Lincolnshire poachers

Dark times in the Fens, as Lincolnshire County Council finds itself in the grip of diabolical cyber-blackmailers who demand £1,000,000 to release the local authority from the grip of a terrifying new strain of virus that has locked up all their files. As ever, it’s unwise to judge the outcome before all of the details are in, but Lincolnshire’s story has some interesting aspects. One element seems to go in Lincoln’s favour: this is “zero-day malware“, the first time that the particular infection has been detected. This obviously would make it harder to defend against, and in any case the Council is “confident it had appropriate security measures in place“.

The Council’s chief information officer Judith Hetherington-Smith reassured residents with the claim that they were “absolutely looking after their data and it hasn’t been compromised”. This implies that no personal data has been compromised, but this can’t be entirely squared with some of Hetherington-Smith’s other comments. For example “Once we identified it we shut the network down, but some damage is always done before you get to that point – and some files have been locked by the software” Right, so there’s some damage then? “A lot of the files will be available for us to restore from the back-up.” A lot of them but not all of them? What about the ones that aren’t available?

That back-up is interesting, in the light of the fact that “People can only use pens and paper, we’ve gone back a few years.” An inherent part of information security is business continuity, ensuring that even if something falls over, the place can keep running. I’m running a course this week for people responsible for risk-managing big information systems, and the client has specifically asked me to emphasise the need for business continuity to be built in. The whole point of this is not to be knocked back to the pen and paper age – I heard a report on Radio 4 that Lincolnshire’s social workers had not had access to systems for several days, which means those charged with protecting the most vulnerable in Lincolnshire don’t have access to information they need to do their job. If this information isn’t “compromised“, then I don’t know how else you would define it. It’s a catastrophe. Rather than attempting to reassure (I’m amazed that no-one has said that they take Data Protection very seriously), the council needs to explain why they are offline for days without a back-up that allows essential systems to keep running.

But the most interesting part of the story, and the element that is most crucial for deciding whether Lincolnshire has breached the Data Protection Act is how the infection got into their systems in the first place. Forget the eye-catching ransom demand, the terrifying challenge of the previously unseen virus, forget even the question of why the Council has no alternative option when attacked than blindness and pens & paper. How did it happen, you cry? How did these cunning cyber-ninjas drip their deadly poison despite all of Lincolnshire’s “appropriate security measures“?

Somebody opened an email. 

I don’t know how good Lincolnshire’s technical security is: however sceptical I might be,  there may be good reasons why they could not mirror their systems or back them up in such a way that they could not be restored more quickly. Nevertheless, everything that the Council has said or done since the incident, even if their claim that no data has been compromised is true (I don’t believe them, but OK), is irrelevant. The fundamental question is why their staff are capable of falling victim to the dumbest, most basic security attack known to humankind. I just hope they don’t get any emails about the frozen bank accounts of the late Dr Hastings Kamuzu Banda. The Lincolnshire incident was entirely, wholly preventable, and they have to explain both to the Information Commissioner and to the fine folk of Lincolnshire why they allowed this to happen.

I have said it a thousand times, and here I am saying it again. An incident is not a breach. In order to have complied, Lincolnshire’s “appropriate security measures” have to include regular training and reminders, specifically warning about threats like malware in emails. Managers have to regularly check how their staff are working and whether they are following the clear, widely disseminated procedures and policies that would be necessary in order to comply. Audits would have to be in place, and the individual systems that Lincolnshire has had to switch off should have been assigned to named asset owners, who are responsible for actively assessing risks entirely like this one, and putting measures in place to keep them running even in the face of attacks.

If the person who opened the email has not been trained, reminded and appropriately supervised, this whole incident is Lincolnshire County Council’s fault and they should be taken to task for it. It doesn’t matter how sophisticated the software was, how unexpected Lincolnshire might be as a target: THEY LET THE BURGLARS IN. All the warm words about what happened after that, even if they’re all true, make no difference to this basic fact. You may say that an organisation can’t prevent human error, but that’s nonsense. Training, reminders, appropriate supervision and picking the right people in the first place massively reduce human error. Everything that happens afterwards is damage limitation: either Lincolnshire did what was required beforehand, or it’s a breach.

