ICO (UK) - The Central Young Men’s Christian Association

From GDPRhub
Revision as of 15:43, 7 May 2024 by Lm (talk | contribs)
ICO - The Central Young Men’s Christian Association
LogoUK.png
Authority: ICO (UK)
Jurisdiction: United Kingdom
Relevant Law: Article 5(1)(f) GDPR
Article 32 GDPR
UK GDPR
Type: Investigation
Outcome: Violation Found
Started: 14.12.2022
Decided: 30.04.2024
Published:
Fine: 7,500 GBP
Parties: The Central Young Men’s Christian Association (Central YMCA)
National Case Number/Name: The Central Young Men’s Christian Association
European Case Law Identifier: n/a
Appeal: Not appealed
Original Language(s): English
Original Source: ICO (in EN)
Initial Contributor: lm

The DPA imposed a monetary penalty of €8,730 (£7,500) on the YMCA for violating UK GDPR security obligations by sending an email containing special categories of data to recipients using carbon copy instead of blind carbon copy.

English Summary

Facts

The Central Young Men’s Christian Association (the controller) offers a Positive Health Programme (Programme), which is an exercise scheme for people living with HIV. As part of the Programme, the Central YMCA collects special categories of data including referrals, dates of HIV diagnosis, medications taken, medical statistics, referring hospitals or clinicians and other medical history.

On 6 October 2022, a coordinator of the Programme sent an email to a mailing list of 270 recipients. The recipients were entered into the carbon copy (CC) function rather than the blind carbon copy (BCC) function, revealing the email addresses of all 270 recipients. The controller became aware of the breach the following day upon receiving complaints from affected data subjects. Upon realising the error, the coordinator attempted to unsend the email, but unintentionally sent a second email to all 270 recipients with the email addresses again entered in the CC function. Accounting for duplicates, 264 email addresses were disclosed in the breach, of which 115 had clear names and 51 had partial names that made them potentially identifiable. Thus, 166 data subjects were affected by the breach.

The controller reported the breach to the Information Commissioner’s Office (ICO) on 7 October 2022. On 10 October 2022, the controller notified the affected data subjects, took accountability of its error and informed data subjects of the steps it was taking.

At the time of the breach, the controller had a verbally communicated policy that the Programme staff should send event invitations using the BCC function. The controller had access to an email marketing tool which would permit for the sending of individual emails to each recipient, but it did not use this tool in sending emails relating to the Programme.

The controller waived its opportunity to respond to the ICO’s Notice of Intent and instead accepted the Notice and the ICO’s findings. It took remedial steps, conducting an audit of how external communications were being undertaken across the organisation and issuing new procedures to provide appropriate guidance on sending secure emails. The controller also updated its data protection training.

Holding

The ICO found that the controller violated Articles 5(1)(f) and 32 UK GDPR. It issued a monetary penalty of €8,730 (£7,500) as well as a reprimand. The ICO found that the breach resulted from serious deficiencies in the controller’s technical and organizational measures, demonstrating violations of Articles 5(1)(f) and 32 UK GDPR.

First, the controller had access to an email marketing platform which would have reduced the likelihood of an inappropriate disclosure. However, but it failed to use this tool for Programme emails even though it had the financial and organizational means to do so. The use of BCC sending instead was a high-risk method of sending emails due to human error. Given this risk, the ICO considered it irrelevant whether or not the policy requiring this practice was written down.

Second, the controller did not provide data protection training specific to employee roles or levels of access to personal data. In this case, the coordinator was a self-employed contractor. The controller’s policy had been to provide training only to employees, and the coordinator had thus not completed any data protection training. Even after the policy changed and training was extended to contractors, the coordinator was still not trained.

Third, the controller did not effectively monitor completion of data protection training. At the time of the investigation, 27% of the controller’s workers – including the coordinator who sent the incident email – had not completed the data protection training.

Finally, the controller’s data protection training was deficient. The ICO found considerable lack of awareness concerning data protection legislation within some parts of the organisation; for example, employees initially did not consider the breach a concern because the email contained no private information.

Initially, the ICO considered that a penalty of €349,000 (£300,000) would be appropriate to reflect the seriousness of the breach. However, taking into account the ICO’s action on previous cases and new policy on imposing monetary penalties, the ICO reduced the fine to €8,730. In calculating the penalty, the ICO took account of the controller’s four-day delay in notifying data subjects of the breach, negligence causing the infringement, remedial measures taken, responsibility of for the breach’s occurrence, lack of previous infringements, cooperation with the ICO and the high sensitivity of the data. Given that the emails were clearly directed at individuals with HIV, the ICO determined that the incident involved a special category of data or at the least carried a risk of inference that may be considered sensitive. It considered the violation serious due to the sensitivity of the personal data involved.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

DATA PROTECTION ACT 2018 (PART 6, SECTION 155)


    SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER



                       MONETARY PENALTY NOTICE



TO:   The Central Young Men’s Christian Association ("the Central YMCA")


OF:   112 Great Russell Street, London WC1B 3NQ.


