Students secure payout over ‘life on show’ data breach

ueaAs Morrisons staff await a Supreme Court ruling and iPhone users twiddle their thumbs outside the High Court, hundreds of undergraduates from the University of East Anglia have secured what many crave but few receive after being handed compensation for a data breach.

Nearly 300 students whose personal details were emailed to their peers have been paid £142,512.16 in compensation, which, if shared equally, would total nearly £500 each.

A spreadsheet containing suicidal thoughts, sexual assault, and serious family illnesses and bereavements was sent to 298 people at UEA in June 2017. It listed extenuating circumstances in which essay extensions and other concessions were granted.

The email was removed from the students’ inboxes by IT staff, and recipients were instructed not to talk about its contents, however, speaking anonymously, students described how they felt their “life was on show”.

A second email was sent out after the error was discovered but the Information Commissioner’s Office said the breach did not meet the requirements for regulatory action.

The compensation payouts were revealed through a Freedom of Information request from student newspaper Concrete and made through an insurance claim.

UEA chief resource officer and university secretary Ian Callaghan said: “We immediately informed the Information Commissioner as soon as we were aware of the breach and put support in place for all affected students.

“Since this incident we’ve reassessed a number of information security measures, including holding a full review of all data on UEA hard and shared drives, introducing mandatory data protection training and refresher training for all staff (whether permanent or temporary) and reviewing access to group email accounts and redacting this access in cases where it was deemed unnecessary.

“We take data protection very seriously and, with help from the new GDPR, we have made great strides as a workforce in raising the awareness of the importance of good data management.”

However, the UK does not have a great record in allowing compensation payments for data loss; so far not a single penny has been paid to consumers through court rulings.

One of the first UK class actions, launched in 2015 against Morrisons following the theft of employee data, has still not been settled, while thousands of iPhone users, who are suing Google for damages over the alleged abuse of Apple’s Safari privacy settings, are still none the wiser.

Related stories
Morrisons in last ditch bid to stop data breach pay-out
Morrisons loses appeal against data breach pay-out
Lawyer slams Morrisons on eve of data ruling appeal
Thousands of Morrisons staff to get data leak pay-off
Here we go again: Google back in dock for data tracking
High Court blocks class action over Google tracking
Google faces £3bn High Court battle over data tracking
Google summoned to High Court to defend data tracking