The Gamekeeper’s Fear of the Penalty

Amongst the hype over the end of negotiations over the new EU Data Protection Regulation, one theme kept emerging again and again: Big Penalties. It’s understandable that people might want to focus on it. The UK goes from a maximum possible penalty of £500,000 to one of just under £15,000,000 (at today’s Euro conversion rate) or even 4% of a private enterprise’s annual worldwide turnover. Only a fool would say that it wasn’t worth talking about. It’s much more interesting than the bit about Codes of Practice, and it’s easier to explain than the section about certification bodies.

It would be equally foolish to assume, however, that penalties on this scale will rain down from Wilmslow like thunderbolts from Zeus. At the same time as many were talking up the future, the Information Commissioner issued two monetary penalties under the current regime, one under Data Protection (£250 for the Bloomsbury Patient Network) and one under the Privacy and Electronic Communications Regulations (£30,000 for the Daily Telegraph). The £250 penalty is the lowest the ICO has ever issued for anything, while the PECR one is the lowest for a breach of the marketing rules, notwithstanding that the Daily Telegraph is probably the richest PECR target at which the ICO has taken aim.

You could argue that the embarrassment caused to the Telegraph carries an added sting (the ICO has never before taken enforcement action against a newspaper). It’s equally likely that the oligarchs who own the paper will consider £30,000 (£24,000 if they pay up in 35 days) to be a price worth paying if it had the desired effect on the outcome of a very close election. They’ll probably do it again.

In any case, the Bloomsbury Patient Network CMP is much worse. The Regulation calls for monetary penalties to be effective, proportionate and dissuasive, and yet everybody at the ICO thought that a £250 penalty, split between three people, was action worth taking and promoting. The Commissioner himself, Christopher Graham told the DMA in March 2015 that the ICO was not a ‘traffic warden‘, but if the Bloomsbury Three pay up on time, the £66.67 penalty they each face is no worse than a parking ticket you didn’t pay in the first fortnight.

The ICO’s press release claims that the penalty would have been much higher if the data controller had not been an ‘unincorporated association’, but this is irrelevant. The ICO issued a £440,000 PECR penalty against two individuals (Chris Niebel and Gary McNeish) in 2012, while the Claims Management Regulator recently issued a whopping £850,000 penalty against Zahier Hussain for cold calling and similar dodgy practices. The approach on PECR and marketing is positively steely. The problem clearly lies in Data Protection enforcement, and that is what the Regulation is concerned with.

The size and resources of the offending data controller are a secondary consideration; the test is whether the penalty will cause undue financial hardship. The ICO could bankrupt someone or kill their business if they deserved it. The Bloomsbury Patient Network’s handling of the most sensitive personal data was sloppy and incompetent, and had already led to breaches of confidentiality before the incident that gave rise to the penalty. Enforcement action at a serious level was clearly justified. Even if the level of the penalty was high enough to deter well-meaning amateurs from processing incredibly sensitive data, this would be a good thing. If you’re not capable of handling data about a person’s HIV status with an appropriate level of security, you have absolutely no business doing so at all, no matter good your intentions are. Donate to the Terence Higgins Trust by all means, but do not touch anyone’s data. If the ICO lacks the guts to issue a serious penalty, it would be better to do nothing at all and keep quiet, rather than display their gutlessness to the world.

Whoever made this decision cannot have considered what message it would send to organisations large and small who already think of Data Protection as pettifogging red tape, low on the agenda. Is there an organisation anywhere in the country that would consider the slim chance of being fined £66.67 to be a deterrent against anything. A fine is a punishment (it has to cause pain to those who pay it) and it is a lesson to others (it has to look painful to the wider world). The Bloomsbury Patient Network CMP is neither.

Despite the increased expectations raised by the GDPR, the ICO is actually losing its appetite for DP enforcement, with 13 Data Protection CMPs in 2013, but only 6 in 2014 and 7 in 2015. Meanwhile, there have been 24 unenforceable DP undertakings in 2015 alone, including one against Google which you’re welcome to explain the point of, and another (Flybe) which revealed endemic procedural and training problems in the airline which are more significant than the moronic cock-ups that went on at the Bloomsbury Patient Network. Wilmslow is so inert that two different organisations have told me this year that ICO staff asked them to go through the motions of self-reporting incidents that ICO already knew about, because the only way the enforcement wheels could possibly begin to turn was if an incident was self-reported. ICO staff actually knowing that something had happened wasn’t enough. It’s these same timid people who will be wielding the new powers in 2018.

