Child sexual abuse inquiry fined £200,000 for exposing victims

The Independent Inquiry into Child Sexual Abuse (IICSA) has been fined 200,000 for a data leak that identified possible abuse victims.

With a remit to investigate historic allegations of sexual abuse, the IICSA has been penalised after a staff member sent a mass email to 90 participants in its inquiry, by mistakenly entering their email addresses into the 'to' field instead of the 'bcc' field.

The incident occurred on 27 February 2017 - prior to the introduction of the General Data Protection Regulation (GDPR), which came into force on 25 May - meaning UK data watchdog the Information Commissioner's Office (ICO) delivered the penalty under the Data Protection Act 1998. Under GDPR the fine could have been much higher.

"This incident placed vulnerable people at risk, which is concerning. IICSA should and could have done more to ensure this did not happen," said the ICO's director of investigations, Steve Eckersley.

"People's email addresses can be searched via social networks and search engines, so the risk that they could be identified was significant."

Informing the inquiry participants about a public hearing, an IICSA staff member initially sent an email containing an error, with all 90 addresses marked in the 'bcc' field. Attempting to correct the error, the staff member sent a follow-up email, but this time marked all recipients in the 'to' field - meaning their identities were exposed to all.

Of the addresses revealed, 52 contained the full names of the participants or had a full name label attached - many of whom may have been victims of child sexual abuse. The IICSA was alerted to the mistake by a recipient who added two further email addresses into the 'to' field before pressing 'reply all'.

The IICSA attempted to rectify the breach by asking all recipients to delete the initial email and to resist circulating the email any further. According to the ICO, one of these messages generated 39 'reply all' emails.

The investigation concluded that the abuse inquiry failed to use an account capable of sending separate emails to each participant, and it had not adequately trained staff on the importance of double-checking into which field an email address was entered.

The ICO also found that the IICSA should not have relied on advice from an IT company it had hired to manage the mailing list, which claimed that it would prevent individuals from replying to the exposed list. Most concerningly, however, the abuse inquiry breached its own privacy notice by sharing participants' email addresses with the IT company without their consent.

A total of 22 complaints came the ICO's way following the incident, with one complainant remarking that he was "very distressed" by the breach.

"The inquiry takes its data protection obligations very seriously and we have apologised to those affected by the data breach," IICSA secretary John O'Brien said.

"After a wide-ranging review by external experts, we have amended our handling processes for personal data to ensure they are robust and the risk of a further breach is minimised."

The 200,000 fine represents one of the largest fines handed to an organisation for a breach in the UK, with the maximum fine that can be levied under the DPA worth 500,000 - Facebook received this for its recent Cambridge Analytica data-sharing scandal.

If the case had been adjudicated under GDPR, however, the IICSA would have found itself open to a maximum fine of 20 million.

Picture: Shutterstock