Consumer organisation Which? is calling on the government to create new rights for people who have been the victims of a corporate data breach.
The group wants the data protection bill, currently being debated in Parliament, to be amended so that independent organisations, such as Which? itself, can fight for collective redress for corporate wrongs.
“Data breaches are now more commonplace and yet many people have no idea what to do or who to turn to when their personal data is compromised,” said Alex Neill, the managing director of home products and services at Which?. “The Government should use the data protection bill to give independent bodies the power to seek collective redress on behalf of consumers when a company has failed to take sufficient action following a data breach.”
Current regulations require companies to offer support when their customers have been affected by a data breach, but there is little ability on the part of consumers to hold a negligent data processor to account: the only option available requires each individual to go to the courts to enforce their rights.
In a statement, a DCMS spokesperson said: “We are confident that our Data Protection Bill will provide consumers with the necessary protections when there’s been an infringement of their rights regarding personal data. The Bill will make the UK fully compliant with the GDPR.”
The call comes after a year in which some of the biggest data breaches ever recorded were revealed. In the second half of 2016, the internet service company Yahoo, now owned by Verizon, said two large breaches had been carried out several years earlier. It initially estimated that one billion customers were affected, but in 2017 it updated the estimate to three billion – every single Yahoo customer, or four out of every 10 human beings alive today.
Gigantic data broker Equifax was also affected by an enormous breach, losing extremely sensitive financial information on 143 million US customers and 400,000 Britons. The credit monitoring firm was rapidly criticised for its poor response to the breach, offering a year’s worth of credit monitoring to users looking to find out if they were affected – but only if they agreed to a clause that prevented them from suing the firm.
The true extent of such breaches is still not widely understood amongst the public. According to a study carried out by Which?, to back its calls for new consumer protections, just 8% of Brits think they have been subject to a data breach in the last year. The actual number, given the continued regularity of such large scale data breaches, and the delay it takes many companies to discover they have been hit, is likely to be far higher – closer to the three quarters of Brits who Which? says are concerned that information they have shared could be at risk of a leak.
Free online services such as haveibeenpwned.com exist to help consumers discover which services they use have been breached, and what information was lost as part of the breach. The site, run by Australian security expert Troy Hunt, tracks dumps of hacked data and informs members if their email address is included in such a collection.
