News

Blue Light Thinking Wrong Suggests Research

Posted on by Andy Miller

New research results from the University of Manchester suggest that the popularly accepted wisdom that the sharp blue light emitted by our smartphones and laptops is harmful to our health and disruptive to our sleep may be wrong.

Blue Light

The current thinking, which has led to device makers adding filters to our devices (e.g. Night Shift in the iPhone 11 and even the Windows 10 Night Mode) that show warmer colours at night is based on the idea that too much exposure to artificial blue light emitted by our devices at night is bad for us. For example, as highlighted by Samsung (on its Australian website), too much blue light displayed on the screen of a device has been thought to suppress the production of sleep-inducing hormone ‘melatonin’, hence the need to filter out the blue and replace it with warmer colours. Samsung also suggests that its filter could “reduce digital eye strain”.

Mixed Messages

The new results presented by the University of Manchester researchers show that not only is this belief about blue light (and the need for warmer light filters at night) likely to be mistaken but also that using warmer light filters may be sending our bodies mixed messages.

Why?

The new research, which was carried out using mice, has revealed that blue colours associated with twilight have a weaker effect than white or yellow light of equivalent brightness. The research results appear to show that, in fact, our eyes naturally associate warmer, brighter colours with daytime, and dimmer and cooler colours (blue and darker) with the night as our body clock synchronises with the environment. These cool colours are signals to the brain that it’s twilight and, therefore, time to start getting ready for sleep.

Meaning?

This means that rather than suppressing sleep-inducing hormone ‘melatonin’, the emission of blue light (in dimmed conditions) may actually be more restful than yellow light, and that showing ‘warmer’ colours (via a filter) rather than blue light could be sending the wrong message to the brain. If this is so, it may be the warmer colours of the filter that are more likely to suppress the production of melatonin rather than the blue light glow from our devices.

What Does This Mean For Your Business?

For device-makers who have developed filters based on the opposite of theses findings, these research results may be unexpected, embarrassing, and highlight an area where costs have been incurred unnecessarily. That said, the view that blue light needed to be filtered at night was widely supported by many credible, expert sources and these filters were developed by device makers with the customer’s wellbeing (and a marketing/value-adding brand benefit) in mind, based on what appeared to be correct information at the time. Also, these new results were based upon one study involving mice, not humans, and that more research is likely to be needed before this new opposite idea about blue light can be widely accepted as the new truth.

Tech Tip – Format Painter

Posted on by Andy Miller

If you’re preparing a Word document in Windows 10 and you like the look of the formatting in one section and you’d like a quick and easy way to apply the same formatting to other sections, try using ‘Format Painter’.

You can find Format Painter on the top left of the screen – a paintbrush symbol. To use it :

– Highlight a paragraph in your document which has the formatting you like.

– Click on the Format Painter symbol.

– Click in the document next to the section you’d like to change to that formatting (you’ll see the paintbrush symbol appear) and highlight the new section.

– The formatting you like will automatically be applied.

Featured Article – Email Security (Part 1)

Posted on by Andy Miller

In this week’s article, which is the first of two parts on what is a huge subject for businesses to tackle, we take a look at some of the important issues of email security and how businesses can try to strengthen this crucial area of their cyber defences.

Most Breaches Involve Email

Over 90 per cent of breaches now involve email, and Proofpoint’s Annual Human Factor Report figures, for example, show that social engineering is strongly favoured as a way in by cybercriminals as 99 per cent of email attacks rely on victims clicking links.

Statistics like these reveal some of the key challenges that businesses and organisations face on a daily basis, such as how to defend effectively against the whole range of email attacks, how to spot and eliminate threats as they arrive, and how to ensure that staff are aware of email threats and know what to do when faced with suspicious emails and links.

Types of Email-Based Attacks

There is a vast array of attacks launched through email systems (often relying on social engineering) including targeted phishing schemes, business email compromises, and ransomware attacks.

– Ransomware is still a popular attack and extortion method, and Trend Micro reported a 77 per cent surge in malware attacks during the first half of 2019.

