British
and Irish Legal Information Institute
Freely Available British and Irish Public Legal Information
[
Home]
[
Databases]
[
World Law]
[
Multidatabase Search]
[
Help]
[
Feedback]
Irish Data Protection Commission Case Studies
You are here:
BAILII >>
Databases >>
Irish Data Protection Commission Case Studies >>
Case Study 17: O2 - Missing media tape [2012] IEDPC 17 (2012)
URL: http://www.bailii.org/ie/cases/IEDPC/2012/[2012]IEDPC17.html
Cite as:
[2012] IEDPC 17
[
New search]
[
Contents list]
[
Help]
Under the requirements of S.I. 336 of 2011, O2 notified the Office of a data security breach involving a missing backup media tape in July.O2 stated that the tape had been identified as missing by its service provider, IBM, in February. IBM had conducted searches for the missing backup media tape but was unable to locate the tape and notified O2 of the matter in May.In their notification to this Office, O2 stated that the data held on the media tape could only be accessed using the same technical equipment utilised to create the tape, which would cost in excess of €600,000.
We investigated this claim and found evidence contrary to the claim of O2. We then informed O2 of our findings, requested details of the type of data held on the backup media tape, and informed O2 of the need to notify affected individuals.O2 reverted stating that the backup media tape was created in August, 2011 and it no longer held records as to what was held on the media tape. It was therefore not in a position to identify the type of data held on the tape and the affected individuals.
We also sought an explanation as to the delay in notifying our Office of the data security breach. Under the obligations imposed by S.I. 336 of 2011, Telecommunications companies & ISP’s are required to notify both this Office and affected individuals without undue delay. O2 explained that they had not been notified by their service provider of the data security breach until 3 months after the issue was identified. The service provider during this time was carrying out searches for the missing media tape and analysing the potential issues. We informed O2 that this delay was unacceptable.
O2, as part of their report to the Office, provided two separate external forensic analysis reports on the backup media. Both of these reports examined the possibility of a third party gaining access to the data held on the missing media tape. Both reports stated that the data could not be accessed by an individual without access to proper equipment and technical expertise. O2 therefore argued that the data on the media was unintelligible, given the requirements to access the data.
However, this Office pointed out that both external reports supplied by O2 did note that the data could be accessed by a third party with sufficient resources. As the data was potentially accessible, Regulation 4(6)(b) of S.I. 336 of 2011 applied, requiring notification of affected individuals. The appropriate standard to be applied is not whether a member of the public could access the data, but whether the data could be accessed at all.
Whilst O2 disagreed with the views and interpretation of this Office, they agreed, as a matter of goodwill, but without any acknowledgement of liability or failure under the Data Protection Acts or S.I.336, to make a charitable donation and notify customers of the matter. As O2 were unable to identify specifically affected individuals, it was agreed that they would make a public announcement of the matter, via their website and press release. This announcement was made in early December. O2, as a gesture of goodwill, also made a charitable donation of €50,000 to Headstrong, a non-profit organisation supporting young people’s mental health.
To ensure that this type of data security breach did not occur again, O2 had undertaken a number of steps, including improved security and controls regarding the storage of media tapes. The Office also made a number of recommendations to O2, including the encryption of its backup media and that the contract between O2 and its third party service providers be amended to include a requirement for immediate notification of any potential data security breaches.