Introduction and Summary




1.    The Information Commissioner ("the Commissioner") has decided to issue

      the Central YMCA with a monetary penalty under section 155 of the Data

      Protection Act 2018 (“the DPA”). The penalty notice imposes an

      administrative fine on the Central YMCA, in accordance with the
      Commissioner's powers under Article 83 of the General Data Protection

      Regulation 2016 (the "UK GDPR"). The amount of the penalty is £7,500

      (seven thousand five hundred pounds).




2.    The penalty is in relation to contraventions of Articles 5(1)(f) and 32(1)

      and (2) of the UK GDPR and an incident on 6 October 2022 (the “relevant
      date”) affecting personal data processed by the Central YMCA on the

      relevant date.



3.    For the reasons set out in this Monetary Penalty Notice, the Commissioner

      has found that the Central YMCA failed to ensure appropriate security of


                                      1      personal data in its control by implementing appropriate technical and

      organisational measures and appropriate policies and procedures, as

      required by Article 5(1)(f) and Article 32(1) of the UK GDPR.


4.    This Monetary Penalty Notice explains the Commissioner's decision,

      including the Commissioner's reasons for issuing the penalty and for the

      amount of the penalty. The Central YMCA has had an opportunity to make

      representations to the Commissioner in response to the Notice of Intent
      regarding this penalty. Instead of making representations the Central

      YMCA has decided to accept the Notice of Intent and the Commissioner’s

      findings.


Legal Framework



Obligations of the Controller



5.    The Central YMCA is a controller for the purposes of the UK GDPR and the

      DPA, because it determines the purposes and means of processing of

      personal data (UK GDPR Article 4(7)).


6.    “Personal data” is defined by Article 4(1) of the UK GDPR to mean:


            “information relating to an identified or identifiable natural person

            (‘data subject’); an identifiable natural person is one who can be

            identified, directly or indirectly, in particular by reference to an

            identifier such as a name, an identification number, location data,
            an online identifier or to one or more factors specific to the physical,

            physiological, genetic, mental, economic, cultural or social identity

            of that natural person.”



                                        27.    “Processing” is defined by Article 4(2) of the UK GDPR to mean:


            “any operation or set of operations which is performed on personal

            data or on sets of personal data, whether or not by automated

            means, such as collection, recording, organisation, structuring,
            storage, adaptation or alteration, retrieval, consultation, use,

            disclosure by transmission, dissemination or otherwise making

            available,  alignment   or  combination,    restriction, erasure   or

            destruction”


8.    Article 9 of the UK GDPR prohibits the processing of “special categories of

      personal data” unless certain conditions are met. The special categories
      of personal data subject to Article 9 include:



            “personal data revealing racial or ethnic origin, political opinions,

            religious or philosophical beliefs, or trade union membership, and

            the processing of genetic data, bio-metric data for the purpose of

            uniquely identifying a natural person, data concerning health or
            data concerning a natural person’s sex life or sexual orientation”.



9.    Controllers are subject to various obligations in relation to the processing

      of personal data, as set out in the UK GDPR and the DPA. They are obliged

      by Article 5(2) to adhere to the data processing principles set out in Article
      5(1) of the UK GDPR. Article 5(2) makes clear that the “controller shall

      be responsible for, and be able to demonstrate compliance with,

      paragraph 1 ('accountability')".



10.   In particular, controllers are required to implement appropriate technical

      and organisational measures to ensure that their processing of personal



                                        3      data is secure, and to enable them to demonstrate that their processing

      is secure. Article 5(1)(f) ("Integrity and Confidentiality") stipulates that:


            “Personal data shall be […] processed in a manner that ensures

            appropriate security of the personal data, including protection
            against unauthorised or unlawful processing and against accidental

            loss, destruction or damage, using appropriate technical or

            organisational measures”.


11.   Article 32 of the UK GDPR also provides that:


            “1. Taking into account the state of the art, the costs of

            implementation and the nature, scope, context and purposes of

            processing as well as the risk of varying likelihood and severity for

            the rights and freedoms of natural persons, the controller and the
            processor shall implement appropriate technical and organisational

            measures to ensure a level of security appropriate to the risk,

            including inter alia as appropriate:



            (a)    the pseudonymisation and encryption of personal data;


            (b)    the ability to ensure the ongoing confidentiality, integrity,

                   availability and resilience of processing systems and services;


            (c)    the ability to restore the availability and access to personal

                   data in a timely manner in the event of a physical or technical

                   incident;


            (d)    a process for regularly testing, assessing and evaluating the

                   effectiveness of technical and organisational measures for
                   ensuring the security of the processing.


                                        4            2. In assessing the appropriate level of security account shall be

               taken in particular of the risks that are presented by processing,

               in particular from accidental or unlawful destruction, loss,

               alteration, unauthorised disclosure of, or access to personal data
               transmitted, stored or otherwise processed."




The C ommissioner’s Powers of Enforcement


12.   The Commissioner is the supervisory authority for the UK, as provided for

      by Article 51 of the UK GDPR.


13.   By Article 57(1) of the UK GDPR, it is the Commissioner’s task to monitor

      and enforce the application of the UK GDPR.


