On 19^th September 2018, the Information Commission Officer (“ICO”) fined credit reference agency Equifax Limited £500,000 for breaching the Data Protection Act 1998 (“DPA”). Finding that Equifax Limited failed to protect the personal data of up to 15 million UK individuals, the ICO awarded the maximum penalty for a breach under the DPA.

The ICO found that of the eight data protection principles established in the DPA, Equifax breached five. The finding considered how Equifax handled personal data, the purpose of processing the personal data and the transfer of the UK data to the US.

What happened?

Between 13 May 2017 and 30 July 2017, data held by Equifax’s US parent company, Equifax Inc was subject to a ‘cyber-attack’. The compromised data ‘included personal data contained in up to 15 million unique records of UK individuals (the “UK data”)’. In regards to the UK data, Equifax acted as the ‘controller’ and Equifax Inc acted as a ‘processor’. Although the US systems were subject to the cyber-attack, the ICO found that in respect of the UK data Equifax Limited ‘had failed to take appropriate technical and organisational measures against unauthorised and unlawful processing’.

The affected UK personal data included records from between 2011 and 2016.  The ICO’s notice drew particular attention to two products that held UK data processed in the US: an Equifax Identity Verifier “EIV data” and “GCS dataset”.

The Equifax Identify Verifier (EIV) was a product used to verify a customer’s identity and comply with anti-money laundering checks. Originally, EIV was hosted in the US, however in 2016 Equifax Ltd moved EIV to be hosted in the UK.  The ICO found that the ‘process for migrating this data to the UK, and its subsequent deletion in the US, was insufficient and/or not adequately effective.’

The ICO categorised the compromised UK data contained in the EIV dataset as follows:

(1) in respect of 19,993 UK data subjects, the following data was compromised: name, date of birth, telephone number and driving licence number.

(2) in respect of 637,430 UK data subjects the following data was compromised: name, date of birth and telephone number.

(3) in respect of up to 15 million UK data subjects the following data was compromised: name and date of birth.’

For the GCS dataset, ‘data relating to 27,047 UK individuals had also been compromised in the data breach’. For ‘14,961 individuals’ the breach compromised their ‘passwords and obscured financial information’.

Equifax Inc discovered the data breach on 29 July 2017 and by late August 2017 Equifax Inc became aware that UK data might be affected. Equifax Inc did not inform Equifax Limited of the breach until late 7 September 2017. The following day Equifax Limited notified the ICO. In regards to the time line, the ICO found that the ‘period of vulnerability for the affected UK data extended over an extended period of time and the data breach was not detected promptly’.

Aggravating factors

The ICO drew on the following aggravating factors in its monetary penalty:

• ‘the security breach impacted many more individuals than just the UK data subjects’;
• ‘risks appear to have persisted for a prolonged period of time’;
• ‘some of the failures concern failures to identify/ ensure appropriate security measures’;
• ‘the data breach exploited a known vulnerability and therefore could potentially have been prevented’; and
• ‘Equifax Ltd’s contractual arrangements with Equifax Inc were inadequate in material respects’.

 Mitigating factors

  The ICO also took into account the following mitigating factors:

• ‘relevant data, was for the most part, not of itself highly sensitive in terms of its impact on data subjects’ privacy’;
• ‘affected data subjects, as well as Equifax Ltd, have been the victim of the malicious actions of third party individuals’;
• ‘Equifax Ltd proactively reported this matter to the Commissioner, promptly after learning about it from Equifax Inc, albeit a significant time after the actual breach’;
• ‘Equifax Ltd deleted at least some of the data remaining in the US environment following migration of EIV to the UK’;
• ‘Equifax Ltd and Equifax Inc took steps to minimise potentially harmful consequences such as engaging specialist IT security experts to manage the data breach, offering free credit monitoring services to UK data subjects affected by the breach, and working with the relevant regulations in the US, Canada and the UK’; and
• ‘Equifax Ltd and Equifax Inc have implemented certain measures to prevent the recurrence of such incidents, for example Equifax Inc has increased system scanning capability and is now storing passwords within a cryptographic hash value, whilst strengthened procedures are now in effect.’

Equifax response

A spokesperson from Equifax explained ‘disappointment in the findings and the penalty’. The spokesperson also reiterated that ‘Equifax has successfully implemented a broad range of measures to prevent the recurrence of such criminal incidents’. Equifax has 28 days from the date of the monetary penalty notice in which to appeal the ICO’s decision and for it to be received by the Tribunal, should it choose to do so. If the ICO receives full payment of the fine by 18 October 2018, then the penalty will be discounted to £400,000. However the early payment reduction is lost if Equifax chooses to exercise rights of appeal.

The fine

The monetary penalty clearly shows that the ICO is not reluctant to awarding the maximum penalty in respect of security breaches, since under the prior UK data protection legislation, the maximum fine was £500,000.  Under the GDPR, the ICO has the power to impose a maximum fine of up to €20 million or 4% of the offender’s annual global turnover, whichever is higher.

Why is this not a breach under the GDPR?

The breach occurred in 2017, which was before the GDPR came into effect on May 25 2018. Therefore, the ICO investigated the breach under the data protection legislation in effect at the time of the breach.