Social Events & Meetings
Defend your business against the biggest cause of data breaches: human error
GDPR is now in full swing, enabling the Information Commissioners Office (ICO), to levy large fines for breaches or for failing to take proper care of customer and personal data. The biggest cause of data breaches is close to home. It’s human error.
The ICO has said that over 85% of breaches are due to human mistakes and professional services firms both large and small are just as susceptible to a breach of GDPR as any other business. It is imperative that GDPR compliant policies and practices are put in place to reduce risk and ensure that the correct course of action is taken in the event of a breach.
Something as simple as email error is, in our experience, one of the most common mistakes made. It could be a case of not blind copying, or it could simply be sending an email to the wrong address. We all know that these things can easily happen, especially when someone is under time pressure or multi-tasking. But if an incident like this leads to the leaking of someone’s personal, sensitive data then the consequences could be serious, however innocent the mistake.
One notable case ruled on by the ICO involved Gloucestershire Police. An officer sent an update email about an alleged victim of child abuse and put recipients names in the ‘to’ field instead of blind copying them. This made all recipients’ names and email addresses visible to all. The force was fined £80,000 by the ICO. Professional services firms deal with sensitive and financial information on a daily basis, so the risk of a data breach is real.
Other common human error issues include staff simply disclosing too much or inappropriate information. This could happen over the phone – it doesn’t have to be electronically in writing. For example, if someone phones a lawyer claiming to be the client but is using a different telephone number – the natural instinct in a good staff member will be to help them and tell them what they want to know. Most of the time, this will be harmless but it could end badly if someone has negative intentions. Professional services firms should be alive to this risk because of the risk of fraud and finance deception.
Other issues straddle the boundaries between human error and systems weaknesses. For example, staff clicking on links in ‘phishing’ emails which then introduce a virus or allow access into systems full of data.
This is why it’s vital to ensure that staff have the training they need around cyber security and GDPR / data protection issues. This is especially prevalent in a professional services firm, where additional regulations apply and governing bodies take interest in such matters. Staff are your first line of defence and awareness of the issues is key. At nuBright, a joint venture between Stephens Scown and Bluegrass Group, we offer accessible and straightforward training that can help.
Our training courses ‘Data Protection’ and’ Cyber Security’, when purchased together, cost just £12 + VAT per person. The course is interactive, online and can all be completed in less than 30 minutes.
When businesses stand back and look at their processes, they often find that it’s not just a compliance issue: there are improvements they can make that create a more efficient business. There are real returns in getting on top of the GDPR, as well as helping keep your business out of a very unwelcome spotlight.
To find out more how nuBright can help your company with data protection and cybercrime email ask@nubright.co.uk or call 01392 796280. www.nubright.co.uk
Thomas Chartres-Moore, Director at NuBright
Like Back to Top Seen 493 times Liked 0 times
Subscribe to Updates
If you enjoyed this, why not subscribe to free email updates and join over 1274 subscribers today!
Subscribe to updates
Alternatively, you can subscribe via RSS 
All email subscriptions must be confirmed to comply with GDPR.