– Phishing is a cheap, easy and highly effective method for criminals to gain access to company systems, steal important data and money, and create a cornerstone of all kinds of other hacking campaigns. Just some of the high profile examples from the news this year include fake voicemail messages being used to lure victims into entering their Office 365 email credentials into a phishing page, Thomas cook customers being targeted by phishing attacks in the wake of the travel company going into receivership, and news of Lancaster University being hit by a large, sophisticated phishing attack aimed at grabbing the details of new student applicants.

Verizon’s 2019 Data Breach Investigations Report showed that 32 per cent of data breaches involve phishing. Phishing threats to businesses are also evolving and becoming more sophisticated all the time. For example, PhishLabs recently discovered a tactic whereby by attackers used a malicious Microsoft Office 365 app to gain access to a victim’s account without the need for the account holder to give up their credentials to the attackers!

The National Cyber Security Centre offers advice on how to protect your business/organisation from phishing attacks here: https://www.ncsc.gov.uk/guidance/phishing.

There is also a number of phishing test sites available online so that you (or staff members) can see if you’re able to spot a phishing email.

– Malware attachments to emails. There is a now staggering amount of malware types that businesses and organisations have to protect themselves against. For example, over 800 million different types were encountered in 2018, and some commentators are predicting that variants will reach over 1 billion by 2020!

A Number of Sources

Email-based attacks aren’t simply targeted just at your email system in a straightforward way but could come from e.g. supplier email systems that have been compromised or could use details stolen from breaches elsewhere as part of the campaign.

PROTECTING YOUR BUSINESS AGAINST E-MAIL THREATS

There are many ways that you can try to protect your email system from email attacks and try to minimise the risk of human error that is so important in social engineering attacks. These include:

HELP FROM THE BIG TECH COMPANIES

Microsoft

Microsoft offers a number of ways that businesses and organisations can help keep their email secure, such as:

– Outlook’s Junk Email Filter, and the Report Message add-in for Outlook.

– Office 365’s Advanced Threat Protection (ATP) plans which offer a variety of leading-edge tools to investigate, understand, simulate, and prevent threats.

– Secure Score for Office 365 – a way to measure and get suggestions about how to protect your business from threats, all through a centralised dashboard.

– The “campaign views” tool in Office 365 that is designed to offer greater protection from phishing attacks by enabling businesses to be able to spot the pattern of a phishing campaign over individual messages.

More information: The Microsoft blog here gives 6 email security best practices to protect against phishing attacks and business email compromise: https://www.microsoft.com/security/blog/2019/10/16/top-6-email-security-best-practices-to-protect-against-phishing-attacks-and-business-email-compromise/

Google

Google also offers a number of tools and suggestions, including:

– Advanced security settings for G Suite administrators to protect against phishing and malware (find out more here: https://support.google.com/a/answer/9157861?hl=en).

– Offering steps to identify compromised accounts (see https://support.google.com/a/answer/2984349?hl=en&ref_topic=2683865).

– Advice on Firewall settings.

You may, of course, already be using another email protection system.

Other Advice

Advice about ways in which you can protect your company now from email-based attack such as phishing and malware attacks is widely available, and in addition to the measures already covered (e.g. using Microsoft security tools), some basic measures that companies take include:

– Always keeping anti-virus and patching up to date.

– Staff education and training e.g. how to spot suspicious emails and what to do/what not to do e.g. not to click on links from unknown sources.

– Disabling HTML emails if possible (text-only emails can’t launch malware directly).

– Encrypting sensitive data and communications as an added layer of protection.

– Getting into the routine of checking your bank account’s activity for suspicious charges.

– Making sure important and sensitive company data is backed up and including business email compromise (BEC) in business continuity planning and disaster recovery planning.

– Preventing email archives from being publicly exposed e.g. by making sure that archive storage drives are configured correctly.

– Monitoring for any exposed credentials (particularly those of finance department emails).

