material times the w as
acting on behalf of CPS.
310. The Representations challenged the Commissioner's finding that
the used the USB device for CPS business and for the
discharge of his employment duties, due to the purportedly
contravening the CPS Electronic Media Policy that was in force at
the relevant time and because the purportedly acted on his
own volition and not in discharge of his employment duties,
because there was no requirement for him to provide the case file
to his colleague who had similar access rights to the CPS computer
system and who would therefore have been able to access it via
their own account/device.
11. There is nothing in the Representations that cause the
Commissioner to alter his findings in paragraph 9 and not to
proceed with this Notice. When initially downloading the material
to the portable media device in performing his actions, the
accessed the information as part of his role and his actions were
not of a nature that break the usual responsibility that a controller
has for its employees – the individual was initially seeking to
provide information to a colleague for a legitimate business
purpose. The Commissioner has considered the CPS Investigation
Report written by which supports the
Commissioner's findings in this regard. For example, The
Investigation Report expressed the finding at paragraph 5.2 that "I
do not believe that [the 's] intentions went beyond a desire to
share material with another i a manner convenient to
himself to help in the presentation and preparation of the
case." Furthermore, there is no evidence that the was aware
of the CPS’ Electronic Media Policy or trained on it.
12. The Commissioner is not satisfied that there were appropriate
technical or organisational measures in place to prevent the
from downloading sensitive data to a portable media device, or that
4 there was sufficient awareness of controller’s expectations of the
in this regard. As the had been erroneously included in
an Active Directory Group, encryption software had not been
downloaded to the individual’s device, meaning that data was able
to be downloaded to a self-procured USB without protections such
as a means of preventing the USB’s ability to access / download
material, or by the presence of encryption software.
13. For the avoidance of doubt, the USB device that the copied
the case file to was not provided for their use by CPS. Instead, the
USB device was provisioned by the themself and belonged to
them. For the purpose of this Enforcement Notice, the provisioning
of the USB device by the is referred to as "self-procurement".
14. For the further avoidance of doubt, despite having a policy in place,
it was clear in response to the Commissioner’s enquires that the
self-procurement of USB devices by CPS staff for use on CPS
business was a practice that CPS was aware of but was not
rigorously controlled through appropriate technical measures which
would have reduced the prospect of a breach of this nature.
15. The Representations challenged the finding referring to the
Electronic Media Policy, but there is nothing within the
Representations that cause the Commissioner to alter his findings
and to proceed with this Notice. The Commissioner refers to the
audit that is identified at paragraph 34(IV) below and the
information provided by the CPS in response to the Commissioner's
investigation.
16. The documents that were copied to the USB device included
medical and social care records of the complainant in the case;
police records including the incident log and investigation reports;
5 the record of interview of the defendant; witness names and
addresses; instructions to the and related
case information; and other sensitive documents. These
documents contained personal data, including personal data of the
highest sensitivity, the processing of which is regulated by Part 3
DPA 2018. The personal data related to approximately ten persons.
17. None of the documents containing the personal data were
encrypted when stored on the USB device.
18. The documents were held by CPS for the purposes of the
prosecution of a criminal offence or offences, the trial of which took
place after the coming into force of DPA 2018 on 25 May 2018 ("the
commencement date" for the Act). The processing of at least some
of these documents constituted "sensitive processing" within the
meaning of section 35 DPA 2018.
19. For the purposes of Part 3 DPA 2018, CPS is a "competent
authority" within the meaning of section 30. Part 3 applied to the
processing of the personal data within the documents from the
commencement date. Prior to the commencement date, the
processing was regulated by the Data Protection Act 1998 ("DPA
1998").
20. The did not hand-over possession of the USB device to their
colleague, but instead retained possession of it with the CPS
documents stored thereon, until a precise date that is unknown to
the Commissioner, but is believed on the balance of probabilities
to have been in August 2018, when th e gave possession of
the USB device to their , o that the could
load onto it a video.