14.   By Article 58(2)(d) of the UK GDPR the Commissioner has the power to

      notify controllers of alleged infringements of the UK GDPR. By Article

      58(2)(i) he has the power to impose an administrative fine, in accordance
      with Article 83, in addition to or instead of the other corrective measures

      referred to in Article 58(2), depending on the circumstances of each

      individual case.


15.   By Article 83(1), the      Commissioner    is required   to ensure    that

      administrative fines issued in accordance with Article 83 are effective,

      proportionate, and dissuasive in each individual case. Article 83(2) goes

      on to provide that:


            “When deciding whether to impose an administrative fine and

            deciding on the amount of the administrative fine in each individual

            case due regard shall be given to the following:


                                       5(a) the nature, gravity and duration of the infringement

taking into account the nature scope or purpose of the

processing concerned as well as the number of data subjects

affected and the level of damage suffered by them;


(b) the intentional or negligent character of the infringement;



(c) any action taken by the controller or processor to mitigate

the damage suffered by data subjects;


(d) the degree of responsibility of the controller or processor

taking into account technical and organisational measures

implemented by them pursuant to Articles 25 and 32;



(e) any relevant previous infringements by the controller or
processor;



(f) the degree of cooperation with the supervisory authority,

in order to remedy the infringement and mitigate the possible

adverse effects of the infringement;


(g) the   categories  of  personal   data  affected  by  the

infringement;



(h) the manner in which the infringement became known to

the supervisory authority, in particular whether, and if so to
what extent,    the  controller or  processor   notified the

infringement;


                     6                  (i) where measures referred to in Article 58(2) have

                  previously been ordered against the controller or processor

                  concerned    with  regard   to  the   same    subject-matter,

                  compliance with those measures;


                  (j) adherence to approved codes of conduct pursuant to

                  Article 40 or approved certification mechanisms pursuant to

                  Article 42; and



                  (k) any other aggravating or mitigating factor applicable to

                  the circumstances of the case, such as financial benefits

                  gained, or losses avoided, directly or indirectly, from the

                  infringement.”


16.   Article 83(5) UK GDPR provides, inter alia, that infringements of the

      obligations imposed by Article 5 UK GDPR on the controller and processor

      will, in accordance with Article 83(2), be subject to administrative fines

      of up to €20 million or, in the case of an undertaking, up to 4% of its total

      worldwide annual turnover of the preceding financial year, whichever is

      higher.


17.   The DPA contains enforcement provisions in Part 6 which are exercisable

      by the Commissioner.  1 Section 155 of the DPA sets out the matters to

      which the Commissioner must have regard when deciding whether to

      issue a penalty notice and when determining the amount of the penalty

      and provides that:



1Section 115 DPA establishes that the Commissioner is the UK's supervisory authority for the purposes
of the UK GDPR.
                                       7            “(1) If the Commissioner is satisfied that a person—



                  (a) has failed or is failing as described in section 149(2) …,


                  the Commissioner may, by written notice (a "penalty notice"),

                  require the person to pay to the Commissioner an amount in

                  sterling specified in the notice.


            (2) Subject to subsection (4), when deciding whether to give a

            penalty notice to a person and determining the amount of the

            penalty, the Commissioner must have regard to the following, so

            far as relevant—



                  (a) to the extent that the notice concerns a matter to which
                  the GDPR applies, the matters listed in Article 83(1) and (2)

                  of the UK GDPR.”




18.   The failures identified in section 149(2) DPA are, insofar as relevant here:


            “(2) The first type of failure is where a controller or processor has

            failed, or is failing, to comply with any of the following—


                  (a) a provision of Chapter II of the UK GDPR or Chapter 2 of

                  Part 3 or Chapter 2 of Part 4 of this Act (principles of

                  processing);



                  …;





                                       8                  (c) a provision of Articles 25 to 39 of the UK GDPR or section

                  64 or 65 of this Act (obligations of controllers and processors)

                  […]”



19.   Schedule 16 includes provisions relevant to the imposition of penalties.

      Paragraph 2 makes provision for the issuing of notices of intent to impose
      a penalty, as follows:



            “(1) Before giving a person a penalty notice, the Commissioner

            must, by written notice (a "notice of intent") inform the person that

            the Commissioner intends to give a penalty notice.”



The Commissioner's Regulatory Action Policy



20.   Pursuant to section 160(1) DPA, the Commissioner published his
      Regulatory Action Policy ("RAP”) on 7 November 2018.



21.   The process the Commissioner will follow in deciding the appropriate

      amount of a penalty to be imposed is described in the RAP from page 27

      onwards. In particular, the RAP sets out the following five-step process:


         a. Step 1. An ‘initial element’ removing any financial gain from the

            breach.



         b. Step 2. Adding in an element to censure the breach based on its

            scale and severity, taking into account the considerations identified
            at section 155(2) - (4) DPA.





