Apps targeted at Children removed from the App Store for failing to have a privacy policy
Following on from the ICO’s Children’s Code which has now come into effect (you can read our full breakdown for what this means for your school here), a recent study from Pixalate has shown some worrying statistics that have come out of a host of apps that Apple and Google have delisted from their respective app stores, most of which are targeted at children. In total there were over 813,000 apps delisted, with over 86% of them targeted at children aged 12 and under.
Some worrying statistics from Google’s delisted apps saw that 66% of the apps had ‘dangerous permissions’, 27% could access their user’s location, and scarily 19% could access the camera. A lack of privacy policy seems to be one of the main reasons for apps being delisted however, with 60% of Apple’s delisted apps from China failing to have a privacy policy in place to protect users’ data, and 26% of Google’s delisted apps in Russia also not having one in place.
The report highlights once again how much of a push there needs to be to protect children’s personal information when online, and how key the ICO’s Children’s Code must be going forward with Third Parties being key players in ensuring the safety of children’s data.
The full report by Pixalate can be found here.
Apple’s new software update is a great step forward in allowing users to take control of how their personal information is being used
Following on from the story above, Apple appears to be the industry leader in ensuring their user’s personal information is being protected from those who wish to use it without our permission.
Apple’s new IOS15 builds on the previous year’s groundbreaking changes as far as data privacy is concerned, by providing numerous improvements that allow users to control how their personal information is shared with third parties. A new privacy menu will break down the data that different apps have about you, and what permissions you have given them. It will then be able to tell you how many times each app has accessed, for example, your microphone or camera.
Another key change is aimed at preventing email tracking, with iOS 15 now allowing users to open marketing emails to prevent their location and the time they opened the email from being shared with the sender. One other piece of security that comes with iOS 15 is that when users open Safari, they will be given a privacy report which tells you how many times Safari has prevented trackers from profiling you and hidden your IP address from known trackers in the last 7 days.
The privacy updates that come with Apple’s new OS will be a welcome improvement to users and it’s great to see a company like Apple who holds personal information for 100’s of millions of people treat data privacy as seriously as they are, particularly with the increase in cyber attacks that are taking place, more of which can be read here.
A record £42 million in ICO fines for 2020/21
A study conducted by a law firm named RPC has found that fines for data protection breaches by the Information Commissioner’s Office have risen in the past financial year by 1580%, with a record £42 million worth of fines being handed out. A large percentage of this amount however represents only two high profile cases, where British Airways were fined £20 million as a result of a cyber-attack that left the personal data of 429,612 customers and staff at risk in 2018.
The other large profile case was that of Marriott International Hotels, who were fined £18.4 million due to a weakness in their security which saw the information of 339 million (yes, 339 million) guests being exposed. What is perhaps even more eye-opening than seeing the sum of these huge fines, is that they could have been even bigger. The ICO cited the COVID-19 pandemic, and the subsequent economic pressure it has put on both businesses as reasons for their more lenient fines.
Once again cyber attacks seem to be a key threat and a catalyst for the record fines we are seeing, and the higher-profile cases of British Airways and Marriott International Hotels can be good examples of illustrating the importance of ensuring cyber security protocols are put in place in schools to best protect data and personal information.
A recent study conducted by Check Point Research which can be found at the bottom of this article has found that there has been a 29% increase in cyberattacks on organisations in the education sector since 2020, the highest increase of any sector.
With such a worrying statistic, we thought it was worth highlighting the study’s findings to illustrate how cyberattacks are becoming an increasingly dangerous threat to schools and the personal data they are responsible for, and what can be done to best protect against these threats. Due to the pandemic, organisations particularly in the education sector were forced to change to a mostly remote workforce. Schools worldwide were then needed to adapt their infrastructure so that employees could work from home effectively.
Unfortunately, this means that educational providers such as Universities and Schools are at the highest risk they’ve ever been of cyber attacks in 2021, and explains why the education sector is seeing the highest increase in weekly cyber attacks worldwide, over and above any other sector’s increase. A frightening case study that is noted in the article is that the Department for Education in Australia’s New South Wales have recently experienced a cyber attack which resulted in their entire online platforms being shut down just days before remote learning was due to start at the beginning of their new school term.
The Check Point points out some other worrying statistics that their study has found regarding the risk cyber attacks pose to the education sector in particular. As of July 2021, the education sector has not only experienced the highest percentage increase of attacks in the last year, but also now has the highest volume of weekly attacks, with an average weekly number totalling 1,739. Whilst the study shows that the most target countries are India, Italy and Israel, it’s worth noting that the UK has seen a 93% increase in weekly attacks in July 2021 compared to the first half of 2021, with the education sector in particular in the UK seeing a 142% increase in that same time.