621. The trial of the case to which the documents and personal data
related commenced on and concluded later that
month with the conviction of the defendant.
22. On 27 November 2018 the s made contact with
the about the USB device, having viewed some of the
documents.
23. The returned the USB device to the on 28
November 2018. The informed their manager at CPS of the
incident on 29 November 2018 and handed-in the USB device.
Thereafter, CPS commenced an investigation and reported the
incident as a personal data breach to the Commissioner on 4
December 2018. CPS also communicated the fact of the breach to
the impacted persons.
24. Following the reporting of the breach, the Commissioner
commenced an investigation. The investigation found that:
I. The was wrongly included in an Active Directory group of
approximately 1,500 persons, which gave him the ability to
download a large volume of sensitive personal data to his
personal, unencrypted USB device, without appropriate
controls being in place.
II. Some members of the Active Directory group were able to use
USB devices without the forced installation and use of CPS
encryption software.
III. The CPS did not provide USB devices for its staff to use, but
instead allowed a system of self-procurement of these devices
by staff.
IV. The use of self-procured USB devices was not subject to
supervision by CPS or asset management.
7 V. CPS considered that it would be a "considerable exercise" to
ascertain how many members of the Active Directory group
were included in error, so it could not provide the
Commissioner with this information, nor could it confirm how
long people had been members of the group for.
VI. CPS considered that the management of portable media was
"complex", which resulted in a far greater disparity than CPS
would have expected between the number of users that had
write access to data and the numbers that had licences to use
encryption software. Of the approximately 1,500 members of
the Active Directory group, only 800 had access to CPS
encryption software. Therefore, it seems likely that not every
member of the Active Directory group who had the capability
to copy or download data to USB drives were able to encrypt
such data.
25. The Representations challenged the accuracy of the information
now contained in 24.I. above. The Commissioner accepts that due to
the approach adopted for the use of gender pronouns in the PEN, there
was a potential for it to convey a different meaning to the one
intended and the Commissioner's understanding of the evidence.
Paragraph 24.I conveys the Commissioner's understanding and there
is nothing in the Representations that causes him to alter his findings
and not proceed with this Notice.
26. The Representations also challenged the Commissioner's findings
now contained in paragraph 24.III, adopting the challenge made to
paragraph 14. As such, there is nothing in the Representations to
cause the Commissioner to alter his findings and not proceed with this
Notice.
827. The Representations also challenged the Commissioner's findings
in paragraph 24.IV, adopting the challenge made to paragraph 14.
The Representations also claimed that the CPS understood the
importance of maintaining a comprehensive records of all approved
use of USBs. However, during the course of the investigation, the
CPS was asked about whether it maintained an asset register for USB
devices. In response, the CPS stated that "USBs are not held on the
register" and that "Asset Registers do not include USB devices". The
CPS also stated, in response to a question about self-procured USBs,
that "due to this limited usage and only being available should other
methods not be suitable, it is not appropriate per se to include them
on an asset register, as they are immediately, after use, sent outside
the organisation". As such, there is nothing in the Representations to
cause the Commissioner to alter his findings and not to proceed with
this.
The contravention
28. The Commissioner has concluded that the retention of the
documents on the USB device by the between 25 May 2018
and August 2018, followed by the passing of possession of the USB
device with the documents stored thereon to the 's
followed by the viewing of some of the contents on the
device by the constituted a personal data breach within
the meaning of section 33 DPA 2018.
29. Furthermore, the Commissioner is of the view that the sixth data
protection principle in section 40 DPA 2018 was contravened, due
to a failure of CPS to implement appropriate technical and
organisational measures for the security of personal data.
30. Section 40 materially provides:
9 "The sixth data protection principle is that personal data
processed for any of the law enforcement purposes must be so
processed in a manner that ensures appropriate security of the
personal data, using appropriate technical or organisational
measures (and, in this principle, “appropriate security” includes
protection against unauthorised or unlawful processing and
against accidental loss, destruction or damage)."
