ICO criticises ‘disappointing attitude’ of dementia charity » Charity Digital News

ICO criticises ‘disappointing attitude’ of dementia charity

The Information Commissioner’s Office (ICO) has found serious failings in the way volunteers at The Alzheimer’s Society charity handled sensitive personal data.

It has ordered the national dementia support charity to take action after discovering that volunteers were using personal email addresses to receive and share information about people who use the charity, storing unencrypted data on their home computers and failing to keep paper records locked away.

Furthermore, volunteers were not trained in data protection, the charity’s policies and procedures were not explained to them and they had little supervision from staff.


Website hack

As well as issues around the security of personal data, the charity’s website was hacked earlier in 2015, putting at risk around 300,000 email addresses, 66,000 home addresses, phone numbers and some birth dates.

The ICO made a series of recommendations in the wake of the attack and the Society implemented most of them. But the charity did not undertake manual checks of its website, a practice the ICO believed to be crucial in detecting vulnerability. The enforcement notice now requires them to do that.

The ICO has made other recommendations that the charity has failed to implement fully. In 2010 it agreed to a series of security measures after several unencrypted laptops were stolen during an office burglary. And it has been the subject of two audits – in March 2013 and March 2014 – which made recommendations about data security.

If the charity does not comply with the enforcement notice it could face prosecution.

The failings concerned a group of 15 volunteers recruited in 2007 to help dementia sufferers and their families or carers seek NHS healthcare funding. Between them, and over a seven-year period, they handled 1,920 cases. As part of their role they drafted reports including sensitive information about the medical treatment, care needs and mental health of the people they were trying to help.

Head of Enforcement Stephen Eckersley said: “In failing to ensure volunteers were properly supported, this charity showed a disappointing attitude towards looking after the very sensitive information that people trusted them with.”


Measures taken

In response to the ICO’s notification, Brett Terry, Director of People and Organisational Development and Senior Information Risk Owner at Alzheimer’s Society, said: “We have taken a number of steps to build on and improve our technology systems and processes to ensure that we meet and exceed both ICO guidance and industry standards.

“As an organisation, we exist to support the most vulnerable in society. We take this responsibility, which includes data protection, extremely seriously. We want to reassure our supporters and wider stakeholders that every measure is being taken to ensure their data is kept safe.”

Related reading

GDPR slide
Platypus Control-R