Related Posts
02nd September 2019 | September 2019
I hope you have all enjoyed your summer holidays. All in all the weather in the south west was very good. I would be grateful if you could ensure you get your nominations to us for the 2020 Devon and Somerset Legal Awards and raise the profile of the solicitors’ profession. Grow Marketing Group is again working with us to help to give the associated firms and individuals the significant public exposure they deserve. They help us to put together an incredible night in celebration of the legal profession and to showcase the achievements and successes within it. As you will recall the 2020 Annual Dinner is being held at Exeter Cathedral, on the 30th April when we will celebrate and recognise the achievements of those in the legal profession. Don't miss this dazzling occasion. You will no doubt have seen that we have two new Council members for the South West and Gwent Constituency that we are a part of. Congratulations to Kathryn King and Scott Bowen on their elections. We look forward to receiving their regular updates on Law Society Council matters. I know from my conversations with Kathryn and Scott at our recent Association of South Western Law Societies (ASWLS) AGM that they plan to alternate their attendance at our DASLS meetings to keep you fully informed. Both Kathryn and Scott are to be DASLS ‘interviewees’ of the month in the near future. Following the ASWLS theme many congratulations to Mel Bevan-Evans for her election as President of ASWLS for the forthcoming year. Also, a well done to our very own Stephen Mahoney who has recently completed his ASWLS year in office. Photo of them together airing the ASWLS brand new medal of office. I must say a big thank you and express this Society’s very best wishes to Rod Mole for over a decade’s commitment as our Council Member at Chancery Lane. We have in fact been lucky enough to have had 13 years of news from the big smoke delivered to us from Rod. We all wish you well Rod and as a Past President and Lifetime Member I know you will maintain close links to DASLS in the future. So to a lifelong French wine drinking oenophile it is “au revoir Rod” from Monique and all your friends at DASLS …..but it’s not goodbye. Following my usual theme (and taking Scott Bowen’s lead as a legal aid criminal practitioner) can I encourage you all to support The Law Society's Criminal Justice Campaign Focus groups for lawyers working in criminal law. If you work within the criminal law fields and are potentially willing to attend a Law Society focus group please take part in the below survey. See the link - https://www.surveymonkey.co.uk/r/N853TJ3 We have our In-House Lawyers Conference coming up in the autumn and I would encourage you all to get involved. Please put the 17th October in your diary and we look forward to seeing you. The Speakers are to be: Juliet Oliver SRA General Counsel, Rav Hothi Head of Relationship Management - Midlands & Southwest, The Law Society, Phil Sampson Sampson Hall, Alex Fetcher Nomanton Chambers, Kate Gardner Clarke Willmott. Coming up we also have our Joint Professional Networking Group meeting in Exeter on the 19th November for the Bank of England Briefing. That almost made me mention the.. “B” ..word. I wish you a pain free Brexit when and if it occurs in October. I am sure the Roscoff Ferry will continue to be sailing from Plymouth when I write to you later in the year. On a personal note I am still at the gym three times a week as a round of dinners could otherwise take its toll on me if I didn’t maintain my regular exercise. I am looking forward to travelling to see colleagues at a number of events in the near future as we head into darker evenings of the autumn. Fear not it will soon be Christmas. Nigel Lyons DASLS President 2019-2020...
02nd September 2019 | September 2019
Introduction The SRA is currently conducting the second of its 2 thematic reviews for 2019. It has called for copies of 400 law firms’ risk assessments to assess the extent to which firms are integrating the more-detailed requirements of the 2017 Anti-Money Laundering Regulations. This follows their first review, reported on in May 2019, into trust and company service providers (TCSP) – a survey of 59 firms only but indicative, nonetheless. That published review identified a number of stark features: 26 of the 59 firms were referred for disciplinary action (though not for actual money laundering, but for sloppy breaches of the Regulations) 4 firms had no risk assessment at all 24 firms had inadequate risk assessments 20 firms had not specifically addressed TCSP work in their risk assessments 14 firms had no or inadequate file-related risk assessments 21 firms were unable adequately to demonstrate that ongoing monitoring was undertaken 14 firms had inadequate PEP processes in place 17 firms failed to provide training about TCSP work Only 10 firms had submitted SARs in the last 12 months. Points to emerge The pointers for us all to take away from this interim review are 1.. ..that we ALL need to revamp our written firm-wide risk assessments to encompass all the factors mentioned in the Regulations, as well as the wider issues revealed by the Treasury Risk Assessment published in October 2017 and further guidance from the SRA thereunder. The Treasury Risk Assessment, inter alia, proscribed 6 levels of badness, of which the second was ‘unwittingness’, and the view was that most professionals fall into this band of oblivion. We are too busy getting on with the job to stand back an inch or two and adequately assess the circumstances of the client – including a knowledge of their source of wealth and, more specifically, the source of funds for the transaction the surrounding instructional context other parties or jurisdictions involved ..in order to assess the real risks of fraud, tax evasion, corruption, bribery or money laundering actually taking place. They suggest that we should all up our game and enter the top category of ‘vigilance at all times’. If we are asking the right questions of the right people at all stages of the matter, the risks are much reduced. This is ongoing monitoring writ large. If despite our questioning, we are satisfied of the bona fides of the client, we can proceed; if not, we should be discussing it with our MLRO/MLCO and making a suspicious activity report to the NCA. 2.. ..we also need to review our PEP processes. Since Politically-Exposed Persons were redefined in 2017 to include domestic characters, as well as foreign, the possibility of acting for a PEP, a family member or a business associate of a PEP is much increased. I used to say (in reliance on the old Law Society Practice Note) that we should simply ask all clients ‘are you a PEP’, taking their response at face value thereafter. I even drafted a short questionnaire for clients to complete in satisfaction of this duty. The Review suggests that this is inadequate, and that some sort of objective search or enquiry (beyond the Google option) would be required. Most firms of my acquaintance use some sort of e-search facility to vet all their clients in the first instance, and this has the virtue not only of picking up whether the client is or is not a PEP but also such matters as Sanctions List membership and other tricky points. Having identified a PEP, it is then for us to decide what enhanced steps we need to take for each type. This is another weakness highlighted by the Review. 3.. ..further, we need to review our procedures for identifying companies, their managers and their owners. The 2017 Regulations appear to say that in addition to verifying the identity of the entity (by a company search), a firm must also obtain and verify t...