Admittedly, there will be a new Commissioner, and it’s possible that the Government will pick a fearsome enforcement fiend to go after Data Protection like a dog in a sausage factory. You’ll forgive me if I don’t hold my breath. Nevertheless, something in Wilmslow has to change, because the General Data Protection Regulation represents a clear rebuke to the ICO’s DP enforcement approach.

Most obviously, in the long list of tasks in Article 52 that each Data Protection Authority must carry out, the first is very powerful: they must “monitor and enforce” (my emphasis) the application of the Regulation. Someone recently said that in certain circumstances, some organisations require a ‘regulatory nudge’, but the Regulation is much more emphatic than that. The ICO’s preference for hand-holding, nuzzling and persuading stakeholders (especially those where former ICO colleagues have gone to work) is a world away from an enforcement-led approach.

The huge increase of penalties throws down the gauntlet, especially when the ICO has rarely approached the current, comparatively low UK maximum. But the ICO should also pay close attention to the detail of Article 79 of the Regulation, where the new penalties are laid out. Of the 59 ICO monetary penalties, 57 have been for breaches of the 7th principle (security). The Regulation has two levels of penalty, the lower with a maximum of €10,000,000 (or 2% of annual turnover), and the higher with a maximum of €20,000,000 (or 4% of annual turnover). Breaches of Article 30, a very close analogue to Principle 7, is in the lower tier.

Admittedly, the higher penalty applies to all of the principles in Article 5 (which in a somewhat circular fashion includes security), but it explicitly covers “conditions for consent“, “data subject rights” and infringements involving transfers to third countries, areas untouched by the ICO’s DP penalty regime. The Regulation envisages monetary penalties at the higher level for processing without a condition, inaccuracy, poor retention, subject access as well as new rights like the right to be forgotten or the right to object. The ICO has issued a solitary penalty on fairness, and just one on accuracy – it has never fined on subject access, despite that being the largest single cause of data subject complaints.

The Regulation bites hard on the use of consent and legitimate interest, and misuse of data when relying on them would again carry the higher penalty. Most organisations that rely on consent or legitimate interest are outside the public sector, who rely more on legal obligations and powers. Indeed, the Regulation even allows for the public sector to be excluded from monetary penalties altogether if a member state wishes it. Nevertheless, since they got the power to issue them, only 24% of the ICO’s civil monetary penalties have been served on organisations outside the public sector (2 for charities and 12 for private sector).

I doubt the ICO is ready for what the Regulation demands, and what data subjects will naturally expect from such a deliberate attempt to shape the enforcement of privacy rights. The penalties are too low. The dwindling amount of DP enforcement is based almost exclusively on self-reported security breaches. While the Regulation might feed a few private sector cases onto the conveyor belt by way of mandatory reporting of security breaches, it will do nothing for the ICO’s ability to identify suitable cases for anything else. Few ICO CMPs spring from data subject complaints, and anyone who has ever tried to alert Wilmslow to an ongoing breach when they are not directly affected knows how painful a process that can be. The ICO has not enforced on most of the principles.

It’s been my habit whenever talking about the Regulation to people I’m working for to emphasise the period we’re about to enter. There are two years before the Regulation comes into force; two years to get ready, to look at practice and procedure, two years to tighten up. The need to adapt to the future goes double for the Information Commissioner’s Office. Instead of canoodling with stakeholders and issuing wishy-washy guidance, wringing its hands and promising to be an ‘enabler’, the ICO should take a long hard look in the mirror. Its job is to enforce the law; everything else is an optional extra. It’s wise to assume that the wish for total DP harmonisation will probably be a pipe dream; it’s equally obvious that the Regulation will allow for much easier comparisons between EU member states, and the ICO’s lightest of light touches will be found wanting.

Underwhelming

The Information Commissioner has published the latest in a long line of undertakings, this time involving Northumbria NHS Trust. As always, the ICO’s press release is very misleading about what has really happened. This time, the notice has been ‘issued’, a word clearly intended to imply that the Trust had no choice in the matter. Recent undertakings have also purported to be “rulings“. However, the Information Commissioner has two powers to enforce the Data Protection Act, and the undertaking isn’t one of them.

Where the ICO identifies a serious breach of the DPA that was likely to lead to serious harm, and which the organisation could have prevented, they can issue a civil monetary penalty – it’s not technically a fine, although that’s the shorthand that most people use. In security cases, the breach is often the lack of training, the lack of management supervision, the lack of procedures or checks. It’s entirely possible for the ICO to issue a CMP without an incident (a loss or a theft of data), but they currently seem to lack the imagination to accomplish this. The CMP is a punishment – even if everything that was wrong has been put right, the ICO can still issue the penalty.

