ICO criticises Alzheimer’s Society’s ‘disappointing attitude’
Melanie May | 7 January 2016 | News
The ICO has ordered Alzheimer’s Society to take action after it found serious failings in the way volunteers at the charity handled sensitive data.
It discovered that volunteers were using personal email addresses to receive and share information about people who use the charity, storing unencrypted data on their home computers and failing to keep paper records locked away.
In addition, it found that the charity had not trained volunteers in data protection, its policies and procedures were not explained to them and there was a lack of staff supervision.
Advertisement
The failings concerned a group of 15 volunteers recruited in 2007 to help dementia sufferers and their families or carers seek NHS healthcare funding. Over a seven-year period, the group handled 1,920 cases. This included the drafting of reports including sensitive information about the medical treatment, care needs and mental health of the people they were trying to help.
Since the ICO identified the issues in November 2014, the charity has made improvements, however the ICO has issued it with an enforcement notice due to concerns that more needs to be done. If the charity does not comply with the enforcement notice it could face prosecution.
In addition to these issues, the charity’s website was hacked earlier in 2015, which put at risk around 300,000 email addresses, 66,000 home addresses, phone numbers and some birth dates.
The ICO made a series of recommendations in the wake of the attack. While the charity implemented most of them, it failed to undertake manual checks of its website, which the ICO believed to be crucial in detecting vulnerability. The enforcement notice also requires the charity to undertake these checks.
Other recommendations made by the ICO have also failed to be implemented fully. In 2010 it agreed to a series of security measures after several unencrypted laptops were stolen during an office burglary, and it has also been the subject of two audits – in March 2013 and March 2014 – which made recommendations about data security.
ICO head of enforcement Stephen Eckersley said:
“In failing to ensure volunteers were properly supported, this charity showed a disappointing attitude towards looking after the very sensitive information that people trusted them with. Our investigation revealed serious deficiencies in the way The Alzheimer’s Society handles personal information. Some of these have been addressed, but the extent and persistence of the charity’s failure to do as we’ve asked means we must now take more formal action.”
Alzheimer’s Society has apologised for the lapses and issued reassurance that checks have shown that no personal data passed into the public domain as a result. It said that it has strengthened existing procedures to ensure all volunteers with access to personal data receive mandatory data protection training and that training completion is monitored for compliance. It also said that it has also upgraded the website to ensure it is fully in line with compliance standards and best practice, and has said that it does run manual checks, and is addressing the remaining issues as a priority.
Brett Terry, the charity’s director of people and organisational development and senior information risk owner, said:
“We are very sorry that data breaches have occurred. We have taken a number of steps to build on and improve our technology systems and processes to ensure that we meet and exceed both ICO guidance and industry standards. As an organisation, we exist to support the most vulnerable in society. We take this responsibility, which includes data protection, extremely seriously. We want to reassure our supporters and wider stakeholders that every measure is being taken to ensure their data is kept safe.”
About Melanie May
Melanie May is a journalist and copywriter specialising in writing both for and about the charity and marketing services sectors since 2001. She can be reached via thepurplepim.com.