The study conducted by Check Points highlights the increasing threat posed by cyberattacks and the risk it poses to personal data. With the education sector in particular being targeted at such a high rate, we all must take the necessary steps to mitigate that risk as much as we can.
Data Protection Education provides various tools to help manage your risk from cyber attacks, that can be used as part of your mitigation strategy. These focuson the management and human elements and should be I place alongside the recommended resilience and security from your IT provider. These include our phishing simulation tool, information security policies, business continuity plans, off-the-shelf risk assessment, software/systems ad supplier due diligence and of course, our info-sec e-learning.
The full article along with some graphs that can help visualise just how much the cyber attack threat has increased in the education sector, and in the UK in particular can be found here.
The Children’s Code
The first update from the ICO is that the transition year for the introduction of The Children’s Code (also known as The Age Appropriate Design Code) has passed, with the code having come into effect on September 2nd. For those unfamiliar with The Children’s Code, it imposes restrictions on how online services that are accessed by children under 18 (despite whether children are their target audience or not) are allowed to use their personal data.
Read more ...
The National Cyber Security Centre has today upgraded it's advice to schools relating to the prevalence of cybers attacks in the sector:
https://www.ncsc.gov.uk/news/alert-targeted-ransomware-attacks-on-uk-education-sector
"The NCSC continues to respond to an increased number of ransomware attacks affecting education establishments in the UK, including schools, colleges, and universities.
This report details recent trends observed in ransomware attacks on the UK education sector. This encompasses trends observed during August and September 2020, as well as the more recent attacks since February 2021. It also provides mitigation advice to help protect this sector from attack.
This alert is designed to be read by those responsible for IT and Data Protection at education establishments within the UK. Where these services are outsourced, you should discuss this Alert with your IT providers.
It is also important that senior leaders understand the nature of the threat and the potential for ransomware to cause considerable damage to their institutions in terms of lost data and access to critical services
Due to the prevalence of these attacks, you should be sure to follow NCSC’s mitigating malware and ransomware guidance. This will help you put in place a strategy to defend against ransomware attacks, as well as planning and rehearsing ransomware scenarios, in the event that your defences are breached."
DPE has a range of resources to help you with cyber attack prevention. Whilst, your IT department is key to success in this area in relation to technical security measures in place, we focus on the more human factors involved in cyber risk.
Firstly, we recommend that all users complete the NCSC's "Stay Safe Online" course, available on the Knowledge Bank. Additionally, we have a range of information security e-learning nuggets for increasing awareness.
Secondly, we recommend that schools review and consider working towards a Cyber Essentials Plus certification. The questionnaire is available on the Knowledge Bank. This covers the technical and human elements of cyber prevention.
Thirdly, we are preparing a Cyber Security best practice area, with resources and links to other guidance. This will also incorporate our main tool for cybersecurity preparation - our Phishing Simulation tool. This will be available to school immediately after Easter and will allow you to test your organisational resilience to phishing attacks.
If you have any questions, concerns, or if you have been subject to a cyber-attack please contact us immediately.
We've looked at the importance of an adequacy decision to allow the free-flow of data between the United Kingdom and Europe in our earlier articles on Brexit. Finally, although in reality quite quickly, we have a decision - with draft adequacy decisions from the European Commission. If approved, this would mean that data can continue to flow uninterrupted following the ending of the bridging period which ends on June 30 2020.
Here's the important bit from the GDPR decision:
"The Commission has carefully analysed the law and practice of the United Kingdom. Based on the findings developed in recitals (7) to (264), the Commission concludes that the United Kingdom ensures an adequate level of protection for personal data transferred within the scope of Regulation (EU) 2016/679 from the European Union to the United Kingdom."
Interestingly, there was another decision relating to data transfers under the Law Enforcement Directive regarding data for law enforcement. Of interest in both draft decisions, are that they will have looked at the UK's Investigatory Powers Act 2016 (which allows data collection for national security purposes). This was always going to be a hurdle, but it looks like it has passed - though the European Data Protection Board may look again.
It is likely that there is a balance in the operation and enforcement of the Information Commissioner's Office...which also likely means that as long as we seek to have adequacy, there will be a data protection regulator and similar standards to what we have now. In fact, the EU can monitor the progress of any divergence from EU data protection law and reverse the decision if any divergence is problematic.
Assuming at this stage the adequacy decision is upheld (the rapidness mentioned earlier suggests as much a political decision as anything), then we may see challenges in court, just as the data transfer mechanisms with the USA have been challenged in court and found to be unlawful. It may be a bumpy ride... The other issue is that with the fallout of Schrems II (the collapse of Privacy Shield) we are unlikely to see any unilateral mechanism for data transfers from the United Kingdom to the USA. So for the time being, we rely on the standard model classes that are being widely adopted.
Purely from a data protection perspective!
There are various provisions around data in the UK-EU Trade and Cooperation Agreement.
