The Central Young Men’s Christian Association (Central YMCA) – €8,775 Fine (United Kingdom, 2024)

The Central Young Men’s Christian Association (the controller) offers a Positive Health Programme (Programme), which is an exercise scheme for people living with HIV. As part of the Programme, the Central YMCA collects special categories of data including referrals, dates of HIV diagnosis, medications taken, medical statistics, referring hospitals or clinicians and other medical history. On 6 October 2022, a coordinator of the Programme sent an email to a mailing list of 270 recipients. The recipients were entered into the carbon copy (CC) function rather than the blind carbon copy (BCC) function, revealing the email addresses of all 270 recipients. The controller became aware of the breach the following day upon receiving complaints from affected data subjects. Upon realising the error, the coordinator attempted to unsend the email, but unintentionally sent a second email to all 270 recipients with the email addresses again entered in the CC function. Accounting for duplicates, 264 email addresses were disclosed in the breach, of which 115 had clear names and 51 had partial names that made them potentially identifiable. Thus, 166 data subjects were affected by the breach. The controller reported the breach to the Information Commissioner’s Office (ICO) on 7 October 2022. On 10 October 2022, the controller notified the affected data subjects, took accountability of its error and informed data subjects of the steps it was taking. At the time of the breach, the controller had a verbally communicated policy that the Programme staff should send event invitations using the BCC function. The controller had access to an email marketing tool which would permit for the sending of individual emails to each recipient, but it did not use this tool in sending emails relating to the Programme. The controller waived its opportunity to respond to the ICO’s Notice of Intent and instead accepted the Notice and the ICO’s findings. It took remedial steps, conducting an audit of how external communications were being undertaken across the organisation and issuing new procedures to provide appropriate guidance on sending secure emails. The controller also updated its data protection training. The ICO found that the controller violated Articles 5(1)(f) and 32 UK GDPR. It issued a monetary penalty of €8,730 (£7,500) as well as a reprimand. The ICO found that the breach resulted from serious deficiencies in the controller’s technical and organizational measures, demonstrating violations of Articles 5(1)(f) and 32 UK GDPR. First, the controller had access to an email marketing platform which would have reduced the likelihood of an inappropriate disclosure. However, it failed to use this tool for Programme emails even though it had the financial and organizational means to do so. The use of BCC sending instead was a high-risk method of sending emails due to human error. Given this risk, the ICO considered it irrelevant whether or not the policy requiring this practice was written down. Second, the controller did not provide data protection training specific to employee roles or levels of access to personal data. In this case, the coordinator was a self-employed contractor. The controller’s policy had been to provide training only to employees, and the coordinator had thus not completed any data protection training. Even after the policy changed and training was extended to contractors, the coordinator was still not trained. Third, the controller did not effectively monitor completion of data protection training. At the time of the investigation, 27% of the controller’s workers – including the coordinator who sent the incident email – had not completed the data protection training. Finally, the controller’s data protection training was deficient. The ICO found considerable lack of awareness concerning data protection legislation within some parts of the organisation; for example, employees initially did not consider the breach a concern because the email contained no private information. Initially, the ICO considered that a penalty of €349,000 (£300,000) would be appropriate to reflect the seriousness of the breach. However, taking into account the ICO’s action on previous cases and new policy on imposing monetary penalties, the ICO reduced the fine to €8,730. In calculating the penalty, the ICO took account of the controller’s four-day delay in notifying data subjects of the breach, negligence causing the infringement, remedial measures taken, responsibility of for the breach’s occurrence, lack of previous infringements, cooperation with the ICO and the high sensitivity of the data. Given that the emails were clearly directed at individuals with HIV, the ICO determined that the incident involved a special category of data or at the least carried a risk of inference that may be considered sensitive. It considered the violation serious due to the sensitivity of the personal data involved.