31. Moreover, the Commissioner notes the requirements of section
66(1) DPA 2018, which materially provides:
"(1) Each controller and each processor must implement
appropriate technical and organisational measures to ensure a
level of security appropriate to the risks arising from the processing
of personal data."
32. The Commissioner is of the view that section 40 was contravened,
for the following reasons:
I. CPS did not implement appropriate technical and
organisational measures for the management of the Active
Directory group, in that the was included in the Active
Directory group in error, with the result that they had
permission to access and write personal data that they were
not entitled to. Furthermore, CPS was unable to provide an
account of the extent of this problem, with the result that the
Commissioner considers it likely that other persons were
wrongly given access and write permissions to which they
were not entitled, or did not need.
II. CPS did not implement appropriate technical and
organisational measures for the provisioning and use of
10 portable media storage devices, in that due to it being aware
of the use of self-procured USBs and due to its failure to
implement appropriate countermeasures to manage the risks
involved in their use it allowed the to self-procure and use
USB devices for the storage and transportation of highly
sensitive personal data in a manner that was free of any form
of formal asset control by CPS, including registration of assets
and recording of their use. To all intents and purposes, the
processing of the data on the 's USB device was wholly
ungoverned and free of supervision by CPS and had it not been
for the responsible conduct of the CPS would
have remained unaware of the fact that a personal data breach
had occurred. In light of the foregoing, CPS did not implement
appropriate technical and organisational measures to prevent,
detect or respond to a personal data breach.
III. CPS did not implement appropriate technical and
organisational measures for the encryption of highly sensitive
personal data that were stored on the USB device.
33. The Commissioner is also of the view that CPS' position that it
would be a "considerable exercise" to ascertain how many
members of the Active Directory group were included in error and
its position that the management of portable media was "complex",
which resulted in a far greater disparity between the number of
users that had write access to data and the numbers that had
licences to use encryption software than CPS would have expected,
is further evidence of a failure to implement appropriate technical
and organisational measures for the security of personal data.
Issue of the Notice
1134. The Commissioner considers that the contravention of DPA 2018 is
a significant one that warrants enforcement action. His reasons for
this conclusion include the following.
I. The personal data that were put at risk were of the highest
sensitivity.
II. Due to the absence of appropriate technical and organisational
measures, the personal data breach would have gone
undetected but for the actions of a member of the public.
III. The measures that should have been adopted for asset control
and encryption are basic controls for the use of portable
storage media.
IV. CPS has rejected both the Commissioner's 2019 Audit
recommendation that it should procure portable media such
as USB drives for use by its staff, instead of allowing self-
procurement by staff, and the recommendation that records
should be kept of their distribution, ownership and use.
V. Without enforcement action, the risks to personal data arising
from the self-procurement of USB devices by CPS personnel,
which are illuminated by the personal data breach, will be
unremedied.
VI. The contravention was longstanding and pre-dated the
commencement date of DPA 2018.
VII. Since this incident, the CPS has reported further incidents to
the ICO involving the loss of portable storage devices. The ICO
therefore consider there to be an on-going issue with the use
of such devices which needs to be addressed.
35. The Representations challenged the information that is now
contained in paragraph 34.III, by repeating the Representations
made in challenge to paragraph 24.IV. As such, they do not cause
12 the Commissioner to alter his findings and not proceed with this
Notice.
36. The Representations challenged the information that is now
contained in paragraph 34.IV, by stating the rationale for the
rejection of the Audit recommendations. The Commissioner relies
on that rationale in support of his findings and so the
Representations do not cause him to alter them and not proceed
with this Notice.
37. The Representations challenged the information in the PEN that is
contained in paragraph 34.V, by repeating the Representations
made in challenge to paragraph 14. As such, they do not cause
the Commissioner to alter his findings and not proceed with this
Notice.
38. The Commissioner therefore requires CPS to take the steps set out
in Annex 1.
