Help Hive mind GDPR help

[BristolEcho]

when there is so much actual internet crime going on. Attribution is next to impossible. To spunk so much money up the wall to protect what most people will willingly give away for an app that makes your face into a cat. Absolute waste of time.

What angle are you coming at this from? Are you in charge of people's data and would you have any reason for contacting ICO in your line of work?

 

[Saul Goodman]

Was the mac changed on the data? Shellbags. Open/save mru?

What was accessed?
By whom?
When ,for how long for?
What happened to that data, was it copied?

Make the assessment first.

What if someone were to boot the machine into Linux from a USB pen, then mount the drive read only and copy the data, how would you know it had been accessed?

 

[farmerbarleymow]

What angle are you coming at this from? Are you in charge of people's data and would you have any reason for contacting ICO in a professional line of work?

He's trolling I think.

 

[Boris Sprinkler]

What angle are you coming at this from? Are you in charge of people's data and would you have any reason for contacting ICO in your line of work?

I work in Security. GDPR tried finding its way onto my desk. Wasnt having it.

 

[Boris Sprinkler]

What if someone were to boot the machine into Linux from a USB pen, then mount the drive read only and copy the data, how would you know it had been accessed?

And then they would know something about someone.
Given how widely used social media is, i dont think minor things like this are worth a toss reporting to the authorities. There's some process stuff that needs updating and an idiot needs retraining.

 

[farmerbarleymow]

I work in Security. GDPR tried finding its way onto my desk. Wasnt having it.

good luck with that approach.

 

[alex_]

There is a lot of could, should here and few facts

this is what the ico wants when you report a breach

Personal data breaches

Reportable breaches have to put someone at risk

“When a personal data breach has occurred, you need to establish the likelihood and severity of the resulting risk to people’s rights and freedoms. If it’s likely that there will be a risk then you must notify the ICO; if it’s unlikely then you don’t have to report it. ”

 

[Athos]

There is a lot of could, should here and few facts

this is what the ico wants when you report a breach

Personal data breaches

Reportable breaches have to put someone at risk

“When a personal data breach has occurred, you need to establish the likelihood and severity of the resulting risk to people’s rights and freedoms. If it’s likely that there will be a risk then you must notify the ICO; if it’s unlikely then you don’t have to report it. ”

Ahem...

It's undoubtedly a data breach. Whether or not it's reportable will depend on the likelihood and severity of any consequences. Which, in turn, depends on what the data was, and who it was leaked to. Can you tell us that?

 

[Saul Goodman]

And then they would know something about someone.
Given how widely used social media is, i dont think minor things like this are worth a toss reporting to the authorities. There's some process stuff that needs updating and an idiot needs retraining.

People generally don't post their credit card details on Facebook.
Also, posting things to Facebook is voluntary. Having your private data leaked to a third party isn't, and failing to report it could land someone in a world of shit, not least the person whose data was leaked.

 

[fucthest8]

Well, you all fail.

We're the data processor, not the controller, so it's not even up to us to report the breach. Shan't be taking advice from any of you lot again!

Anyway, cheers for all the input, it was more that I wanted to provide the right advice to the customer.

Some of you though need to go take a course on assessing risk.

 

[fucthest8]

It's undoubtedly a data breach. Whether or not it's reportable will depend on the likelihood and severity of any consequences. Which, in turn, depends on what the data was, and who it was leaked to. Can you tell us that?

I can't say too much about what the data was and (see above) I actually need the customer to make that assesment. You deserved a response though.

Suffice it to say that we are talking about the details from one small organisation being leaked to another even smaller organisation, utterly unrelated. I think the likelihood of any consequences is extremely low, but the severity is probably medium.
Anyway, not my call!

 

[fucthest8]

Well I think we are all judging this on the incident that has been explained? The data could have been copied and even someone being able to view someone elses data is reportable in my experience.

The fact the second customer is aware would make me want to prove that I've done everything I can. If I was that customer and I knew about GDPR I would be expecting them to report it and potentially considering reporting it myself if they didn't.

I've reported to ICO by the way and have to handle a lot of people's sensitive data in potentially high risk situations in the community. Maybe I am just twitchy?

Fucthest your company must have a clear policy on this?

You also deserve a response. Yeah, we have a policy, which is - per the regs - what's the risk? Which was the part I was struggling with, per my OP "I want to believe that the "risk to people" is actually low ..." and having slept on it I still think it is.
Again though, not actually my call!

 

[Athos]

I can't say too much about what the data was and (see above) I actually need the customer to make that assesment. You deserved a response though.

Suffice it to say that we are talking about the details from one small organisation being leaked to another even smaller organisation, utterly unrelated. I think the likelihood of any consequences is extremely low, but the severity is probably medium.
Anyway, not my call!

Obviously you can't give the detail of the data, but in the broadest terms is it more like e.g. names and addresses, than, say, medical notes or bank details? (Severity)

Have you had any assurances from the receiver of the data re who's seen it at their end, and what's been done with it? (Liklihood)

 

[alex_]

Well, you all fail.

We're the data processor, not the controller, so it's not even up to us to report the breach. Shan't be taking advice from any of you lot again!

Anyway, cheers for all the input, it was more that I wanted to provide the right advice to the customer.

Some of you though need to go take a course on assessing risk.

This is wrong - you have a obligation to report it to the controller, possibly even a contractual one

 

[fucthest8]

This is wrong - you have a obligation to report it to the controller, possibly even a contractual one

See the part in the post you quote where I talk about providing advice to the customer?

Do some inferring. You can do it.

 

[Supine]

See the part in the post you quote where I talk about providing advice to the customer?

Do some inferring. You can do it.

You come across as a bit rude about all of this. It was your company that fucked up and you who asked for u75 advice.

 

[fucthest8]

Obviously you can't give the detail of the data, but in tune broadest terms is it more like e.g. names and addresses, than, say, medical notes or bank details? (Severity)

Have you had any assurances from the receiver of the data re who's seen it at their end, and what's been done with it? (Liklihood)

Yep, having recovered the drive yesterday and met with both customers, they* believe there is a very small amount of really sensitive data, but the likelihood of it having made it off the drive is low, vanishingly so. You'll just have to take my word for that, not going into even the vaguest details.

Customer whose data it is has made the decision not to report - yet - while we do forensics on what's been accessed to confirm what we've been told

Should be fine. Phew!

*The customer whose data it is