The other power that the ICO has is the Enforcement Notice. Here, there is no direct punishment, only the threat of prosecution if the notice is not complied with. The crucial difference between a CMP and an enforcement notice is that with the latter, the breach must be ongoing. The staff have not been trained, the laptops remain unencrypted, crucial and risky procedures are undocumented and unchecked. If an organisation refuses to undertake the steps required to put things right, an Enforcement Notice is plainly the tool to use. It’s possible – and logical – for the ICO to use either or both, depending upon the problem. They did both with Powys Council in 2011, for example. There could be a particularly heinous breach (CMP) which the organisation still hasn’t rectified (EN).

Neither of these problems is solved by an undertaking, a measure that is not even mentioned in the Data Protection Act. Put simply, an undertaking is the ICO asking the organisation to make a public promise that they will put things right and do better next time. If an organisation does not do what it has promised to do, there are no immediate consequences. If the ICO found an undertaking that had been ignored, they could do nothing other than issue an Enforcement Notice. Nothing is triggered by the failed undertaking in itself, whereas failure to comply with an Enforcement Notice leads to prosecution. There are people who think that the undertaking is a bargain to snapped up – if you refuse to sign, an enforcement notice or CMP will be winging its way from Wilmslow. But think about what that means: the ICO thinks they could make the case for a CMP, but is letting the organisation off the hook. Do you believe that? Alternatively, the ICO thinks that there is a significant ongoing breach (an Enforcement Notice cannot be issued if the identified breach has already been dealt with), but is choosing to trust an organisation that has already cocked it up to sort it out because they’ve been asked to. Which is nice.

I can see what’s in it for the ICO. Their investigations advance at a glacial speed (I have spoken to data controllers who have dealt with enforcement for years on a single case), and the ICO’s reputation for being risk averse and indecisive is richly deserved. Going for an undertaking closes the case. Asking the organisation to sign an undertaking does not require the ICO to identify a breach that is sufficiently serious to survive scrutiny by the Tribunal, should the data controller decide to appeal, so rather than making a firm decision, the undertaking allows for woolly compromise. Crucially, the ICO can still announce the undertaking as if they have actually made a decision – DP people will tweet and comment, there will be some stories in the IT and local press, and overall, the impression of action will have been created.

However, I don’t understand how the undertaking is anything but a kick in the teeth for the cooperative organisation: they don’t need to be cajoled with an enforcement notice and don’t deserve a CMP. If the ICO thinks the organisation will do it without being forced to do it, would they really risk a tribunal appeal on an Enforcement Notice that the data controller might already have complied with? And on the other side, would they really risk letting a recalcitrant or unwilling data controller off with a glorified press release instead of a CMP or an enforcement notice? If an unsigned undertaking might result in a CMP, is there any evidence that any of those that have actually received an undertaking were first offered a CMP and refused it? And if not, why not? Why were they immediately punished, but all the undertaking recipients not?

I can see only two possibilities – the ICO lacks the confidence to enforce when they should be doing (which is possible), or the ICO does not want to admit that it has spent months on a hiding-to-nothing case where the incident is more eye-catching than the breach. Wilmslow’s senior staff still have a real problem telling incidents and breaches apart, and the undertaking allows them to make a move without ever really deciding. If they offer your organisation an undertaking, they’ve already decided that they don’t have the evidence or the serious breach for a genuine exercise of their powers.

Don’t get me wrong, I have no problem with those that breach the DPA receiving CMPs and Enforcement Notices: I’m all for it. The absence of enforcement on fairness, dodgy re-use and selling of data, inaccuracy and failed subject access is a scandal. But for an organisation that hasn’t breached the DPA sufficiently badly to warrant a CMP, and who has put the problems right (or is clearly willing to do so), the undertaking is a PR exercise for the ICO. It is not an order, it is not a requirement, it is a request. You can say no.

Whoops!

Yesterday, after at least a year of pondering it, the Information Commissioner asked the Universities and Colleges Admissions Service (UCAS) to sign an undertaking, agreeing to change the way in which they obtain consent to use students’ data. The data is obtained as part of the application process and subsequently used for marketing a variety of products and services, and UCAS has agreed to change its approach. It’s important to note that this is an undertaking, so UCAS has not been ordered to do anything, nor are there any direct consequences if they fail to do what is stated in the undertaking. An undertaking is a voluntary exercise – it is not served, it does not order or require, it simply documents an agreement by a Data Controller to do something.