– Using two-Factor Authentication (2FA) where possible, and enterprise users may wish to block .html and .htm attachments at the email gateway level so that they don’t reach members of staff, some of whom may not be up to speed with their Internet security knowledge.

– Not using the same password for multiple platforms and websites (password sharing). This is because credentials stolen in one breach are likely to be tried on many other websites by other cybercriminals (credential stuffing) who have purchased/acquired them e.g. on the dark web.

Looking Forward and Getting Prepared

In today’s environment, attackers can adapt their campaigns and methods so quickly, and use methods that can evade the more common protection solutions (polymorphic attacks) that businesses and organisations find themselves in a position whereby known signature and reputation-based checks aren’t enough and that they need to be able to get a fuller picture and find solutions that can focus effectively on zero-day and targeted attacks in addition to known vectors. Looking forward, there is also the future threat of AI machine-learning software being able to possibly generate phishing URLs that can beat popular security tools, and of the threats posed (further in the future) buy the possible use of quantum computers in cyberattacks, and these are subjects that we will look briefly in part 2 of our look at email security. For now, stay safe.

New Phishing Tracker For Office 365

Posted on by Andy Miller

Microsoft is launching a new “campaign views” tool in Office 365 that is designed to offer greater protection from phishing attacks by enabling businesses to be able to spot the pattern of a phishing campaign over individual messages.

Context and Visibility

Microsoft is in a good position to leverage the large amount of anti-phishing, anti-spam, and anti-malware data and experience that it has across the entire Office 365 service world-wide to identify campaigns. It is this information that feeds into the campaign views tool.
The idea is that the extra context and visibility that campaign views provides gives the full story of how an organisation has been targeted. This additional dimension of defence means that an organisation and its users can see if/how defences have held up against popular attacks, and adjust its own defences accordingly, based on these insights.

What It Shows

The kind of information that the ‘campaign views’ tool can reveal to security teams includes:

  • A summary of a phishing campaign i.e. when it started, it’s pattern and timeline, the size and spread of the campaign, and how many known victims there has been (and see if users have clicked on the phishing link).
  • A list of IP addresses and senders associated with the attack, plus a list of all the URLs that were used in the attack.
  • A look at which messages were blocked, delivered to junk or quarantine, or allowed to get through to the inbox.

Today’s Attacks ‘Morph’ To Get Around Defences

Today’s email attacks are often the sophisticated output of factory-like cybercrime operations where new templates and variances can be rapidly created, generated, and scaled-up in a way that is designed to offer the best chance of maximising financial gain while evading detection and capture.

For example, in a single campaign, the attackers can make multiple changes and variants (morphs) e.g. changes in the sending infrastructure, the sending IPs and sending domains, sender names and addresses, URLs, and the hosting infrastructure for their attack sites. These morphs can, therefore, enable attackers to get around popular defence tactics such as blocking known bad URLs, sending IP address, or sending domains.

Value

Microsoft says that the extra context and visibility that ‘campaign views’ gives security teams means that they can be more effective and efficient. For example, once armed with the information that ‘campaign views’ provides, security teams can be better at remediating compromised/vulnerable users, improving the general security posture (by removing configuration flaws), investigating related/similar campaigns, and hunting and tracking any threats that have the same indicators of compromise.

What Does This Mean For Your Business?

Email is one of the main ways that cybercriminals can gain access to company systems and phishing campaigns are an all-too-common way to dupe businesses into clicking on links in often convincing-looking pages, thereby releasing the malware that causes so much damage, or imparting password and financial information. ‘Campaign views’ appears to be another potentially valuable tool in the cyber defences of businesses with its main strong point being that it gives a much fuller picture of real-world attacks. This additional context and data can help businesses to become much better prepared and more proactive in finding and closing the door on rapidly evolving email security threats.

Real-time Phishing Protection Now Available in Chrome

Posted on by Andy Miller

Google has announced real-time phishing protection with the help of improvements to ‘Safe Browsing’ which allow Chrome to check each new site you visit against a safe list stored on your computer and with Google so that Chrome can issue an instant warning if the site is thought to be suspicious or malicious.