39. The Commissioner considered, as he is required to do under section
150(2) DPA 2018 when deciding whether to serve an Enforcement
Notice, whether any contravention has caused or is likely to cause
any person damage or distress. The Commissioner considers that
there was clear potential for distress to have been suffered by the
impacted data subjects, due to the overall context of the case and
the nature of the data involved.
40. Moreover, CPS has also recognised that the personal data breach
may have caused significant emotional distress to those data
subjects.
1341. However, the Commissioner considers that compliance with the
provisions of DPA 2018 referred to above to be a matter of central
importance to data protection law. Even if a failure to comply has
not, or is not likely, to cause any person damage or distress, the
issue of this Enforcement Notice to compel compliance would
nonetheless be an appropriate exercise of the Commissioner’s
enforcement powers.
42. The Commissioner has considered whether it is practicable for CPS
to comply with the requirements of Annex 1. In this regard the
Commissioner notes that the requirements are basic ones for the
procurement, use and tracking of portable data storage media and
they are proportionate to the facts in issue in this case.
43. Having regard to the significant nature of the contravention, the
scale of the personal data being processed and the context in which
it is processed, the Commissioner considers that this Enforcement
Notice is a proportionate regulatory step to bring CPS into
compliance.
44. The Commissioner has also had regard to the desirability of
promoting economic growth, and the potential impact his Notice
might have. The Commissioner considers the proposed
enforcement action is unlikely to have an impact on any measure
of economic activity or growth in the UK.
Terms of the Notice
45. The Commissioner therefore exercises his powers under section
149 DPA 2018 to serve an Enforcement Notice requiring CPS to
take specified steps to comply with the DPA 2018. The terms of the
proposed Notice are set out in Annex 1 of this Notice.
14 Consequences of failing to comply with an Enforcement
Notice.
46. If a person fails to comply with an Enforcement Notice the
Commissioner may serve a penalty notice on that person under
section 155(1)(b) DPA requiring payment of an amount up to
£17,500,000 or 4% of an undertaking’s total annual worldwide
turnover whichever is the higher.
Right of appeal
47. By virtue of section 162(l)(c) DPA there is a right of appeal against
this Notice to the First-tier Tribunal (Information Rights). If an appeal
is brought against this Notice, it need not be complied with pending
determination or withdrawal of that appeal. Information about the
appeals process may be obtained from:
General Regulatory Chamber
HM Courts & Tribunals Service
PO Box 9300
Leicester
LE1 8DJ
Telephone: 0203 936 8963
Email: grc@justice.gov.uk
48. Any Notice of Appeal should be served on the Tribunal within 28
calendar days of the date on which this Notice is sent.
15Dated the 20th day of December 2023
Signed:
Anthony Luhman
Director PACE Projects and Temporary Director of Investigations
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
16ANNEX 1
TERMS OF THE ENFORCEMENT NOTICE
By no later than 3 months of issue of the notice CPS shall take the
following steps:
1. Implement appropriate technical and organisational measures to
prohibit and prevent the use by CPS personnel of self-procured USB
portable storage devices for the storage, transportation and related
processing of personal data of which CPS is the controller.
2. Implement appropriate technical and organisational measures to
provision the use of CPS-procured USB portable storage devices
by CPS personnel for the storage, transportation and related
processing of personal data of which CPS is the controller.
3. Implement appropriate technical and organisational measures for
the purposes of asset management of CPS-procured USB portable
storage devices, including the registration of the procurement of
these assets, requests for use of these assets, distribution of these
assets, sharing of these assets with third parties, such as law
enforcement agencies and the courts, and the timely return of
these assets.
4. Implement appropriate technical and organisational measures to
ensure that the use of CPS-procured USB portable storage devices
complies with CPS policies and procedures for data protection,
including security principles and the implementation of measures
such as device or file encryption.
5. Implement appropriate technical and organisational measures to
limit the use of CPS-procured USB portable storage devices, taking
account of the overall risks of their use, the context of processing
and the presence of available alternatives to their use such as
17secure file transfer using the Egress solution or related solutions
approved by the National Cyber Security Centre.
18
