The Information Commissioner, John Edwards, has issued a warning call that organisations need to do more to help people affected by data breaches. Citing new figures published by the Information Commissioner’s Office (“ICO”) indicating that some 30 million people have had their data lost or stolen, Edwards urged organisations to take action to prevent data breaches having a “ripple effect” that further disrupts the lives of those affected in ways that might not always be appreciated.

Edwards expressed alarm not only that 30% of victims of data breaches report experiencing distress as a result, but also that a quarter say that they have received no support from the organisation involved. What is more, almost a third of those affected by a breach stated that they found about it not from the organisation itself but from the media, something Edwards says only deepens the sense of distrust and betrayal.

The message from Edwards is stark: organisations must do better. He states that “too many organisations fail to fully appreciate the harm they cause when they mishandle personal data. When a data breach occurs, it’s not just an admin error – it is a failure to protect someone. In many cases if that someone is in a vulnerable situation, they are already facing innumerable personal challenges, or they may be at risk of harm”.

As for how organisations should improve, Edwards points to new guidance from the ICO which stresses the importance of combining empathy with action, calling upon organisations to do the following:

• Promptly assess the risks to the individuals involved, including your reporting and notification duties.
• Acknowledge what has happened with the person affected by a breach.
• Be human and accessible in your response and commit to making sure it doesn’t happen again.
• Share the ICO’s simple guidance with people affected by a breach.
• Share the ICO’s toolkit of resources with your staff to help change the culture and ensure that empathy is at the heart of your response.

More information can be found here, including a link to resources recently published by the ICO on this subject.