Phishing Problem

As well as being sent to phishing pages via links in phishing emails, phishing links are also inserted into malicious advertisements and even direct messages on chat apps.

Also, even though Google’s existing ‘Safe Browsing’ feature adds thousands of new unsafe sites and to the blocklists of the web industry and Chrome already checks the URL of each site you visit/file you download against a local list which is updated every 30 minutes, Google has noted that some phishing sites are even able to slip through the 30-minute refresh window by switching domains quickly or by hiding from Google’s crawlers.

The multiple phishing threats coupled with the ability of some sites to side-step even a 30-minute time window are what have prompted Google to move into real-time phishing checks through Chrome.

Real-Time

Google’s new, improved protections via Chrome allow the inspection of the URLs of pages visited with Safe Browsing’s servers in real-time (local safe site list check + checks with Google) in order to be able to give users an instant warning that they may be on a malicious page as well as a prompt to change their password.

Google says that this real-time warning system on sites that are brand new can deliver a 30% increase in protections.

Password Issues

The issues of using weak passwords, password sharing, and the stealing of passwords through phishing are all-too-familiar threats. With this in mind, Google launched predictive phishing protections which can warn users who are syncing history in Chrome when they enter their Google Account password into suspected phishing sites. Google has now also expanded this protection to cover everyone signed in to Chrome (whether or not Sync is enabled) and the feature will also work for all the passwords stored in Chrome’s password manager.

This updated security feature now means that if you type one of your protected passwords (from Chrome’s password manager, or the Google Account password you used to sign in to Chrome) into an unusual site, Chrome will classify this as a potentially dangerous event.

What Does This Mean For Your Business?

Offering real-time phishing protection checks is one way to help Chrome users stay a step ahead of cybercriminals who have shown that they could even adapt their campaigns quickly enough to get past a sophisticated system that updates its security information every 30 minutes. This has to be good news for business and domestic users alike, and the flashing up of instant warnings on visiting new sites looks as though it could reduce the numbers of those who fall victim to phishing attacks as well as constantly reminding Chrome users of the risks that are ever-present on the Internet today and of how easy it would be to fall victim to ever-more convincing and sophisticated phishing attempts.

New Google ‘Interpreter’: Real-Time Translator For Your Mobile

Posted on by Andy Miller

Google has announced the rollout of its “interpreter mode” real-time translator on Assistant-enabled Android and iOS phones worldwide.

A Back and Forth Conversation

Google says that interpreter mode means that you can now use your mobile phone to have a “back and forth conversation with someone speaking a foreign language”. In fact, interpreter mode comes loaded with 44 languages, and since it’s integrated with the Assistant it’s already on your Android phone. Those with iOS can also use interpreter by downloading the latest Google Assistant app.

How To Use It

To operate interpreter mode Google says that all you have to do is say e.g. “Hey Google, be my German translator” or “Hey Google, help me speak Spanish”, after which you’ll be able to see and hear the translated conversation on your phone. Interpreter has some built-in ways to make your foreign language conversations faster and smoother, such as, after each translation, the Assistant presenting Smart Replies, and giving you suggestions that let you quickly respond without speaking.

Interpreter mode offers different ways to communicate which you can use according to your situation e.g. type using a keyboard for quiet environments, or manually select what language to speak.

Other Translation Tools Are Available

Google’s offering is not the only translation tool available for use on mobile devices. There are a number of different apps and services including iTranslate Voice, SayHi, TextGrabber (for reading foreign text), Microsoft Translator, WayGo, and more.

What Does This Mean For Your Business?

A recent EU survey showed that, sadly, only 38% of British people can speak more than one language and this statistic highlights a real need for this kind of service among UK people travelling abroad.

The Interpreter mode could clearly be very useful for business (and personal) trips overseas in removing language barriers. As well as allowing you to hold basic conversations without any personal knowledge of a language, it may prove very useful for things such as researching and checking travel/flight information, finding local restaurants and landmarks, getting recommendations, and holding business conversations which can sometimes involve the use of more complex and specialised words and terms in foreign languages.

