Irish Data Protection Commission Case Studies
You are here:
BAILII >>
Databases >>
Irish Data Protection Commission Case Studies >>
CASE STUDIES 2013 - Data Protection Commissioner - Ireland [2013] IEDPC 14 (2013)
URL: http://www.bailii.org/ie/cases/IEDPC/2013/2013IEDPC14.html
Cite as:
[2013] IEDPC 14
[
New search]
[
Contents list]
[
Help]
Breach Notification
On the 1st November, 2013, the Office received a data security breach notification from Loyaltybuild Ltd. in accordance with our Personal Data Security Breach Code of Practice. The notification informed this Office that encrypted credit card data had been compromised through an attack on its website.
Loyaltybuild Ltd is a company (data processor) who provides a service facilitating hotel getaway breaks that are offered as part of loyalty schemes run by its clients (data controllers).
The Office also received breach notifications from two data controllers in relation to the same matter.
On the 11th November 2013, Loyaltybuild Ltd updated their notification to inform the Office that credit card details (full card number, expiry date, card holder name and CVV code), in unencrypted format, and also contact details for customers who had made bookings through the Loyaltybuild website, had also been compromised. Data controllers across Europe were affected by the breach. Data was compromised to varying degrees, in some cases it included unencrypted credit card data, while in other cases it was confined to customer contact details.
For completeness of reporting on the investigation, this case study spans 2013 and the early months of 2014.
Actions taken by the Office - Inspection 12th November 2013, Enforcement Notice 13th November 2013, information campaign to affected individuals
An Inspection Team from the Office carried out a site visit of Loyaltybuild Ltd on the 12th November 2013. The Inspection team found serious issues regarding the security of data on Loyaltybuild’s systems and a lack of procedures to ensure that the data was protected and managed properly. Loyaltybuild advised that it had been inadvertently recording full credit card details in unencrypted format and that it was not a part of their recorded process.
On foot of the report of the Inspection Team, the Commissioner issued an Enforcement Notice against Loyaltybuild Ltd on the 13th November, 2013. The Enforcement Notice was part of a package of immediate actions undertaken by the Office to limit the affects of the data security breach.
The actions required by the Enforcement Notice were as follows:
- Loyaltybuild was required to notify all its clients about the security breach and advise them to notify affected individuals.
- Loyaltybuild was required to delete all personal data held for the purpose of providing services to its clients.
- Loyaltybuild was required to achieve PCI-DSS compliance in respect of its processing of payment card data, verified by an independent third party.
- Loyaltybuild was to implement a series of changes to its procedures to bring them in line with industry best practices.
- Loyaltybuild was not allowed process personal data until it had satisfied this Office that these requirements were being met.
The Office also liaised with a number of banks and the Irish Payment Services Organisation (IPSO) to determine the potential implications for affected individuals. Based on this information, we issued advice to individuals, both through the Office website and media interaction, to monitor their bank accounts and to ensure that they could identify all payments being processed against their debit / credit card and notify their card company of any unusual activity. Affected individuals were also warned to be wary of any unsolicited communication they received.
Loyaltybuild Ltd’s remedial actions in relation to procedures and policies
Loyaltybuild Ltd. has been in regular contact with the Office advising of its progress on the matters set out in the Enforcement Notice and has cooperated fully with the Office’s investigation.
In accordance with the requirement in the Enforcement Notice, Loyaltybuild Ltd employed a company to carry out its PCI Certification. On receipt of the Report of Compliance, this Office employed a further company to carry out a peer review of the report.
A further requirement was put in place that Loyaltybuild Ltd. engage a third party auditor to scrutinise its procedures and policies (choice of company to be subject to final approval by this Office). The Office consulted with that company to satisfy ourselves of their competence in respect of carrying out a system-wide audit and subsequently approved their use.
The requirements of the system-wide audit were set out by the Office and we met with the company to discuss the implementation of this audit. The audit will continue over a number of months in 2014. The company will provide us with regular updates.
A particular issue addressed by the Office was the handling of credit card payments. Our Inspection Team advised Loyaltybuild Ltd to consider alternative processes to retaining credit card details on their systems. Loyaltybuild Ltd. no longer stores credit card details. This process was verified by our Inspection Team. Instead of processing the credit card payments themselves, Loyaltybuild Ltd. will now pass the customer on to a third party processor’s website, which specialises in credit card payments.
A further visit by an inspection team to Loyaltybuild Ltd. in late January 2014 verified that the terms of the Enforcement Notice had been met, and the Commissioner lifted the Enforcement Notice to allow Loyaltybuild Ltd. to recommence processing personal data.
Data Controllers
The Investigation of the breach necessarily involved an assessment of any data protection issues in the relationship between the various data controllers with whom Loyaltybuild Ltd had contracts as a data processor.
Loyaltybuild had contracts with data controllers across Europe. This Office can only interact with data controllers based in this jurisdiction. However, we notified relevant Data Protection Authorities (DPAs) so that they could contact data controllers in their jurisdiction. Relevant DPAs were provided with regular updates on our investigation.
We found it necessary to focus on the contracts in place between the various data controllers based in this jurisdiction and Loyaltybuild Ltd.
The biggest issue we found among the data controllers we examined was a lack of understanding of their status as data controller, in relation to their customers who booked hotel breaks through the Loyaltybuild website. All the data controllers we spoke with initially believed that Loyaltybuild was the data controller. This Office explained to them their responsibilities as a data controller and that Loyaltybuild was a data processor in respect of the loyalty breaks offered by the companies. We explained that when the customer (data subject) booked a hotel break, they did so as a customer of the data controller and that Loyaltybuild was only a processor.
We looked at the contracts in place between the data controllers and Loyaltybuild under a number of headings;
- Did the contract specify ownership of data
- Did the contract specify a retention period
- Did the contract require compliance with DP legislation
- Did the contract specify appropriate security requirements
- Did the contract require confidentiality of data
- Did the contract restrict further processing
- Did the contract specify actions to be carried out on receipt of a Subject Access Request
- Did the contract specify the deletion of data
- Did the contract specify actions on termination of contract
- Did the contract allow for the right to audit the data processor
We found that in all cases there were issues with one or more of the above. We found that no Data Controller had set a Retention Policy, setting out the timeframe for holding data in respect of its customers.
ODPC also requested details on what “due diligence” had been carried out prior to awarding the contract. Again this Office identified issues with some data controllers who failed to carry out proper due diligence.
Along with the Enforcement Notice issued to Loyaltybuild, the Commissioner also issued Enforcement Notices to two Data Controllers on the 13th November 2013. These Enforcement Notices required affected individuals to be notified, detailing the nature of the data and the steps to be taken to secure their personal and financial data. They were also required to ensure that any data processor acting on their behalf that carries out financial transactions involving customers is PCI compliant as required.
Main Findings of Loyaltybuild Ltd Investigation:
- Loyaltybuild Ltd. failed to implement adequate security measures to protect the data it held on its systems
- Loyaltybuild Ltd. failed to implement proper procedures to manage the data it processed.
- Data Controllers were unaware of their role in the control of the data held on Loyaltybuild Ltd.’s systems.
- No Data Controller had set a Retention Policy, setting out the timeframe for holding data in respect of its customers.