ICO Provisional £6 Million Penalty for Software Provider Following NHS Data Breach

What Happened:

The UK Information Commissioner’s Office (ICO) has provisionally decided to impose a £6.09 million fine on Advanced Computer Software Group Ltd (Advanced) after a ransomware attack in August 2022.

This attack disrupted NHS and social care services and exposed the personal information of 82,946 people, including sensitive data such as medical records and home entry details for individuals receiving care.

The breach occurred when hackers accessed Advanced’s systems via a customer account that lacked multi-factor authentication.

Source

Related Resources:

The Employment Practices Code | UK ICO

Data Subjects Rights, Employment

Building a Cybersecurity and Privacy Learning Program | NIST | Initial Public Draft

Data Breaches, Employment, Risk Management, Technical and Organisational Measures (TOMs)

Guidance Note: Employer Vehicle Tracking | Irish DPC

Employment

How to deal with SARs as an employer by the UK ICO

Access Requests (DSAR), Employment

C-34/21

Employment, Specific processing situations

Data protection and monitoring workers

Employment, Specific processing situations

Protection of workers’ personal data: General principles by ILO

Employment, Specific processing situations

GenAI and data protection: how organisations and their employees can use it appropriately and lawfully

AI, Employment

Opinion on processing of CCTV data in regard to employee performance analytics by the Bulgarian DPA

CCTV, Employment, Specific processing situations

Everything Recruiters Need to Know About GDPR by ZOHO

Employment, Specific processing situations

[Draft] Guidelines on the processing of personal data in regard to recruitment by the UK ICO

Automated Decision-making, Controllers and Processors, Data Protection Impact Assessment (DPIA), Employment, Specific processing situations

[Draft] Guidelines on the processing of personal data in regard to employment by the UK ICO

Employment, Specific processing situations

GUIDELINES CLOCKING AND ATTENDANCE CONTROL PROCESSING USING BIOMETRIC SYSTEMS BY THE AEPD

Employment, Principles, Sensitive Data, Specific processing situations