                                      9         c. Step 3. Adding in an element to reflect any aggravating factors. A

            list of aggravating factors which the Commissioner would take into

            account, where relevant, is provided at page 11 of the RAP. This
            list is intended to be indicative, not exhaustive.



         d. Step 4. Adding in an amount for deterrent effect to others.



         e. Step 5. Reducing the amount (save that in the initial element) to
            reflect any mitigating factors, including ability to pay (financial

            hardship). A list of mitigating factors which the Commissioner would

            take into account, where relevant, is provided at page 11-12 of the

            RAP. This list is intended to be indicative, not exhaustive.




Circumstances of    the Failure: Facts



General Background



22.   This Penalty Notice does not purport to identify exhaustively each and
      every circumstance and document relevant to the Commissioner’s

      investigation. The circumstances and documents identified below are a

      proportionate summary.



23.   The Central YMCA is an education and wellbeing charity registered as a

      data controller with the Information Commissioner's Office (the "ICO"). It
      provides a number of community programmes, one of which is the

      Positive Health Programme.






                                      1024.   The Positive Health Programme ("Programme") is run by the Positive

      Health team as part of YMCA Club. YMCA Club is a large gym facility,

      which is part of the Central YMCA.


25.   The Programme is an exercise scheme for people living with HIV. As part

      of the Programme, the Central YMCA collects special category data (the

      aims of referral to the Programme, the date of HIV diagnosis, the

      medication taken, the individual's medical statistics, other medical history
      and their referring clinician/hospital).



26.   On 6 October 2022 at approximately 15:34 BST, a co-ordinator for the

      Programme sent an email to a mailing list of 270 recipients, inviting them

      to a talk about nutrition.


27.   The Programme co-ordinator used an email programme (Microsoft

      Outlook) to send the email. At the relevant date, the Central YMCA had a
      verbally communicated policy that the Programme team should send

      event invitations via Microsoft Outlook using the blind carbon copy

      (“BCC”) function.


28.   The co-ordinator unfortunately included those email addresses in the

      carbon copy (“CC”) function, thus revealing all of the email addresses to

      all 270 recipients.


29.   The day after, on realising the error, the co-ordinator used the recall

      function within Microsoft Outlook to try and recall the email sent. This
      however led to another email to all 270 recipients. It was the Programme

      team's belief that this would remove the original message from the

      recipients' inboxes.




                                     11The number of data subjects involved


30.   Whilst the emails had been sent to 270 recipients, there were duplicates,

      so they were sent to 264 unique email addresses.


31.   The emails were not delivered to 9 of those email addresses, so the emails

      were delivered to 255 recipients, disclosing 264 email addresses.



32.   The Central YMCA then assessed that 115 of those had clear names in
      them, and a further 51 contained at least part of a name, making them

      potentially identifiable. Therefore 166 data subjects were affected by the

      breach, all of whom are in the Programme.



The nature of the personal data and special category data disclosed


33.   As part of its guidance and resources relating to UK GDPR, the

      Commissioner has produced detailed guidance in relation to special

      category data. The guidance includes a sub-section titled 'What is special

      category data?' which establishes that special category data is not just

      personal data which specifies relevant details but also personal data
      "revealing or concerning" those details. The test to be met is whether the

      relevant information can be inferred with a reasonable degree of

      certainty, and if so, it is likely to be special category data.



34.   As well as the disclosure of 166 email addresses containing personal data,

      the context of the email was the Programme. The invite to the event for
      nutrition guidance to individuals meant that it can be reasonably assumed

      that the recipients of the email would be aware that the Programme is

      directed at individuals with HIV. If the recipients were not part of the

                                      12      Programme, they could find out what the Programme was on the Central

      YMCA's website.


35.   Recipients of the email can therefore infer from its contents that the 166

      individuals whose email addresses were disclosed in the breach were

      likely to be living with HIV, meaning that the disclosed personal data

      included health data, which in turn is special category data under Article

      9(1) of the UK GDPR.


36.   The Central YMCA had also set expectations of privacy in its Programme,
      and that some members of the Programme may have wished to remain

      anonymous, even to other members of the Programme, whilst noting that

      "all recipients are assumed to have an HIV positive diagnosis".


37.   Even if the personal data was not considered to be special category data,

      there are particular sensitivities regarding the personal data being

      processed in the Programme, which the Central YMCA should have

      considered and taken a cautious approach when processing it, as set out
      in the Commissioner's guidance referred to in paragraph 33:


           "If you think the data carries a risk of inferences that might be

           considered sensitive or private, even if this falls short of revealing

           something about one of the special categories with any level of

           certainty, then you should also carefully consider fairness issues

           and whether there is anything more you can do to minimise privacy

           risks."


Discovery    of  the  breach,    reporting   to  the   Commissioner     and
communications to data subjects





                                     1338.   The Central YMCA became aware of the breach on the morning after the

      email was sent, as a result of complaints received from recipients.


39.   The YMCA Club informed the Central YMCA's Data Protection Officer (DPO)

      later that morning, with a breach report being made to the ICO that

      evening. This was in line with Article 33 of the UK GDPR and within the

      72 hour period.


40.   In accordance with Article 34 of the UK GDPR the Central YMCA notified

      affected data subjects on 10 October 2022, setting out the cause of the

      breach, took accountability for the error and informed data subjects of

      the steps the Central YMCA were taking, including reporting the incident

      to the ICO and conducting an internal review. The data controller provided

      the DPO’s contact details for anyone affected to ask questions or to
      discuss how the breach had affected them.



