Data breaches

Summary

A request for data breach statistics and details from the Department of Environment, Food and Agriculture was made but ultimately lapsed because the requester failed to provide necessary clarifications on the scope of the data.

Key Facts

• The request was received on 2019-07-29 and lapsed on 2019-09-23.
• The authority questioned the requester's eligibility under the FOI Act 2015 due to lack of proof of Isle of Man residency.
• The authority offered to respond under the Code of Practice on Access to Government Information instead.
• The request was paused pending clarification on whether to include minor incidents or only those reported to the Information Commissioner.
• The requester did not respond to the clarification request within the 4-week deadline.

Data Disclosed

• 2019-07-29
• 2019-09-23
• 2019-08-23
• 2019-09-10
• 5 years
• 2 years
• 4 weeks
• 686781

Exemptions Cited

• Requester eligibility under Freedom of Information Act 2015 (non-resident status)

Original Request

Good afternoon, I would like to request the following information under the FOI Act: - The number of data breaches over the last five years, broken down by year - Information on what the data affected is - The number of people the breach affected - Any information available on the circumstances of the breach

Data Tables (1)

Full Response Text

1 From: Sent: 10 September 2019 17:19 To: Subject: FW: FoI request (ref: 901994) re Data Breaches (ref: 901994) Dear , I note that we have not received any response to the email below. If we do not hear from you by the 20th September we will consider closing this request. Please note no further work has been done on this request since the email below was sent. Best wishes

From: Department of Environment Food and Agriculture

Sent: 23 August 2019 10:00 To:

Cc:

Subject: FoI request (ref: 901994) re Data Breaches (ref: 901994)

Dear , Thank you for your Freedom of Information request received on the 29th July. The legislation enables access to information by residents of the Isle of Man, which includes companies incorporated in the Island. You have given a Manx contact address, albeit not residential, (and arguably have a Manx surname) but no contact telephone number. As you do not appear to be an Island resident, unless you can demonstrate otherwise, we cannot progress your request under the Freedom of Information Act 2015. Nonetheless, the above is largely academic as we still have an obligation to respond to your request under the Code of Practice on Access to Government Information. More information on this can be found here https://www.inforights.im/individuals/code-of-practice-on-access-to- government-information/ Before we go any further however, and in order for us to provide the information you request we need some clarification as below. 1. The number of data breaches over the last five years, broken down by year.
For the past 2 years we have recorded many incidents, always erring on the side of caution and over-recording. Many of these we have later determined were not breaches that would have caused any risk of harm to any individuals. Most of the incidents have been very minor. Do you wish to know about all incidents or only the ones which resulted in reports to the Information Commissioner? 1. Information on what the data affected is.
Please clarify what you mean by 'affected'. Do you mean the information that was inadvertently released or lost (for instance) or do you mean this should include other information that may have 2 consequently been of less value or less accurate due to the release or loss of the previous information? 1. The number of people the breach affected
Please clarify what you mean by 'affected'. Do you mean only data subjects outside of our organisation, people involved in the breach within the organisation, data subjects whose rights and freedoms may have been affected by a breach, all of the above, or something else? 1. Any information available on the circumstances of the breach
Please clarify whether you mean what caused the breach, what happened as a result, how it was identified, or something else? While we aim to provide information when possible we will not be able to process your request until this clarification is received. Should you not respond within a reasonable period (around 4 weeks) the Department may refuse to provide you with the information requested. Should you have any queries regarding this please do not hesitate to contact me (686781). Best wishes