This article was co-authored by Joshua Curzon,
Trainee Solicitor, London.
The Information Commissioner's Office (ICO), the
UK's data regulator, recently issued a formal reprimand to a UK
company which had fallen victim to a cyber incident. Brand New Tube
(the company) suffered a data breach when an unauthorised third
party gained access to its systems and exfiltrated the names, email
addresses, and passwords of 345,000 website users.
Why did the ICO issue a reprimand?
The ICO's decision to issue a reprimand rested on two
fundamental issues:
1. Failure to evidence penetration testing and
vulnerability scanning
The UK GDPR requires organisations to implement appropriate
technical measures to protect personal data. Penetration testing
(simulating an attack on systems) and vulnerability scanning
(automatically scanning systems for known issues) are technical
security measures recommended by the National Cyber Security
Centre. Recent ICO enforcement notices
