On Monday this week, the ICO announced in the news section of its website that it has imposed an £18,000 fine on Scottish charity Birthlink, a charity specialising in post-adoption support and advice, for people who have been affected by adoption with a Scottish connection.
It maintained the Adoption Contact Register for Scotland, which allows adopted people, birth parents, birth relatives and relatives of an adopted person to register their details with the aim of being linked to and potentially reunited with other family members.
What happened?
In January 2021, Birthlink reviewed whether they could destroy ‘Linked Records’ due to limited physical storage at the charity. Those records contained files about individuals who had already been linked with the person they sought. Some included handwritten letters from birth parents, photographs, and copies of birth certificates. The Board agreed no barriers to the destruction of those records existed, but that retention periods should apply to certain files and only replaceable records could be destroyed.
Due to poor record keeping, specifics of what happened next are uncertain. But it is estimated in April and May 2021, it destroyed approximately 4,800 personal records, up to ten percent of which may be irreplaceable.
A Care Inspectorate inspection in August 2023 brought to the attention of the charity’s Board that irreplaceable items had in fact been destroyed as part of the overall record destruction and reported the incident to the ICO.
The full extent of personal data lost will never fully be known. But some people’s access to a part of their personal and family history and identities may have been permanently erased due to Birthlink’s systematic data protection failures. Handwritten letters and photographs from birth parents were amongst items destroyed.
Why did the ICO impose a fine?
Since March 2024, when the ICO published details of its current approach to imposing fines, the regulator had been adopting a ‘lighter touch’ when using its enforcement powers in response to data breaches such as this one. Often, the regulator chose to issue a public reprimand, instead of imposing financial penalties. The underlying rationale for that approach was that how removing funds from organisations such as charities and public sector organisations ultimately has a detrimental impact on individuals relying on the services and support from those organisations.
In this instance, the seriousness of the breach meant the ICO concluded a fine was appropriate.
What actions by the charity helped to mitigate?
Having considered representations from the charity, the ICO reduced the total amount of the proposed fine from £45,000 to £18,000.
Mitigating factors included how, since the breach occurred, Birthlink has implemented improvements, including
- digitally recording and storing all physical records
- appointing a Data Protection Officer, and
- initiating staff training.
Aggravating factors which lead to fine
- The ICO investigation found that, at the time of the breach, there was a limited understanding of data protection law at the charity. It had limited knowledge of data protection obligations
- Birthlink had not implemented relevant policies and procedures, lacking even easy-to-implement and minimum cost policies and procedures, which would likely have prevented the destruction.
- Nor had it appropriately trained its staff.
- Also, the ICO found that despite concerns being raised internally at the time when files including individuals photographs and cards were being shredded (an internal report of a suspected data breach, in other words) this was not properly investigated and instead the destruction continued.
- Furthermore, poor record keeping procedures meant that Birthlink were unable to identify people who had been affected by the breach.
Sally Anne Poole, Head of Investigations at the ICO, said:
“It is inconceivable to think, due to the very nature of its work, that Birthlink had such a poor understanding of both its data protection responsibilities and records management process… This case highlights – perhaps more than most – that data protection is about people and how a data breach can have far-reaching ripple effects that continue to affect people’s lives long after it occurs.
“Whilst we acknowledge the important work charities do, they are not above the law and by issuing and publicising this proportionate fine we aim to promote compliance, remind all organisations of the requirement to take data protection seriously and ultimately deter them from making similar mistakes.”
Broader picture: ICO expectations from organisations handling a data breach
The approach taken by the ICO is consistent with how, particularly during the past year, it has consistently called for better staff training on handling personal data, appropriate technical procedures within organisations, and prompt reporting – in particular from organisations providing services to people who may be in vulnerable situations and have had their personal data breached.
The ICO has always recognised that records of personal information are especially important to people such as those who have experience in care, given those records might contain information about individual’s personal childhood and history which they cannot recall themselves. In Scotland, the regulator has been engaging directly with local authorities to improve response times where it identified poor performance handling requests for care records.
Last year, the ICO also launched its Ripple Effect campaign. It aims to raise awareness of the human impact data breaches can have. It called on organisations using sensitive personal data to improve and recognise the critical importance data protection has in protecting people’s lives.
What should organisations do?
There is detailed guidance available on the ICO website to help organisations understand and comply with their obligations under data protection law.
Their free online resources include:
- easy to use self-service tools and helpful bitesize tips specifically aimed at small charities
- detailed records management and security guidance.
Navigator data protection services are available to help organisations improve their compliance, such as
- an initial compliance audit, using the Accountability Framework issued by the ICO
- bespoke training on data protection for staff, covering essential requirements of the regulator
- drafting or updating documentation, such as privacy policies to meet the ‘transparency’ requirements in the UK GDPR, and ‘appropriate’ internal policy documents, required to comply with data protection general principles and the specific requirements of the Data Protection Act 2018.
For further information about any of the services available from Navigator, contact Sean Morris, Legal Manager at sean.morris@navigatorlaw.co.uk