Aspects of the story concern me. The ICO’s head of enforcement is quoted as saying: “By failing to give these applicants a clear option to avoid marketing, they were being unfairly faced with the default option of having their details used for commercial purposes” but given that the marketing was sent by text and email, the opportunity to “avoid” marketing is not what should have been in place. If UCAS wanted to sell access to university and college applicants, they needed consent – which means opt-in, not opt-out. As the undertaking itself points out, consent is defined in the EU Data Protection Directive as freely given – an opt-out cannot constitute this in my opinion. If you think that an opt-out does constitute consent, try transposing that thinking into any other situation where consent is required, and see how creepy your thinking has suddenly become. Consent should be a free choice, made actively. We should not have to stop commercial companies from texting and emailing us – the onus should be on them to make an attractive offer we want to take up, not on consumers to bat away their unwanted attentions.

It’s entirely possible that the ICO’s position on consent is better expressed in the undertaking itself, but here we have a little problem. At least when it was published yesterday, half of the undertaking was missing. Only the oddly numbered pages were published, so presumably the person who scanned the document had a double-sided original and didn’t notice that they had scanned it single-sided. The published document also included one page of UCAS’ covering letter and the final signed page of the undertaking, which the ICO never normally publishes. This mistake reveals some interesting nuggets that we wouldn’t normally know, from the trivial (the Chief Executive of UCAS signed the undertaking with a fountain pen, something of which I wholeheartedly approve) to the potentially significant (the covering letter sets out when UCAS might divert resources away from complying with the undertaking).

But that’s not the point. The point is that the ICO uploaded the wrong document to the internet, and this is not the first time it has happened. I know this because on a previous occasion, I contacted the ICO to tell them that they had done it, and many people on my training courses have also seen un-redacted enforcement and FOI notices on the ICO website. The data revealed in the UCAS case is not sensitive (although I don’t know how the UCAS Chief would feel about her signature being published on the internet), but that’s not the point either. The ICO has spent the last ten years taking noisy, self-righteous action against a variety of mainly public bodies for security slip-ups, and the past five issuing monetary penalties for the same, including several following the accidental publication of personal data on the internet.

The issue here is simple: does the ICO’s accidental publication of this undertaking constitute a breach of the 7th Data Protection Principle? They know about the risk because they’ve done it before. Have they taken appropriate technical and organisational measures to prevent this from happening? Is there a clear process to ensure that the right documents are published? Are documents checked before they are uploaded? Does someone senior check whether the process is being followed? Is everyone involved in the process properly trained in the handling of personal data, and in the technology required to publish documents onto the web? And even if all of these measures are in place, is action taken when such incidents are identified? If the ICO can give positive answers to all these questions, then it is not a breach. Stuff happens. But if they have not, it is a breach.

There is no possibility, no matter how hilarious it would be, that the ICO will issue a CMP on itself following this incident, although it is technically possible. What should happen is that the ICO should quickly and effectively take steps to prevent this from happening again. However, if the Information Commissioner’s Office does not ask the Information Commissioner Christopher Graham to sign an undertaking, publicly stating what these measures will be, they cannot possibly speak and act with authority the next time they ask someone else to the same. Whether they redact Mr Graham’s signature is entirely a matter for them.

UPDATE: without acknowledging their mistake, the Information Commissioner’s Office has now changed the undertaking to be the version they clearly intended to publish. One wonders if anything has been done internally, or if they are simply hoping that only smartarses like me noticed in the first place.

Out of control

Heralded by an annoying quiz that seemed to bamboozle everyone who tried it (and which has mysteriously vanished from the website *UPDATE* it can be found here), the ICO has issued new guidance on data processors. It is called, with admirable brevity, ‘Data controllers and data processors: what the difference is and what the governance implications are’. The problem it aims to solve is mentioned early on:

We are producing this guidance because of the increasing difficulty organisations can face in determining whether they or the organisations they are working with have data protection responsibility

I’m not entirely sure the guidance is any help. Let’s take one of the examples from the second part of the guidance: the market research company. Despite the fact that the organisation which contracts the Market Research company “retains overall control of the data in terms of commissioning the research and determining the purpose the data will be used for” (i.e. does what a data controller does), the ICO guidance decides that the research company is the data controller because it decides which customers to select and what questions to ask. The research happens only because the client wants it to, and only to find out what the client wants to know, but somehow, 2 + 2 makes 5 and the research company is a data controller. The same is true – apparently – for third party payment handling companies, for IT services companies (the example used is a third party doing vehicle monitoring on behalf of a car hire company), for accountants, and solicitors. As soon as a data processor does anything beyond the laborious following of technical instructions, the ICO sees them as controllers.