The Commissioner’s Investigation



41.   The Commissioner first wrote to the Central YMCA on 14 December 2022
      asking for further information in relation to the actions the Central YMCA

      had taken following the data breach notification it had made on 7 October

      2022. During the period between February 2023 and April 2023,

      subsequent enquiries were raised by the Commissioner seeking additional

      information from the Central YMCA.


42.   The Commissioner's investigation found four key areas where the Central

      YMCA failed to take reasonable steps to prevent this breach:


         a. The Central YMCA had no written policy in place regarding the

            sending of group emails,

                                      14         b. The Central YMCA had access to an email marketing platform (and

            the use of this platform would have reduced the likelihood of an

            inappropriate disclosure) however the Central YMCA did not use it
            in this case,

         c. The Central YMCA failed to effectively monitor completion of data

            protection training, and

         d. There is evidence of deficiencies within the Central YMCA's data

            protection training.



The Contraventions of Articles of 5 (1)(f) and 32 (1) and (2) of the UK

GDPR



43.   The Commissioner has considered whether the facts set out above

      constitute a contravention of the data protection legislation.


44.   For the reasons set out below, the Commissioner has taken the view from

      his investigation that this breach occurred as a result of serious

      deficiencies in the technical and organisational measures implemented by

      the Central YMCA.


45.   For the reasons set out below, and having carefully considered the

      information provided by the Central YMCA, the Commissioner's view is

      that the Central YMCA failed to comply with Articles 5 (1)(f) and 32(1)

      and (2) of the UK GDPR.




Article 5 (1)(f) and 32(1) and (2) of the UK GDPR





                                     1546.   The Commissioner finds that the Central YMCA has failed to comply with

      the requirements of Article 5(1)(f) of the UK GDPR, including to process

      personal data "in a manner that ensures appropriate security of the data,
      including protection against unauthorised or unlawful processing, using

      appropriate technical or organisational measures". In making this

      determination, the Commissioner takes into account the Central YMCA's

      failure to comply with Articles 32(1), 32(1)(a), 32(1)(b) and 32(2) of the

      UK GDPR, which was demonstrated by the Central YMCA's failure to
      implement appropriate technical and organisational measures:



         a. not having a relevant written policy or procedure in place;

         b. inappropriately relying on the use of BCC to send group emails;

         c. not providing data protection training specific to employee roles and

            levels of access to personal data;
         d. a lack of awareness of data protection legislation within some parts

            of the organisation; and

         e. not effectively monitoring completion of data protection training.



            (1) not having a relevant written policy or procedure


47.   At the time of the security incident, the Central YMCA did not have

      sufficient written information security policies or procedures to prevent

      this breach. It only had a verbal policy to use BCC in emails, both of which

      are insufficient and not appropriate for managing special category data.

      It also communicated relatively frequently using this method.


48.   Another part of the Central YMCA (the Communications and Marketing

      team) had an email marketing tool, BrotherMailer, which could have been

      used to mitigate this risk and handle the special category data


                                       16      appropriately, by sending individual emails to each recipient. However,

      the Central YMCA did not know that the Programme was sending emails

      of this nature.


49.   Relevant industry standards and guidance, including ISO27001, NIST

      Cyber Security Framework, and the ICO and National Cyber Security

      Centre co-published guidance, "GDPR Security Outcomes", establish that

      organisations should have written security policies and procedures in
      place.



50.   ISO27001 recommends that: “A set of policies for information security

      shall be defined, approved by management, published and communicated

      to employees and relevant external parties”. The NIST Cyber Security

      Framework requires that an: “Organizational cybersecurity policy is
      established and communicated”, and the GDPR Security Outcomes sets

      out that to protect personal data against cyber-attacks organisations

      should "define, implement, communicate and enforce appropriate policies

      and processes that direct your overall approach to securing systems

      involved in the processing of personal data".


51.   It is the Commissioner's view that the lack of documented and

      appropriate security policies and procedures to deal with the sending of

      emails with special category data was in non-compliance with Article

      32(1) of the UK GDPR. The lack of such documentation also contributed

      to the Central YMCA failing to process personal data in a manner that
      ensured appropriate security of the personal data, including protection

      against unauthorised or unlawful processing, using appropriate technical

      or organisational measures, as required by Article 5(1)(f) of the UK GDPR.

      It also meant that the Central YMCA had not assessed the appropriate


                                     17      level of security with regard to the risks of its data processing, particularly

      here in respect of the unauthorised disclosure of an individual's special

      category data to other participants in the Programme, as required by
      Article 32(2) of the UK GDPR.



            (2) inappropriately relying on the use of BCC to send group

            emails


52.   As the Commissioner refers to above, the lack of a documented policy

      meant that whilst the Programme co-ordinator believed that they were
      acting in an appropriate way, following the verbal policy to use BCC, this

      was an inappropriately insecure method of doing so. This is because it

      relies on the individual sending the email to ensure that it goes in the BCC

      field and not, as happened here, in the CC field, thus exposing individuals'

      special category data.