The most important for data protection and GDPR relates to adequacy, as discussed in our earlier Brexit blog. In short, the agreement does not make a determination on adequacy, but what it does say is that for the "Specified Period" (a sort of transition period after the transition period) that transfers of personal data from the EU to the UK will not be considered transfers of personal data to a third country during this period and therefore will not be prohibited by the GDPR. This period lasts four months and can be extended by another two months.
The hope (though not guaranteed) is that the UK will be granted adequacy during this period.
As for other adequate countries (which allow transfers of data from the EU), the UK is adopting that list and data transfers will be allowed.
The ICO issued the following statement:
“This is the best possible outcome for UK organisations processing personal data from the EU.
This means that organisations can be confident in the free flow of personal data from 1 January, without having to make any changes to their data protection practices.”
As we all know, on 31 December 2020, the Transition Period (sometimes also referred to as the “Implementation Period”) under the EU-UK Withdrawal Agreement will come to an end. And one of the areas still in the mix is data protection, so what is the status now and what changes?
Firstly, the GDPR isn't going away. It is enshrined in our local law - in this case, the Data Protection Act 2018 and the Information Commissioner's Office and the UK Government have stated that they are committed to maintaining its provisions.
What happens if there is no deal?
The UK has so far stated that nothing changes internally. And there will be no restrictions on data leaving the UK. And any changes only apply to data processed on or following the 1st January 2021 - any processing up to 31st December 2020 are unaffected and current rules apply.
The problem comes in two ways. Firstly - where is the destination of the data? And secondly - what about data coming into the UK.
Destination of the data
So leaving the EU not only affects data to and from the UK and the European Economic Area (where data can flow freely), it also affects the destinations that have an adequacy agreement or other data sharing protocols with the EU.
What does that mean? Well, just like the GDPR and DPA18 provides safeguards for an individuals data, adequacy and other tools provide equivalent safeguards in those destination countries, meaning data can flow freely. The list with adequacy probably isn't as long as you'd think:
Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland and Uruguay.
But when we leave, and if there is no deal and no adequacy agreement, then we have no legal protocols in place to recognize those safeguards anyway.
The big one in data protection matters is of course the US. And as with all the other countries not on the adequacy list (such as India or Australia), how can we safely transfer data?
In most cases, we use something called standard contractual clauses. These are published by the EU, to be added to a contract and builds the safeguards into the contract. In the case of the US, there have been other safeguards - originally Safe Harbor, then Privacy Shield. Both allowed the US FCC oversight of data protection in the businesses that signed up to them. But they have both been invalidated by the Court of Justice of the European Union. So the big American tech companies, now either rely on consent, or where controller-processor relationships exist, then standard contractual clauses.
We have standard contractual clauses embedded with our processor in the US. So we are OK?
The issue here is that the standard contractual clauses reference EU law. Also, the ones provided by the ICO were based on the 1995 Data Protection Directive, not the 2016 GDPR, so they are out of date anyway. And any organisation relying on them in the UK it referencing EU law and EU protections that no longer apply at the end of the transition period. We have recommended for some time that standard contractual clauses should reference UK law, not EU - the meaning of the clauses provide the safeguards, but the laws backing them up must be the law of the land.
What about data coming back into the UK?
This really is where the trouble starts. An organisation in the EEA (even a data processor) requires a lawful basis and safeguards to transfer data to the UK. Adequacy would provide that, but otherwise, they need under GDPR to have the standards contractual clauses that reference EU law. Which means that a data controller in the UK doesn't get it's data back unless it agrees on a contract that cedes control to EU jurisdiction. Seems unfair? Well, we voted to leave and if we want to continue working with organisations in the EU, then we still have to play by their rules. It makes contracts complicated as the legal context would have to reference the UK and EU laws. UK for the UK-based data controller and the EU standards contractual clauses for the EU-based processor.
What about where we have data coming back to the UK, but not from the EEA?
In these cases, the same issue applies. Your data process may agree to the standard contractual clauses and the safeguards they provide. But under what jurisdiction are they enforced? It's always been the problem with any agreement. Take the US for example, you can have a contract saying all safeguards are in place - but if the NSA wants access to your processor's data, then your contract won't mean much.
In any case, those contracts, if referencing EU law will be technically invalid on January 1st 2021.
We'll get an adequacy agreement, won't we? Didn't we implement the GDPR after all?
You would hope so, but it's tied up in the negotiation. Technically, you can't have an adequacy decision granted as a member of the EU - we've left and the transition period was supposed to sort this out. At the moment it's up in the air, both because it is a bargaining chip and a little thing called the Investigatory Powers Act 2016. That allows (following judicial approval) interception of (often bulk) communications. It's supposed to be targeted but allows bulk interception. And as it's all top secret, we don't really know what communications are being collected and analyzed. But we know it's at the very least a consideration in the evaluation of an adequacy agreement.