02nd September 2019 | September 2019
What made you want to serve on The Law Society Council? I have been involved in The Law Society’s Junior Lawyers Division (“JLD”) for a while and have met some incredible people who inspired me to do more for the profession as a whole rather than just the JLD. They opened my eyes to the possibility of serving on Council and although I never dreamed that anyone would vote for me in the election, I am immensely proud to have been proved wrong. The challenges we face are evolving. The way we work is adapting. Council, in my opinion, also needs to adapt in order to be more representative of the profession and to fulfil its purpose. I hope that I can bring a fresh perspective to Council which will help to achieve this. What are the key concerns you have at the moment for the legal profession in the South West? The ‘South West’ is such a large and varied geographical area that there is no ‘one size fits all’ approach, which I think is misunderstood (or at least not fully appreciated) by many. What works well in the Bristol legal market, for example, does not necessarily have the same relevance for the legal market in Barnstaple. Or Exeter. Or Looe. Smaller practices are not getting the support they need to keep up with changes and there is not enough focus on the regions at Council level. That being said, I think it has been acknowledged that change is necessary and I understand that there is currently a review underway to address the structure and make up of representation. What is your dream job? I have wanted to be a lawyer since I was at primary school so have never seriously considered doing anything else, but based on current interests if I wasn’t a solicitor I would probably be a detective or a forensic scientist. I don’t know the first thing about psychology or forensic science - but I like the idea of solving crimes and pursuing the truth. That and the TV dramas make it out to be quite glamourous and rewarding! Which sort of work gives you the most job satisfaction? Floating companies on growth markets such as AIM. We often work with companies from start up throughout their development, so it is rewarding to see one that is ready for this step. They are usually quite large transactions involving months of preparation, planning and project management on top of the technicalities specific to the particular market. The teamwork across the teams of professional advisors is an interesting dynamic and the satisfaction of completing the transaction is always extremely fulfilling. What gets you up in the morning? It sounds cheesy but I genuinely love my job. That and my husband gets really grumpy with me when my alarm wakes him up but I don’t get out of bed. What do you do in your spare time? I am a corporate lawyer so spare time can be a novelty. That being said, I do manage to fit in a swim or a gym session before work most mornings and regularly boulder and play netball. I also like to watch crime dramas to unwind after a long day and guess who the culprit is (which I am told is rather annoying for anyone sat watching with me!). What book are you reading at the moment? Small Great Things by Jodi Picoult. I have read a few of her novels over the years and find them quite moving. What is the most recent film you have seen? John Wick. It wasn’t my choice of film but I enjoyed it more than I thought I would. A word of warning – if you are particularly fond of puppies then maybe it isn’t the film for you. What are your favourite food / restaurant? There’s a sushi restaurant in Cheltenham called ‘Kibou’ that I just can’t get enough of. It’s been my restaurant of choice for years and is still going strong. Where is your favourite holiday destination? France. It’s so close and yet so culturally different than the UK. Good wine, good cheese and a relaxed atmosphere, what’s not to love?...
