Archive

Data protection & privacy

A series of vague and apparently contradictory statements have marked Cathay Pacific’s public response to its recent data breach – the world’s largest airline data privacy incident.

While the extent of the damage to the company and its reputation remains unclear, the breach has been described by Cathay’s Chairman as ‘one of the most serious’ the airline has faced, and that its response would be ‘different’ tomorrow.

What can be learned from the airline’s fumbled response?

First, the backstory: late one evening Cathay acknowledges a ‘data security event’ affecting 9.4 million customers that it claims to have acted to contain ‘immediately’. A torrent of negative coverage and plenty of speculation about the state of the firm’s IT security quickly ensues. Journalists and customers complain that Cathay is not responding to phone calls or emails.

The following morning Cathay admits that it had been aware of suspicious behaviour on its network for a three month period starting March, prompting an avalanche of questions from worried customers and bemused regulators and politicians about why it had taken so long to inform its customers. CEO Rupert Hogg takes to the media and video to defend his firm.

Three weeks later, Cathay submits a statement (pdf) to Hong Kong lawmakers confirming the attack had intensified over a three month period and that it had known in August that passenger data had been accessed and/or stolen. Cue a third wave of hostile coverage, this time questioning the company’s honesty and transparency. Lawmakers accuse the company of orchestrating a cover-up.

(Business Traveller has a useful timeline of the incident).

Making inaccurate or inconsistent statements during a data privacy incident is easily done when facts are thin on the ground and the media is breathing down one’s neck.

Top data breach communications pitfalls

Based on my experience, here are the top five communications mistakes organisations make when responding to a data breach – the first and most damaging of which is zero communication:

  1. Concealing a breach. Until recently, most data breaches were not made public. GDPR and other data privacy laws now mean organisations must notify those impacted and the relevant authorities about a breach. Yet some will try to bury it from public view. As Uber and Yahoo! can testify, a cover-up is seen as worse than the breach itself. Substantial fines may appear a good deterrent to concealment, but research shows the longer-term reputational damage can be more significant.
  2. Confirming a breach too slowly. Cathay Pacific took three months to delay formal notification in order to contain the attacks and to determine what data had been lost and who has been affected. But organisations in many jurisdictions are now obliged to notify regulators quickly, and customers now expect to be informed quickly, and view organisations that are seen to move too slowly as unprofessional, clueless, or with something to hide.
  3. Providing inaccurate facts or data. Cathay Pacific may have waited until it was sure of the facts and numbers, yet many organisations now quickly go public about a breach to meet their regulatory obligations, or under pressure from a third party, and then have to revise their statements as the facts become clear (eg. Dixons Carphone revising upwards the number of records involved in its 2017 data breach from 1.2 million to 10 million). This creates additional negative news cycles, and creates a perception of amateurism at best and willful obfuscation at worst.
  4. Downplaying a breach. It is tempting to claim that the sensitivity and scope of the data and systems involved in a breach are limited, or that the impact on the company and those affected is minimal. But such statements can easily come undone as the full extent of the intrusion comes to light, leaving you looking irresponsible or worse.
  5. Providing inadequate media support. Cathay chose to push out its bad news late in the evening and send its teams home. But little irritates journalists more than an unmanned or unresponsive management or communications team, and senior executives unable or unwilling to provide a human face to something that has already been confirmed publicly by the company.

Every organisation is advised to avoid these pitfalls wherever possible.

Cathay’s CEO may have promised the airline would respond differently to future breaches, but he did not elaborate how.

Notifying regulators and customers more quickly is an obvious starting point. Careful thought must also be given to the openness, transparency, tone, consistency and ownership of one’s statements, amongst other factors.

My next post will set out data breach communications best practices.

Today I published an updated and strengthened Privacy Policy on this website. The policy is one component of the considerable work required to prepare for the European Union’s General Data Protection Regulation (GDPR) – due to come into effect on May 25, 2018.

Initially fairly daunting for a small operator, I came to appreciate that the GDPR also presents an opportunity to build strong relationships and trust on the basis of a real commitment to the security, privacy and confidentiality of my clients and the users of my website and other channels.

Equal treatment for everyone

While the GDPR focuses on protecting the personal information of EU citizens, I strongly believe that data privacy is a right that belongs to you, wherever you are.

Given the fact that the GDPR is widely seen as the global gold standard for personal privacy – a standard that sits above (and in many cases, significantly above) those set in other countries and jurisdictions – means that you can expect me to apply equally the principles and rights associated with the regulation to everyone, everywhere.

OK, so what does this mean in practice?

The new Privacy Policy should give you a good idea what this means in terms of the day-to-day collection, management and use of your personal information, as well as your rights to access and control that information.

Behind the scenes, I have been reducing the amount of data I hold on my clients and others. For example, personal information about a client is now reduced to the bare minimum once a project has finished or a contract expired. In addition, personal information about all business contacts has been taken off the cloud and stored locally, encryption beefed up, and passwords strengthened and changed more regularly.

Much of my business comes from referrals, which means I do little or no direct or email marketing, online commerce, or online customer support. This may change as I continue to expand my business, and in all cases will involve me clearly telling you what information is being collected about you, why it is being collected, and who, if anyone, it may be shared with and for what reason.

Stay in touch

Protecting your personal privacy is not just about hitting a deadline – it is an ongoing process.

Stay tuned to this blog for further updates, and do send any feedback, comments or questions you have to privacy@charliepownall.com.

%d bloggers like this: