HIV Scotland
Insufficient technical and organisational measures to ensure information security
Decision Date
October 18, 2021
Authority
Information Commissioner (ICO)
GB
Sector
Individuals and Private Associations
Country
GB
Law
GDPRStatus
FINALDescription
The British DPA (ICO) has imposed a fine of EUR 11,800 on the non-profit organization HIV Scotland. The controller had sent an e-mail to 105 people, with e-mail addresses on the mailing list visible to all recipients. In the case of 65 of the e-mail addresses, persons could be identified by name. It was possible to draw conclusions about the individuals' HIV status or risk based on the personal data provided.The DPA found that the organization had failed to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. For example, the organization had conducted inadequate employee training and used improper methods for sending bulk e-mails via blind copy (bcc).