Tech Tip – Read Without Distractions

Posted on by Andy Miller

If you need to read a web page without the distractions of adverts or unwanted recommendations, Microsoft Edge in Windows 10 provides an easy way to do this.

– In Microsoft Edge (top), click on the “Reading View” icon (open book symbol).

– Alternatively, type Ctrl+Shift+R.

How Does Encryption Work?

Posted on by Andy Miller

Encryption comes from the age-old science of cryptography.  In the digital world of today, encryption refers to using electronic devices to generate unique encryption algorithms which essentially scramble messages and data making them unintelligible to anyone who tries to intercept them, and also to provide an effective way to lock our electronic devices.

Using Encryption

Encryption can be used for most things that have an internet connection, such as messaging apps, personal banking apps, websites, online payment methods, files and more.

Why?

Cybercriminals seek our personal data (especially financial details) which they can find in our files, on our personals devices, and on websites / platforms and places online where we have submitted that data e.g. for registration/login, payment, in the form of emails and other messages, and our personal data may be stored in many different places (servers and databases) across the Internet and the digital world.

Verizon figures show that nearly one-third of all data breaches in 2018 involved phishing and that phishing was present in 78% of cyber-espionage incidents and the installation and use of backdoors.  Also, IT Governance figures, for example, show that 421,103,896 data records were confirmed to have been breached in October this year (still only 50% of the monthly average!) in111 incidents (including the compromising of sensitive and financial information).

A recent nCiper survey showed that the main driver for encryption is the protection of sensitive information and that organisations use encryption to protect intellectual property and the personal information of their customers.

Symmetric and Asymmetric Encryption

There are two main encryption methods, symmetric and asymmetric, both of which are made up of encryption algorithms, and the use of prime numbers forms a fundamental aspect of popular encryption methods.

Note: You will often hear the term ‘keys’ used as part of the explanation of encryption.  Keys in this sense means a random (but unique) string of bits that are generated by an algorithm to scramble and unscramble data.  Generally, the longer the key, the harder it is to break the encryption code.

Symmetric encryption uses the same (identical) key for encrypting and decrypting data. With symmetric encryption, two or more parties have access to the same key. This means that although it is still secure, anyone who knows how to put the code in place can also reverse engineer it.  Symmetric key encryption is generally used for encrypting large amounts of data efficiently e.g. 256-bit AES keys are symmetric keys.

Asymmetric encryption, on the other hand, uses a pair of keys, one for encrypting the data and the other for decrypting it. For the first key (used to encrypt data), ‘public key’ cryptography uses an algorithm to generate very complex keys, which is why asymmetric encryption is considered to be more secure than symmetric encryption (the code can’t be run backwards).  With asymmetric encryption, the public key is shared with the servers to enable the message to be sent, but the private key (owned by the possessor of the public key) is kept secret. The message can only be decrypted, therefore, by a person with the private key that matches the public one. Different public-key systems can use different algorithms.

Public Key Encryption – HTTPS

Public key encryption is widely used and is useful for establishing secure communications over the Internet e.g. for TLS/SSL, which enables HTTPS.  For example, A website’s SSL/TLS certificate is shared publicly and contains the public key, but the private key is on the origin server i.e. it is “owned” by the website.

Different Methods of Encryption

There numerous common encryption algorithms and methods.  These include:

  • RSA – Unveiled by three mathematicians back in 1977, RSA is a public-key encryption algorithm and a common standard for encrypting data sent over the internet.
  • Triple DES – designed to replace the original Data Encryption Standard (DES) algorithm and uses three individual keys with 56 bits each.  Triple DES is being used less frequently now but is still used in financial services and other industries.
  • Blowfish – also designed to replace the original Data Encryption Standard (DES).  This is a flexible and strong standard that is found in many different software categories e.g. e-commerce platforms (to protect passwords).
  • Twofish – One of the fastest, can be used in hardware and software environments, and (like Blowfish) is freely and often bundled in encryption programs.
  • AES – Advanced Encryption Standard (AES) is an incredibly strong encryption algorithm used by the U.S. Government, and likely to become the private sector standard in future.