53.   The Central YMCA had the financial and organisational means to

      implement BrotherMailer in the Programme team but failed to do so. As

      the Central YMCA procured the BrotherMailer tool for use elsewhere in the

      Central YMCA, it can be inferred that parts of the Central YMCA knew that

      reliance on sending emails by BCC was inappropriate, but that this
      knowledge,   the   process  and   the   tool were   not   appropriately

      communicated throughout the Central YMCA.



54.   If the Central YMCA had used BrotherMailer it would also have likely

      safeguarded the personal data from inappropriate disclosure.


            (3) not providing data protection training specific to

            employee roles and levels of access to personal data



                                     1855.   The Central YMCA told the Commissioner that the Programme co-

      ordinator had been initially a self-employed contractor in a different team.

      They had not completed data protection training and it had been the
      Central YMCA's policy to provide training only to employees.



56.   This changed in March 2022, but as the Commissioner notes below in

      point 5, the Programme co-ordinator still did not take the training.


57.   The Central YMCA used a training partner called Bob's Business Ltd. The

      Central YMCA provided copies of this training to the Commissioner during

      the investigation. It included sections on the sending of group emails, but

      it also stated (despite what the Central YMCA said about there being no

      written policy) that individuals should use BCC when sending to multiple

      contacts.


58.   Whilst completion of that training may have reduced the risk of the

      inappropriate disclosure, BCC is still a high risk method of sending emails

      and hence the training would not have eliminated the risk of human error.


59.   The training did not highlight the increased risks when processing special

      category data, nor did it bring attendees' attention to the fact that there

      was within the Central YMCA the BrotherMailer platform available which

      would have provided an appropriately secure alternative method to send

      emails.


60.   The Commissioner expected the Central YMCA to provide role specific

      data protection training, at a sufficient quality to ensure that data

      protection is understood, and proportionate to the individual's level of

      access to, and sensitivity of, personal data.


                                       19            (4) a lack of awareness of data protection legislation within

            some parts of the organisation


61.   The Commissioner noted in its investigation that there is evidence of a

      lack of awareness of data protection legislation in the Programme team.

      For example, they did not initially understand the seriousness of the

      breach, referring to a "possible breach" when reporting it, and stating that
      the email "contained no private information".



            (5) not effectively monitoring completion of data protection

            training



62.   The Programme co-ordinator had not completed data protection training
      prior to the data breach. At the relevant time, 73% of workers at the

      Central YMCA had completed the relevant training module.



63.   Before the Programme co-ordinator moved to a fixed term contract in

      2022, they were signed up to certain induction modules, including data
      protection training. They did not complete this training, nor did they do

      so when training was required for self-employed contractors. A process

      was in place for line managers to ensure induction checklists were

      completed, but there was no central oversight. A reporting mechanism

      was in place to assess non-completion, but this did not work either.


64.   The Commissioner expected the Central YMCA to monitor training

      effectively and ensure that mandatory training was completed, in line with

      the Central YMCA's policies.




                                      20Factors relevant to whether a penalty is appropriate, and if so, the

amount of the penalty


65.   The Commissioner has considered the factors set out in Article 83(2) of

      the UK GDPR in deciding whether to issue a penalty. For the reasons given

      below, he is satisfied that: (i) the contraventions are sufficiently serious

      to justify issuing a penalty in addition to exercising his corrective powers;

      and (ii) the contraventions are serious enough to justify a significant fine.


(a)   the nature, gravity and duration of the infringement taking into

account the nature, scope or purpose of the processing concerned as

well as the number of data subjects affected and the level of damage

suffered by them


Nature:


66.   As the Commissioner sets out above, this was a disclosure of special

      category data in circumstances where confidentiality was expected, and

      the Central YMCA had not taken appropriate actions to appropriately

      secure the special category data. The Central YMCA had intended to use
      BCC which is not appropriately secure, and the Programme co-ordinator

      then used CC which was not secure.



67.   The Commissioner's investigation into the incident revealed multiple

      infringements of the UK GDPR as set out in paragraphs 41 to 64 above.

      In particular, the Commissioner found breaches of Article 5(1)(f) and
      32(1) and (2) due to: no written policy being in place for the sending of

      group emails; the email marketing platform not being used hence CC

      being used by mistake; not effectively monitoring the completion of data

      protection training; and deficiencies within that training itself.

                                     21Gravity:


68.   The contravention is serious, in particular having regard to the sensitivity

      of the personal data processed by the Central YMCA.



69.   In addition, the Commissioner takes account of the risks to data subjects

      that arise from the loss of control and disclosure of what they considered
      and expected to be confidential special category data, as it was special

      category data for 166 data subjects given that a positive HIV diagnosis

      can be inferred with a reasonable degree of certainty.




Number of data subjects



70.   The number of data subjects is 166, as set out above at paragraph 69.


Duration



71.   The Commissioner considers that the contraventions relating to Articles

      5(1)(f) and 32(1) of the UK GDPR were from 6 October 2022 at 15:34
      BST when the breach occurred. It was not until 10 October 2022 that the

      individuals on the affected mailing list were emailed to advise of the

      breach.