Data Protection rights all propagate from the European Convention on Human Rights - and the UK government hasn't exactly supported their full implementation in UK law, meaning data protection and other rights are subject to change.
What does the ICO say?
The ICO is for the time being, following the European Data Protection Board's(EDPB) lead on the revision of standard contractual clauses (it's yet to be seen if they will issue "UK" versions. The EDPB is currently evaluating the CJEU decisions and cases on Privacy Sheild and standard contractual clauses. But we aren't part of that regime from 2021. I doubt we will digress too far from any decisions - the ICO will still want to maintain as much parity as possible with the EU, for the time being at least. But in their last statement in November there is no indication about these safeguards in a post-Brexit world:
“We are reviewing the two recommendations published by the European Data Protection Board (EDPB) following the CJEU Schrems II ruling in July. The judgment confirmed how EU standards of data protection must travel with personal data when it goes overseas.
“The first recommendation updates the European Essential Guarantee for surveillance measures.
“The second has been published for public consultation and looks at the extra measures organisations may take to support the international transfer of data to meet EU standards, and is out for public consultation.
“This recommendation follows previous EDPB guidance stating that organisations must conduct a risk assessment as to whether a transfer tool, such as Standard Contractual Clauses (SCCs), provides enough protection within the legal framework of the destination country. If not, organisations must put extra measures in place to mitigate the risks.
“The Schrems II judgment said that supervisory authorities have an important role to play in the oversight of international transfers. As part of this role we are reviewing the recommendations and will consider whether we need to publish our own guidance in due course.
“We are also reviewing the European Commission’s new GDPR SCCs currently under consultation.
“We reiterate our advice that organisations should take stock of the international transfers they make, and update their practices as guidance and advice become available.
“We continue to apply a risk-based and proportionate approach to our oversight of international transfers in accordance with our Regulatory Action Policy.”
With the fall of Privacy Shield and challenges to standard contractual clauses continuing in European courts the message from the ICO is that where possible use standard contractual clauses. But as in the latest communication, there may need to be a risk assessment undertaken and additional safeguards implemented. But no-one really knows what additional safeguards that you would put in place, other than avoiding data to that location.
Which brings us on to the best way of dealing with the impact of Brexit on data protection.
Keep your data in the UK. In most cases, this is what's happening with education products. And the ICO says that complying with the GDPR is the best preparation, even if you have no international data transfers.
The notable exceptions are Microsoft and Google, which most schools use at least one of. Microsoft hosts its data in the UK, and have but earlier in 2020 stated that:
"Due to the unprecedented circumstances around the COVID-19 crisis and the need to manage online services demand in Europe, if your organization is an educational institution, we may provision your Microsoft 365 tenant in the European Union (EU), European Free Trade Association (EFTA), the United Kingdom (UK), United States (US), or Canada (CA), or transfer your data to any data centers in the EU, EFTA, UK, US, or CA..."
Whilst that doesn't seem to be the case right now, it shows that they will change the terms if it suits them.
As for Google, it's in the G Suite for Education (Online) Agreement:
"Google may transfer, store and process Customer Data in the United States or any other country in which Google or its agents maintain facilities. By using the Services, Customer consents to this transfer, processing and storage of Customer Data."
So using cloud services, there is at least a chance that data leaves the UK. Both Microsoft and Google were certified under Privacy Shield and operate standard contractual clauses - and operate secure systems. In reality, there is little risk. But the risk of transfer out of the UK doesn't matter when the company is a US entity - the Clarifying Lawful Overseas Use of Data Act (2018) or CLOUD Act is a US law that allows federal law enforcement to compel U.S.-based technology companies to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil - so your data is within reach.
This is where the ICO's advice to assess risk is important. We can't operate without accepting a certain amount of risk. In relation to Brexit, that risk is mitigated where we can use UK based companies and keep data in the UK. Where it goes to the EU, we can use standard contractual clauses. Where it goes somewhere else, we can use variations of the clauses to contractually oblige other parties to apply an appropriate level of safeguards, but still where the US is concerned to have no choice but to tolerate certain risk.
At DPE as we work through the records of processing and document more processing and suppliers we'll be ensuring that the risk levels are documented. We use this tool to document international data transfers too and assess risk levels. Life will be easier with an adequacy agreement, but it doesn't make everything easier. Schools operate in the UK with UK data subjects (unless you are an overseas school that targets staff and students abroad - contact us in that case). The most important thing we can do to prepare is to continue with the compliance journey and ensuring we follow the best practice available. The risks around international data transfers may have changed, but they have always existed.
If you have suppliers outside of the UK that you are concerned about or any questions, then get in touch and we will help with documenting on the RoP and undertaking the appropriate risk assessments.
The Data Protection Education Team
Download our latest flyer:
