L5 Data Breaches and the National Consent POlicy

Question 1

when is a data protection officer necessary for an organisation

Answer 1

• the processing is carried out by a public authority or body
• the core activities of the controller or the processor consist of processing operations, which require regular and systematic monitoring of data subjects on a large scale; or
• the core activities of the controller or the processor consist of processing on a large scale of special categories of data or personal data relating to criminal convictions and offences

Question 2

special data cetagories

Answer 2

• Personal data revealing racial or ethnic origin.
• Political opinions.
• Religious or philosophical beliefs.
• Trade union membership.
• Genetic data and biometric data processed for the purpose of uniquely identifying a natural person.
• Data concerning health.
• Data concerning a natural person’s sex life or sexual orientation.

Question 3

data protection impact assessments

Answer 3

• Mandatory for any new high risk processing projects
• To identify and mitigate against any data protection related risks arising from a new project
• Plan for the implementation of any solutions to those risks, and assess the viability of a project at an early stage.

Question 4

data breach

Answer 4

a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.” (HSE Data Breach Process Guidance, 2019)

Question 5

guidelines/laws which relate to management of breaches

Answer 5

• HSE Data Protection Policy
• HSE Data Protection Breach Process Guidance
• Article 33 of the GDPR introduces mandatory data
  breach notification obligations on organisations

Question 6

HSE Breach Process Guidance

Answer 6

1. Identify
2. Notify
3. Classify
4. Report
5. Contain and Recover
6. Risk assessment
7. Notification of breach
8. Evaluation and response

Question 7

step 2: notify

Answer 7

• Staff member notifies line manager within 72 hours, although really it should be immediately
• Manager is notified and will sign the Data Breach Incident Report form

Question 8

step 3: classify

Answer 8

Manager will identify if it is a data protection breach or data protection incident

Question 9

step 4: report

Answer 9

• The staff member and manager complete data breach incident form
• Which is sent to Deputy Data Protection Officer who confirms breach / incident
• Also sent to Office of Chief Information Officer (OoCIO) if information systems breach

Question 10

Step 4: report (if it’s an incident)

Answer 10

• DDPO advises of any corrective action to make
• Manager logs incident and implements corrective actions

Question 11

Step 4: report (if it’s a breach)

Answer 11

DDPO logs breach with Data Protection Commission and advises of corrective actions that have been taken

Question 12

Step 5: contain and recover

Answer 12

• The manager will limit the scope and impact of the breach of data (eg. changing access)
• DDPO establish who in the organisation needs to be made aware of the breach and inform them of what they are expected to do to assist in the containment exercise (eg Garda, communications dept)
• OoCIO has a role in containment if it was an IT breach (eg wiping a mobile device)

Question 13

Step 6: risk assessment

Answer 13

• Consider what would be the potential adverse consequences for individuals:

a) What type of information/data is involved?
b) How sensitive is the information/data?
c) Are there any security mechanisms in place (e.g. password, protected, encryption)?
d) What could the information/data tell a third party about the individual?
e) How many individuals’ are affected by the breach?

• If large scale/highly sensitive → DDPO informs DPO who will advise of necessary corrective actions

Question 14

Step 7: notification of breach

Answer 14

• Outline what occurred
• Apologise for the incident
• Provide name and contact for further info
• Describe the likely consequences of the breach
• Describe the measures taken to address the breach
• Confirm the DPC has been notified
• Record notification to data subject

Question 15

Step 8: Evaluation and response

Answer 15

• A thorough review of the incident should occur.
• Ensure that the steps taken during the incident were appropriate and to identify areas that may need to be improved.
• Any recommended change to policies and/or procedures should be documented and implemented as soon as possible thereafter

Question 16

What does the HSE electronic communications policy apply to

Answer 16

• All electronic communications, email, internet, intranet and fax services provided by the HSE
• All IT resources provided by the HSE
• All users (including HSE staff, students, contractors, sub-contractors, agency staff and authorized third party commercial service providers)
• All use (both personal & HSE business related)
• All connections to (locally or remotely) the HSE’s email, internet, intranet and fax facilities
• All connections made to external networks through the HSE network

Question 17

stipulations for personal use of HSE electronic communications (with line manager’s permission)

Answer 17

1. Is not excessive
2. Does not take priority over their HSE work responsibilities
3. It does not interfere with the performance and work of the user, other staff or the HSE
4. Does not incur unwarranted expense or liability for the HSE
5. Does not have a negative impact on the HSE in any way
6. Does not involve commercial activities, such as running any sort of private business, advertising or performing work for personal gain or profit
7. Is lawful and complies with this policy and all other relevant HSE policies

Question 18

HSE Electronic communications policy on personal use of email

Answer 18

• Make clear that the email is personal and not on behalf of HSE
• Words or actions do not have a negative impact on the HSE
• Only email facilities provided by the HSE may be used in connection with an individual users work for the HSE.
• Confidential or restricted information via email must not be forwarded from HSE email messages to their own personal third party web based email account.
• Users should ensure they keep their personal email messages separate from their HSE business related email messages.

Question 19

HSE electronic communications policy on internet use

Answer 19

• The HSE automatically filters internet access and blocks websites deemed to be inappropriate
• HSE smart devices aren’t filtered - users are held responsible for all connections made by that device
• Cannot install or use third party software on HSE devices
• HSE IP address is logged when visiting any website

Question 20

HSE electronic communications policy on social media use

Answer 20

• Social media is blocked on HSE devices/internet
• All use of social media (personal or otherwise), must be in accordance with the HSE Social Media Policy & Guidelines
• Never post/discuss confidential info on social media
• Speak in the first person
• Remarks made in the name of the HSE about individuals, organisations or groups which are of an offensive, derogatory or threatening nature on social media may result in disciplinary, legal or criminal action being taken.
• If you refer to the HSE as your employer in your social media biography, you should be mindful that you are publicly connecting yourself to your place of work.
• Having an opinion on topics in the public domain relating to the HSE is acceptable, but be mindful that any opinions or comments should be based on fact.
• Be mindful that your opinions will be monitored by the media who use social media as a research tool

Question 21

HSE tips from Social media policy

Answer 21

• Respect others’ views and opinions…do not engage in a public disagreement.
• Act professionally at all times.
• Be quick to correct your own mistakes and admit when you are wrong.
• Do not engage in conduct that would be viewed as unacceptable online.
• Do not engage with trolls whose aim is to engage you in negative conversation.
• Share information that you know to be true, be careful of fake news and sharing misinformation

Question 22

HSE electronic communications policy regarding fax

Answer 22

• Confidential and personal information should not be transmitted by fax
• Exceptions apply in case of emergency
• Cover sheet
• Double check fax number
• Minimal information
• Telephone before
• Keep copy of transmission slip
• Approval from Manager

Question 23

HSElive

Answer 23

• HSE’s social media team
• if you are contacted by a member of the public with a question, refer them to HSE live