Cyber Security and Privacy goes Nuts

This week we read about Gloucester City Council and how they were the subject of a suspected Russian hacker attack using Sleeper Malware that affected their systems on 20^th December and which to date has resulted in other government institutions blocking mail from Gloucester’s systems.

Food giant KP (Crisps & Nuts) suffered an intrusion on 28^th January that caused it to stop production and shipping.

It was also reported that in January 2022, 95 data breaches had resulted in the Personally Identifiable Information of a staggering 66,000,000 people being leaked.

You can find out if you have been subject of a data breach on this website. www.haveibeenpwned.com

For those of us who watch the industry there was really nothing new to learn. Why innovate when established methods of attack work so effectively? However, the really interesting outcome of these breaches is not even the massive fines being imposed by the Information Commissioners Office as we reported back at the end of 2021, but how the legal industry has jumped on the bandwagon. Data Breach claims by ambulance chasing solicitors are really on the up.

In Warren vs DSG Retail Ltd. (2021) DSG were successful in having the misuse of private information and breach of confidence claims dismissed as DSG had taken any positive steps itself to consider if it had misused the personally identifiable information. However, Warrens claim under the Data Protection Act 2018 was allowed to continue. Though moved from the High Court to County Court to reflect the likely value of the claim.

In Johnson Vs Eastlight Homes an inadvertent leak of not particularly sensitive PII caused Eastlight Homes to report itself to the ICO, who decided upon no further action. The Court decided that the claims for Misuse of Private Information, Breach of Confidence, Negligence, Breach of article 6 of the ECHR and Breach of the GDPR and DPA meant that all of the ancillary claims didn’t really add anything to the breach of DPA which meant that the Claims of £3000 wasn’t worthy of the £15,000 costs already incurred and additional £50,000 budget for proceeding with the case. The court gave further warning that these trumped up claims would not be looked upon favourably.

So it seems likely that going forward businesses involved in these Data Breach Claims can expect a more clear cut action being taken by claimants and at individual claims values low enough not to contest if covered by and insurer