This is wrong, and it is stupid. In all of these examples, the client decides what data will be processed and why, and their contractor does the work on their behalf. The ICO is not skilfully negotiating what it calls the “complexity of modern business relationships”, something that few of the ICO’s staff ever experience unless they leave Wilmslow. It is turning white into black, and with consequences.

Following the ICO’s train of thought, if organisations want to share data with a lawyer, a solicitor, a market research company, an IT services company, they are obliged to tell data subjects that their data is being shared. This is what happens when one data controller shares data with another. They must identity a condition for processing the data – e.g. consent, or a legal obligation. You might think this sounds like it is the data subject’s interests and perhaps a good thing, but there’s more.

A data controller decides who to share data with. It determines the level of security, the retention period and the purposes for which the data will be used. Your market research company may choose to retain your customer data and use it for other projects. Your solicitor or accountant may chose to sell your customer data to claims management companies. A data processor that retains or reuses its client’s data without the client’s consent is likely to commit a criminal offence. A data controller that decides how to use data that it holds – even if received from someone else – is simply doing what a data controller does. The ICO’s view of market research companies is particularly eccentric given that they have previously ordered organisations to retrieve data from market research companies under FOI, on the sound reasoning that the market research company held the data solely for the organisation’s purposes.

But this is not the punchline. I’ve blogged several times about the ICO’s apparent blindness to the existence of the Royal Mail and courier companies. They’ve finally been good enough to publish their position. Couriers are neither controller or processor because “Processing personal data, including holding it, implies a degree of access to or ability to control or use the data itself, not just physical possession of the letters or parcels that contain the data”. I completely disagree with this proposition. The extended definition of processing includes ‘transmission’ and ‘destruction’, both of which can be carried out without access to the data concerned.

However, let us assume that the author is correct. Couriers are in “physical possession of the mail but may not open it to access any personal data or other content”. The same is true of an archiving company, which does not even move data from A to B, but simply takes delivery of a sealed box and returns it or destroys it without access to the data. The same is true of specialist IT firms that destroy hard drives and other data storage by means of physical destruction (for example, using the industrial guillotine promised but not delivered by the data processor in the NHS Surrey case, the identity of which the ICO insists on keeping secret). The Data Protection Act does not put couriers into this state of limbo, so the ICO have to explain why their interpretation applies to couriers but not other types of organisations who are in exactly the same situation.

This is important because the ICO has in the past served civil monetary penalties totalling more than £500,000 on organisations for breaches involving data processors who fit the same bill. In both cases, Brighton and Sussex University NHS Trust and NHS Surrey received their penalty because they did not have proper contracts with data processors who were in “physical possession of the drives but “may not open it to access any personal data or other content”. In both cases, an errant data processor sold hard drives instead of destroying them. Just as the Royal Mail handles sealed envelopes, these processors handled physically sealed drives. Opening the envelope without permission is exactly the same as connecting the hard drive to read its contents. But according to this new guidance, the Royal Mail is not a data processor and failure to have a proper contract is no breach, but hard drive renderers are data processors and failure to have a proper contract is a breach with a price of £200,000 – £325,000.

A wise person pointed out to me recently that it’s important to know what the ICO thinks, even when they’re wrong. That’s true, but only so you can argue with them properly. In the end, this is only guidance, and it doesn’t change the law. I imagine the Tribunal will make mincemeat of it should the ICO ever be foolhardy enough to base any action on its contents, but I doubt it will ever come to that. Should you wish to read advice on data processors, track down the old ICO guidance (called ‘Identifying Data Controllers and Data Processors’, and dated 14/03/2012). It’s a little bit laborious but only because whoever wrote it shows real awareness of the murky territory they were trying to navigate. It’s still good, balanced guidance and for all practical purposes has not been superseded by the new one. Until someone notices and corrects what I can only assume the intern has done, tread carefully.

UPDATE: Thanks to C.Miller in the comments for pointing out where the missing quiz can actually be found.