For front line staff, getting 3 pivotal areas understood and adhered can be the difference between GDPR compliance and breach.

1. Is all filing robust?
2. When, where and how is information used and shared?
3. Have all service users actively agreed to this?

Think about the following:

Filing
is everything that contains a personal name filed under lock and key?

• staff records
• service user records
• customer details
• supplier details
• invoices – purchase/sales
• what about laptops – are they encrypted?

Sharing of data
do you know in the ins and outs of how, when and where you share data?

• with whom
• by what method
• how shared data is stored
• how long shared data is kept for
• how shared data is destroyed
• what about?
  • telephone answer messages
  • online and cashless payment systems
  • data back ups
  • emails
  • what about any apps the organisation uses
  • what about any social networks use

Consent

• • have all service users been told about all of all of the above
  • have they agreed to it

If all staff, all honesty answer no to any of these questions you really do need to instigate update training on the latest rules and regulations relating to data protection, GDPR and PECR.

to be fully compliant every system procedure, process, project and initiative needs to assessed to ensure privacy is maintained at every stage. As a bare minimum every member of staff needs to think about the above questions and point out where things may be going wrong.

Our training courses on data protection, GDPR, PECR and Privacy Impact Assessments help.

Following the appointment of John Edwards as the new Information Commissioner we are expecting changes in strategy, direction, guidelines, rules and regulations that impact on data protection, the UK-GDPR and the UK-PECR.

We are keeping a close eye on changes and will incorporate them into our data protection related courses as the appear

Whilst most of the headline news around GDPR/PECR relates to data breaches analysis of action and fines by the Information Commissioners Office (ICO) shows that most breaches are down to human error; poor understanding of data protection laws and poor practice; bad judgments and naivety remain the most common drivers behind breaches.

It is imperative that management and data protection teams keep up to date with the all the changes as they occur. Embed them in their policies and procedures and cascade to staff.

Regular update training for all is a low cost way to stay compliant and avoid the huge fines that apply in the event of GDPR/PECR breaches.

Check out our courses here. Prices start at just £285+vat for a group of 14.

Most people will have heard of the GDPR, but what about the PECR? Do you what it is or how high the fines for breaching it can be?

Unfortunately ignorance isn’t a suitable defence and most penalties for breaches of the GDPR and PECR can be attributed to staff errors. Poor or no knowledge of the regulations, insufficient understanding of what they, personally, need to do to meet the legislation. Poor quality, incomplete or missing privacy impact assessments or just laziness or it’s too much effort attitude and approach to privacy.

Concrew Trainings courses on GDPR and PECR bring these potentially dry dull and boring subjects to life and help participants understand why every company and every individual needs to understand fully the latest requirements for data protection.

Our courses start at just £285+vat for 14 people. The cost is miniscule relative to the fines the ICO hands out.

Well we would say that now wouldn’t we: ………………………..

Check out these recent ICO fines:

Mermaids Charity– 08 July 2021
The Information Commissioner’s Office (ICO) has fined transgender charity Mermaids £25,000 for failing to keep the personal data of its users secure.

Brazier Consulting Services – 01 July 2021
The Information Commissioner’s Office (ICO) has fined Leeds-based Brazier Consulting Services Ltd (BCS) £200,000 for making unlawful claims management calls.

ColourCoat Ltd – 23 June 2021
£130,000 fine for multiple breaches of Regulations 21 and 24 of the PECR.

Global One 2015 Charity – 15 June 2021
fined £10,000 for sending unsolicited direct marketing messages

Papa Johns (GB) Ltd – 15 June 2021
fined £10,000 for sending nuisance marketing messages to its customers.

OK, I hear you say, but it won’t happen to us………….. We are too large/professional/organised/etc/etc

What about the recent names fined in the last 12 months

The Conservative Party MPN
The Information Commissioner’s Office (ICO) fined the Conservative Party £10,000 for sending marketing emails in the name of RT Hon Boris Jonson MP to people who did not want to receive them.

American Express Services Europe Limited
Direct marketing messages were sent by, or at the instigation, of American Express Services Europe Limited. These messages contained direct marketing material for which subscribers had not provided adequate consent. Fined £72,000

Marriott International
The ICO fined the hotel chain Marriott International Inc. £18.4million for failing to keep millions of customers’ personal data secure.

British Airways
The Information Commissioner’s Office (ICO) fined British Airways (BA) £20m for failing to protect the personal and financial details of its customers.

Singapore subway by Jim used under CC BY-SA 2.0