(b)   the intentional or negligent character of the infringement



72.   The Commissioner considers that the infringement was negligent for the

      reasons set out in paragraphs 66 to 69 above.


                                     22(c)   any action taken by the controller or processor to mitigate the

damage suffered by data subjects


73.   The Central YMCA complied with Article 34 of the UK GDPR to notify data

      subjects of the personal data breach, but this took from 6 October to 10

      October to do so.


74.   The Central YMCA also implemented short and longer term remedial

      measures, including an attempted email recall which was ineffective,

      immediate breach reporting to the Central YMCA DPO and feedback to the

      staff involved about the approach they had taken being ineffective.



(d)   the degree of responsibility of the controller or processor taking
into account technical and organisational measures implemented by

them pursuant to Articles 25 and 32





75.   Article 32 of the UK GDPR requires organisations to implement
      appropriate technical and organisational measures to ensure a level of

      security appropriate to the risks presented by their processing; to include

      the potential impacts these risks may have on the rights and freedoms of

      natural persons.



76.   More specifically, Article 32(1)(b) of the UK GDPR requires organisations
      to implement measures that ensure the ongoing confidentiality, integrity,

      availability and resilience of their processing systems and services.


77.   The Commissioner is satisfied that for the reasons set out in the

      paragraphs above that the Central YMCA did not have sufficient measures

                                     23     in place to ensure the ongoing integrity and resilience of processing

     systems and services in line with Articles 5(1)(f) and 32(1).


(e)  any   relevant  previous   infringements   by   the  controller  or

processor



78.  The Commissioner has not identified any relevant previous infringements
     by the Central YMCA.



(f)  the degree of cooperation with the supervisory authority, in order

to remedy the infringement and mitigate the possible adverse effects

of the infringement


79.  The Central YMCA fully cooperated with the Commissioner's investigation.



(g)  the categories of personal data affected by the infringement


80.  The categories of personal data affected is set out above at paragraphs

     33 to 37.


(h)  the manner in which the infringement became known to the

supervisory authority, in particular whether, and if so to what extent,

the controller or processor notified the infringement



81.  The Central YMCA self-reported the personal data breach to the

     Commissioner within 72 hours of becoming aware of the incident.


(i)  where measures referred to in Article 58(2) have previously been

ordered against the controller or processor concerned with regard to

the same subject-matter, compliance with those measures;

                                   2482.   Not applicable.


(j)   adherence to approved codes of conduct pursuant to Article 40 or

approved certification mechanisms pursuant to Article 42;



83.   Not applicable.


(k)   any other aggravating or mitigating factor applicable to the

circumstances of the case, such as financial benefits gained, or losses

avoided, directly or indirectly, from the infringement.



84.   The Commissioner has considered the following aggravating factors in

      this case:
         a. Not applicable.



85.   The Commissioner took into account the following mitigating factors:

         a. Not applicable.




Summary and Penalty


86.   For the reasons set out above, the Commissioner has decided to impose

      a financial penalty on the Central YMCA. Taken together the findings

      above concerning the infringement, its likely impact, and the fact that the

      Central  YMCA   failed  to comply   with   its GDPR   obligations,  the

      Commissioner has decided to apply an effective, dissuasive and
      proportionate penalty reflecting the seriousness of the breach which has

      occurred.



                                     25Calculation of Penalty



87.   The Commissioner considers that imposition of a financial penalty would

      be an effective and proportionate action to ensure future compliance.



88.   Following the Five Step process set out in the RAP the calculation of the
      proposed penalty is as follows.



89.   Step 1: An initial element removing any financial gain from the breach.

      There was no evidence of financial gain from the breach.



90.   Step 2: Adding in an element to censure the breach based on its scale
      and severity, taking into account the considerations identified at section

      155(2)-(4) DPA. This refers to and repeats the matters listed in Article

      83(1) and (2) as set out above. The details are set out above and the

      conclusion at step 2, taking into account: (a) the matters set out above

      at paragraphs 65 to 83, (b) the matters referred to in this section and (c)
      the need to apply an effective proportionate and dissuasive fine the

      Commissioner considers that a penalty of £300,000 would be appropriate

      before adjustment in accordance with Steps 3-5 below. This amount is

      considered appropriate to reflect the seriousness of the breach and takes

      into account in particular the need for the penalty to be effective,

      proportionate and dissuasive.


91.   Step 3: Adding in an element to reflect and aggravating factors (Article

      83(2)(k)). The Commissioner considered that there were no additional

      factors relevant to the setting of the penalty were addressed during Step

      2.



                                       2692.   Step 4: Adding an amount for deterrent effect to others. The

      Commissioner considered that the factors relevant to the setting of the

      penalty were addressed during Step 2.


93.   Step 5: Reducing the amount to reflect any mitigating factors including

      ability to pay. The Commissioner does not believe that there are any

      mitigating factors relevant to step 5 even though new procedures have

      been implemented and better training and written policies have been
      applied. The Commissioner expects any organisation to have these in

      place as a matter of course. However, taking into account the

      Commissioner's current policy and its action on previous cases, the

      Commissioner reduced the value of the fine to £7,500.