Free Encryption

In addition to Blowfish and Twofish, other free encryption tools include LastPass (a popular password manager), VeraCrypt (available for Windows, OS X and Linux OS), and FileVault2 (good for encrypting data on macOS devices and Mac hardware).

Windows 10 includes its own encryption tool ‘BitLocker’ which enables you to use encryption on your PC’s hard drive and on removable drives.

End-to-End Encryption

End-to-end encryption is used to encode and scramble information so only the sender and receiver can see it. For example, WhatsApp uses end-to-end encryption and although the messages go through a server, none of those messages can be read by anyone other than the sender and receiver.

WhatsApp and its end-to-end encryption were criticised by Amber Rudd in 2017 (who was Home Secretary at the time) when it was revealed that the first London Bridge terror attackers used WhatsApp to plan the attack and to communicate.  This led to government calls for ‘back doors’ to be built-in to WhatsApp and other end-to-end encrypted communications tools to allow government monitoring.  These calls were resisted on the grounds that building back doors means that security is compromised, and cybercriminals could also exploit these back doors.

Fails

Although encryption provides effective security and privacy it is not always infallible. For example:

  • Back in May 2018, A German newspaper released details of a security vulnerability discovered by researchers at Munster University of Applied Sciences, in PGP (Pretty Good Privacy) data encryption. PGP is an encryption program that is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and disk partitions, and to increase the security of e-mail communications.
  • Also, in October this year a report by a former Google employee on the ‘Freedom of the Press Foundation’ website warned organisations that any data stored on Google’s G Suite is not encrypted, can be accessed by administrators and can be shared with law enforcement on request.

Quantum Threat

One on threats to existing encryption that many tech commentators fear in the near future comes from quantum computers.  For example, quantum computers can perform calculations much faster than classical computer and this could enable them to defeat the encryption that currently protects our data e.g. our online banking records and other personal documents on hard drives.  With people having access to (commercial) quantum computers, this could become a real threat (e.g. access to Quantum Systems are now being offered via the cloud).

As well as the quantum threat, there is also some concern among tech and security commentators about the encryption and anonymisation technology that is being used to hide criminal activity e.g. on the dark web

The Future

In the immediate future, therefore, some companies are seeking to address the threat from quantum computers cracking existing encryption algorithms. Estimates of when there will be commercially available quantum computers range between 10 and 20 years, although state-sponsored use of quantum computers for wrongdoing could conceivably happen sooner.

The National Institute of Standards and Technology is already pushing researchers to look ahead to this “postquantum” era.

Recently, IBM researchers developed two quantum-proof cryptographic algorithms (Kyber and Dilithium) which now make up the “Cryptographic Suite for Algebraic Lattices” (CRYSTALS).  These have enabled IBM to create the world’s first quantum computing-safe tape drive.

In the meantime, however, with cyber threats evolving at a fast pace, companies and organisations that don’t use encryption as one of their security tools are effectively making things too easy for cybercriminals to access their data, with potentially devastating consequences.

Facebook’s New Tool Allows You To Port Your Photos & Videos To Google

Posted on by Andy Miller

Facebook has announced that it is releasing a data portability tool that will enable Facebook users to transfer their Facebook photos and videos directly to other services, starting with Google Photos.

Why?

Facebook acknowledged in its white paper (published back in September) that under GDPR currently, and under the California Consumer Privacy Act rules next year, data portability is a legal requirement. Also, Facebook said that it had also been considering ways to improve people’s ability to transfer their Facebook data to other platforms and services for some time e.g. since 2010 Facebook has offered Download Your Information (“DYI”) to customers so they can share their information with other online services.

In addition to the legal requirements and Facebook’s existing DYI service, Facebook highlights its own belief in the principle of data portability, and how this could give people control and choice while encouraging innovation as the reason for the introduction of its new data portability tool.

What Is It?