06th March 2020 | March 2020
Dear All, This year really is flying by. I have just had my birthday. After updating you previously on the excellent catch up I had with the Law Society CEO Paul Tennant on his visit to the south west last November, I had not expected to be back in touch with him quite so soon. Sadly, this time it was in less happy circumstances. I was, like many of you, shocked and saddened in January to hear the news and see the pictures of the substantial fire at Chancery Lane in London. I have emailed Paul Tennant and James Shepherd, our Law Society Relationship Management Executive, to send our best wishes and we are hoping that the building will be back to full use very soon. As I write this report, preparations are in full swing for the 2020 DASLS Legal Awards & Dinner. As you know the Annual Dinner is being held again this year at Exeter Cathedral. The event is to take place on the 30th April 2020. After the success of last year, we are hoping that once again the event is sold out which would mean we will have around 480 people attending. If you have not done so already, please contact Llew Nicholls and the team at our Awards partners ‘Grow Marketing’ who have worked very hard alongside our very own Tony and Monique to achieve full sponsorship of this event. You can contact Llew to book the remaining places by emailing Llew directly at Llew@growmarketinguk.com. There have been more nominations than ever before with more entries making the short list. Please do not miss this dazzling occasion. You will all have received DASLS latest 2020 training courses programme. Tony Steiner and the team have worked hard to arrange these events. You will see that as members you get preferential rates and if appropriate reduced rates for multiple attendees from your firms. Please take advantage of these services as a proportion of the monies do go to support our Society’s broad continuing education offering. If I do not see you individually before I look forward to catching up with you at the 2020 DASLS Legal Awards and Annual Dinner in April. With very best wishes Nigel Lyons President 2019-2020...
06th March 2020 | March 2020
New AML Regulations and the pursuit of the beneficial owner. Introduction The new Money Laundering & Terrorist Finance (Amendment) Regulations 2019 which came into force on 10 January have modified a number of aspects of the 2017 AML Regulations, with which we have been complying for some time. However, many firms’ procedures hark back to the earlier days of the 2007 Regulations and have not been modified or updated much over recent years. This article seeks to set out what the new Regulations in fact require, and the steps we should be taking in relevant cases. The Policy It has been true for some time that the ultimate aim of all the regulatory rules is transparency – it has always been the case that the use of artificial structures such as trusts, companies, bearer shares, foundations and charities – whilst perfectly legal – have to some extent also benefitted from the extra anonymity they offer to the true owner and recipient of the funds and services we provide. If we offer services to these types of entity, the Regulations require us to go some way to identifying the individuals who are actually benefitting from our services, and this entails uncovering the true ownership of the organisation. Whilst this would be difficult in many instances – Cayman Island companies with bearer shares, for example – we must nevertheless attempt to get some assurances from the creators of the companies, accountants or registrars as to the ownership of the shares, and have some way of being notified of any change in ownership. We also need to be aware of the PEP and Sanctions status of these individuals. Further, for UK companies, the PSC Regulations 2016 impose an exactly similar obligation on the companies themselves to identify their beneficial owners and notify Companies House of any shareholder with 25% or more of the shares or exercising control over management of the business. The Regulations The Regulations provide that we must, as part of our CDD procedures Identify the client – this means coming to know who they are, by name and some other characteristic, e.g. address, date of birth, date of incorporation Verify that identity – by means of reliable and independent data and documentation Identify the beneficial owner (if the client is an entity) – though not necessarily verifying that identity Identify and verify the identity of the person actually instructing us (if not already done). What this means for us When acting for a COMPANY (that is not a listed company) the Regulations require us to obtain Details of the company as registered (which must be proven by a copy of the register entries available from Companies House or equivalent registry) – name, number, registered office address, principal place of business the law to which it is subject details of its governing documentation (its memorandum) names of the directors. Names of any beneficial owners, and the identity of any individual owners of legal entities which own the client Names and verification of the persons instructing us on behalf of the company, and their authority to do so. Note that we cannot rely on the information provided by the company under the PSC Regulations but we must undertake our own research in order to fulfil our CDD duties. Further, if as part of that research, we discover that the Companies House data on PSC’s is incorrect, then we are now under a further obligation to notify the Registrar of Companies of this fact. We also need to establish that PEPs and Sanctions checks are also undertaken. If genuinely positive entries are revealed in response we should undertake enhanced CDD steps or cease to act, accordingly. Electronic searches are a permissible avenue to use provided the search provider can offer us the necessary assurances that the person actually claiming an identity is IN FACT that person. Check also whether ...
