This Regulation imposes a legal obligation on providers of publicly available electronic communications networks or services to notify thisOffice of a personal data security breach, no later than 24 hours after thedetection of the breach, where feasible.
The Service Provider informed us that one of its customers, who was amember of an organisation, while reviewing histelephone bill via the Provider's on-line facility, noticed that he hadaccess to the details of bills of over 400 other members of the same organisation. On becomingaware of the incident, the Service Provider quickly removed a sharedbilling code that linked a limited number of accounts related to members of the organisation on the ServiceProvider's billing system.
The Service Provider informed us that it was able to confirm from thecustomer's log-in details that he had access only to customers' name,surname, mobile number and six months call records. We were informed thatthe customer did not have access to the individuals' financial details oraddress details.
The root cause of the incident was identified as being a customer serviceagent applying a shared billing code via the administration systems. Wewere informed that the agent incorrectly set up the shared billing coderesulting in the accounts being linked in error and making theindividual who accessed the data the master account holder.
The Service Provider confirmed that it was informing all individualsaffected by the incident. The Service Provider also informed theindividuals that the matter had been rectified and had ensured that asimilar incident would not occur again.
This case demonstrates how the speed at which a breach is identified anddealt with may assist in minimising the overall security risk of thebreach. Informing the affected individuals of the matter permits them toconsider the consequences for each of them individually and to takeappropriate measures as they see fit. The reporting of the matter to us byData Controllers as speedily as possible, as per the above legislation,also assists in our role of trying to improve compliance with DataProtection legislation.