ICO alerted after technical ‘issue’ exposed college files to student barristers

Data breach

The college did not confirm how many students had been able to access the files to date.

“The ICCA experienced a data breach in August 2023,” said Russell. “Due to a technical issue, certain registered students submitting search requests in their [email protected] email accounts were returned results that included some files from the ICCA’s staff-only SharePoint site.

“As soon as the issue became known, immediate action was taken to secure the files affected,” he added.

The Information Commissioner’s Office has also confirmed it was notified of the breach and that it is considering its next steps.

An ICO spokesperson said: “The Council of the Inns of Court has made us aware of an incident and we are assessing the information provided.”

Russell said the data breach was contained within the college institution and that it did not pose a “high risk” to affected individuals’ “rights and freedoms”.

“The ICCA fully investigated the breach and verified that no financial data or log-on/password data was accessed,” he said.

Written undertakings

Russell said: “It has been able to determine that no personal data was shared beyond our institution, although some files were accessed by a very small number of ICCA students. We contacted those students who did access files and have received written undertakings from them that any data they may have viewed has not been shared with other parties, and never will be in future.

“Once the full facts of the breach were established, and after consulting with external IT and GDPR experts, the ICCA completed a thorough risk assessment,” he said.

Russell added that by applying the relevant tests, it was concluded that the matter did not represent a high risk to the “rights and freedoms” of those individuals affected.

“Nevertheless, and in the interests of transparency and candour, the ICCA proactively notified all those whose data had been viewed of the details of the breach,” he said.

GDPR obligations

Data protection lawyer Dai Davis told Computer Weekly the significance of the college claiming the data breach did not pose a “high risk” meant the college did not then have to notify all students whose data had been compromised.

Under the General Data Protection Regulation (GDPR), the college was under no obligation to contact all individuals whose data may have been viewed, but was obliged to contact the ICO.

“The college has stated that it has nevertheless notified those whose data the college is aware were ‘viewed’,” he said.

“But since the college has stated merely that the nature of the breach was a ‘technical issue’, one cannot determine whether this means all the individuals whose data had been accessed have been contacted.”