The amount of the penalty


94.   For the reasons explained above, the Commissioner is satisfied that the
      conditions from the factors set out in Article 83(2) of the UK GDPR have

      been met in this case and that he has adopted fair procedure. The latter

      has included issuing a Notice of Intent, in which the Commissioner set out

      his preliminary thinking. The Central YMCA had the opportunity to make

      written representations in response to the Notice of Intent but instead
      has decided to accept the Notice of Intent and the Commissioner's

      findings.



95.   In making his decision, the Commissioner has also had regard to the

      factors set out in s108(2)(b) of the Deregulation Act 2015; including: the

      nature and level of risks associated with non-compliance, including the
      risks to economic growth; the steps taken by the business to achieve

      compliance and reasons for its failure; the willingness and ability of the

      business to address non-compliance; the likely impact of the proposed

                                      27      intervention on the business, and the likely impact of the proposed

      intervention on the wider business community, both in terms of deterring

      non-compliance and economic benefits to legitimate businesses.


96.   Taking into account all of the factors set out above, the Commissioner

      has decided to impose a penalty on the Central YMCA of £7,500 (seven

      thousand and five hundred pounds).





Conclusion


97.   The monetary penalty must be paid to the Commissioner's office by BACS

      transfer or cheque by 3 April 2024 at the latest. The monetary penalty

      is not kept by the Commissioner but will be paid into the Consolidated

      Fund which is the Government's general bank account at the Bank of
      England.



98.   There is a right of appeal to the First-tier Tribunal (Information Rights)

      against:

         a) The imposition of the penalty; and/or,
         b) The amount of the penalty specified in the penalty notice



99.   Any notice of appeal should be received by the Tribunal within 28 days of

      the date of this penalty notice.



100. The Commissioner will not take action to enforce a penalty unless:
        the period specified within the notice within which a penalty must be

         paid has expired and all or any of the penalty has not been paid;




                                      28        all relevant appeals against the penalty notice and any variation of it

         have either been decided or withdrawn; and

        the period for appealing against the penalty and any variation of it has
         expired



101. In England, Wales and Northern Ireland, the penalty is recoverable by

      Order of the County Court or the High Court. In Scotland, the penalty can

      be enforced in the same manner as an extract registered decree arbitral
      bearing a warrant for execution issued by the sheriff court of any

      sheriffdom in Scotland.



102. Your attention is drawn to Annex 1 to this Notice, which sets out details

      of your rights of appeal under s.162 DPA 2018.


Dated the 6th day of March 2024













Anthony Luhman
Temporary Director of Investigations
Information Commissioner’s Office
Wycliffe House

Water Lane
Wilmslow
Cheshire
SK9 5AF






                                      29    ANNEX 1



           Rights of appeal against decisions of the Commissioner


1.    Section 162 of the Data Protection Act 2018 gives any person upon

      whom a penalty notice or variation notice has been served a right

      of appeal to the First-tier Tribunal (Information Rights) (the
      Tribunal') against the notice.



2.    If you decide to appeal and if the Tribunal considers:-





          a)    that the notice against which the appeal is brought is
                not in accordance with the law; or



          b)    to the extent that the notice involved an exercise of

                discretion by the Commissioner, that she ought to have

                exercised her discretion differently


      the Tribunal will allow the appeal or substitute such other decision

      as could have been made by the Commissioner. In any other case

      the Tribunal will dismiss the appeal.



3.    You may bring an appeal by serving a notice of appeal on the
      Tribunal at the following address:

                GRC & GRP Tribunals
                PO Box 9300

                Arnhem House
                31 Waterloo Way
                Leicester
                LE1 8DJ


                                           30                Telephone: 0203 936 8963
                Email: grc@justice.gov.uk


          a)    The notice of appeal should be sent so it is received

                by the Tribunal within 28 days of the date of the

                notice.


          b)    If your notice of appeal is late the Tribunal will not

                admit it unless the Tribunal has extended the time for

                complying with this rule.



4.    The notice of appeal should state:-


      a)    your name and address/name and address of your representative (if

            any);

      b)    an address where documents may be sent or delivered to you;

      c)    the name and address of the Information Commissioner;

      d)    details of the decision to which the proceedings relate;
      e)    the result that you are seeking;

      f)    the grounds on which you rely;

      g)    you must provide with the notice of appeal a copy of the penalty

            notice or variation notice;

      h)    if you have exceeded the time limit mentioned above the notice of

            appeal must include a request for an extension of time and the
            reason why the notice of appeal was not provided in time.



5.    Before deciding whether or not to appeal you may wish to consult your

      solicitor or another adviser. At the hearing of an appeal a party may

      conduct his case himself or may be represented by any person whom he
      may appoint for that purpose.


                                          316.    The statutory provisions concerning appeals to the First-tier Tribunal

      (General Regulatory Chamber) are contained in sections 162 and 163 of,
      and Schedule 16 to, the Data Protection Act 2018, and Tribunal

      Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009

      (Statutory Instrument 2009 No. 1976 (L.20)).












































                                         32