Facebook says that its new photo transfer tool (the roll-out has just started) is a tool based on code that has been developed through participation in the open-source Data Transfer Project and can be accessed via Facebook settings within Your Facebook Information.

The tool will enable Facebook users to transfer their Facebook photos and videos directly to other services (Google Photos first).

The first part of the roll-out is in Ireland with worldwide availability planned for the first half of 2020.  Facebook says that the tool is still essentially in testing and that it will be refined based upon feedback from users and from conversations with stakeholders

Help From The Data Transfer Project

One of the key factors in the development of the portability tool was Facebook joining the Data Transfer Project (along with Google, Microsoft, Twitter, Apple, and others) which is an open-source software project that’s designed to help participants develop interoperable systems that will enable users to transfer their data seamlessly between online service providers.

What Does This Mean For Your Business?

Facebook has been offering its DYI service for nearly 10 years, but the new portability tool is something which will enable Facebook to meet its legal requirements under GDPR and the CCPA while helping Facebook to stay competitive with other online services.

Facebook is also acutely aware of the damage done to user trust over the data sharing with Cambridge Analytica, which is why the recent white paper that Facebook published about its portability ideas clearly acknowledged that portability products need to be built in a privacy-protective way.

For Facebook users, this new tool may be one of the many new services that help them to be more trusting of Facebook again by making them feel that they have real options and choices about what they do with their files from Facebook (even though it’s a legal requirement to give people the portability option).

Over Half of Businesses Don’t Respond To GDPR Requests On Time

Posted on by Andy Miller

The results of a survey by Talend show that 58% of businesses worldwide fail to address requests from individuals for a copy of their personal data within the one-month time limit as required by GDPR.

Bad, But Better Than Last Year

The survey, which involved 103 GDPR-relevant companies across the globe (84% of which were EU-based companies) revealed that more than 18 months after the General Data Protection Regulation (GDPR) came into force, most companies are still not complying with the Regulation when it comes to data requests.

Even though a 58% failure to comply rate is not good, it is an improvement on 2018 when 70% of the companies surveyed reported they had failed to provide an individual’s data within one month.

Public Sector, Media & Telecoms Worst Offenders

The Talend survey revealed that only 29% of public sector organisations and only 32% of companies in the media and telecommunications industries were able to respond with the correct data within the one-month limit, putting them at the bottom of the compliance table for this issue.

Average Performers

The survey also showed that companies in the retail (46%), financial services, travel, transport and hospitality sectors barely achieved an average response rate within the one-month limit. This, however, was a small improvement on the previous year.

Why?

According to Talend, the lack of a consolidated view of data and clear internal ownership over pieces of data, and a lack of automation in processing requests are key reasons why companies are failing to respond to data requests within the legal time limit.

In some industry sectors too (e.g. financial services), retrieval of the information may be complicated by clients perhaps having many different contracts with the same company with their data being spread across different offices and systems.  This, coupled with the fact that processing data requests is often manual, time-consuming, and, therefore, costly (“spend, on average, more than $1,400 to answer a single SRR” – Gartner) goes some way to explaining the slow response. (SRR means subject rights request)

Also, there is a lack of proper ID checks by companies where data requests are concerned with only 20% asking for ID, and there have also been reports of companies struggling to find the right email address to send the data requested to.

What Does This Mean For Your Business?

With GDPR becoming law 18 months ago, the potential fines for non-compliance being large, and with companies and organisations having appointed specific people to be in charge of data management and security, these results do look a little disappointing on the surface, and many businesses would expect to do better.  However, GDPR has brought a much larger volume of data requests for some organisations and back in June it was even reported by law firm Squire Patton Boggs that one year on from the introduction of GDPR, companies were facing cost pressures from a large number of subject access requests (SARs) coming from their own employees.

Nevertheless, the shift in responsibility towards companies that GDPR has brought, and the widespread knowledge about GDPR is a reminder also, that companies really should have a system and clear policies and procedures in place that enables them to respond quickly and in a compliant way to data requests, whoever they are from.