Hi

I oversee a team who handle breaches as part of their job. For context, the team are info specialists and in the normal course of duties decide on exemptions and handle IRs and ICO/tribunal cases, usually without any need for further support from legal services or external counsel. They aren't employed as lawyers but some have a legal background. Whilst not considered 'senior' officers they are the council's info specialists.

They handle breach investigations and make recommendations. These they will discuss with each other and in many cases with me or next level up if the issue is a high profile one, but I don't officially sign off the majority of their work. They are autonomous in that respect. They also draft the policies and guidance on handling breaches. The officer assigned sees a case through investigation, recommendations, reporting (if appropriate) and follow up. As part of that they will discuss recommendations with the relevant service to ensure they fit the situation, but broadly speaking, their recommendations in the report are final. The only thing that we definitely discuss before they take action is whether to report to the ICO, although their recommendations in this are taken seriously.

Happy to discuss off group if that would help.

Victoria Blyth
Information Manager

Information Management Team
London Borough of Barnet, North London Business Park, Oakleigh Road South, London N11 1NP
Tel: 020 8359 2015
please consider the environment - do you really need to print this email?


-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Simon Howarth
Sent: 28 July 2014 12:24
To: [log in to unmask]
Subject: Re: [data-protection] Data Breach Handling - Who and How?

It really depends on your level in the organisation and the culture of that organisation.

The NHS has very predefined requirements for the handling of data breaches. After a risk assessment the breach is categorised and there are expectations (nationally) as to what will then be done. Google for the document entitled "Checklist Guidance for Reporting, Managing and Investigating Information Governance Serious Incidents Requiring Investigation".

I suppose to answer  your question, in my case at least, what I say goes. If it's a serious breach a "level 2" then I run a formal investigation with a panel and produce a report with recommendations that is signed off by the board. If it's less serious, the report is produced less formally but the recommendations are still to be carried out. This organisation takes these incidents very seriously though so there is no issue of recommendations being ignored. We also have a process to follow up completion of actions and report to our assurance board of success or failure.

Not sure if this helps you or not?

 

-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Andrew Goodfellow-Swaap
Sent: 28 July 2014 10:55
To: [log in to unmask]
Subject: [data-protection] Data Breach Handling - Who and How?

Good morning everyone,

Currently, in the local authority I work, data breaches are handled by yours truly in liaison with the relevant senior managment of the affected area. My role essentially consists of analysing the situation and advising on immediate and longer term actions that can/should be taken by the business in order to ensure that damage is mitigated and the chance of a repeat incident is minimised as far as possible. Basically I advise on what actions should be taken to maximise/ensure DPA compliance, among other things.

My question, to anyone who performs a similar function or oversees someone that does, is what level of responsibility does the colleague that handles data breaches possess when it comes to the advice they provide? Do they advise the business area directly or is their advice signed off/ratified by their line management before being given to the business area responsible for the incident?

Any and all answers gratefully received either on or off list.

Thanks

Andrew Goodfellow-Swaap

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     All archives of messages are stored permanently and are
      available to the world wide web community at large at
      http://www.jiscmail.ac.uk/lists/data-protection.html
     If you wish to leave this list please send the command
       leave data-protection to [log in to unmask] All user commands can be found at http://www.jiscmail.ac.uk/help/commandref.htm
 Any queries about sending or receiving messages please send to the list owner
              [log in to unmask]
  Full help Desk - please email [log in to unmask] describing your needs
        To receive these emails in HTML format send the command:
         SET data-protection HTML to [log in to unmask]
   (all commands go to [log in to unmask] not the list please)
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     All archives of messages are stored permanently and are
      available to the world wide web community at large at
      http://www.jiscmail.ac.uk/lists/data-protection.html
     If you wish to leave this list please send the command
       leave data-protection to [log in to unmask] All user commands can be found at http://www.jiscmail.ac.uk/help/commandref.htm
 Any queries about sending or receiving messages please send to the list owner
              [log in to unmask]
  Full help Desk - please email [log in to unmask] describing your needs
        To receive these emails in HTML format send the command:
         SET data-protection HTML to [log in to unmask]
   (all commands go to [log in to unmask] not the list please)
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This email and any attachments to it are intended solely for the individual to whom it is addressed. It may contain sensitive or confidential material and should be handled accordingly. However, it is recognised that, as an intended recipient of this email, you may wish to share it with those who have a legitimate interest in the contents.

If you have received this email in error and you are not the intended recipient you must not disclose, distribute, copy or print any of the information contained or attached within it, all copies must be deleted from your system.  Please notify the sender immediately. 

Whilst we take reasonable steps to identify software viruses, any attachments to this email may contain viruses which our anti-virus software has failed to identify. No liability can be accepted, and you should therefore carry out your own anti-virus checks before opening any documents.

Please note: Information contained in this e-mail may be subject to public disclosure under the Freedom of Information Act 2000 or the Environmental Information Regulations 2004.




^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

     All archives of messages are stored permanently and are

      available to the world wide web community at large at

      http://www.jiscmail.ac.uk/lists/data-protection.html

     If you wish to leave this list please send the command

       leave data-protection to [log in to unmask]

All user commands can be found at http://www.jiscmail.ac.uk/help/commandref.htm

 Any queries about sending or receiving messages please send to the list owner

              [log in to unmask]

  Full help Desk - please email [log in to unmask] describing your needs

        To receive these emails in HTML format send the command:

         SET data-protection HTML to [log in to unmask]

   (all commands go to [log in to unmask] not the list please)

    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^