The Data Breach at the Events Company
You work for an events company managing a 2,000-delegate conference. A staff member accidentally emails the delegate list, including names, email addresses, and dietary requirements, to an external supplier instead of an internal colleague. The list also includes 40 delegates who asked not to be contacted by sponsors. The supplier is a catering company that has signed a confidentiality agreement. The error is discovered two days later. The conference is in three weeks. Your manager asks you to handle it.
1. Explain the privacy issues and the steps you must take, including whether the breach is notifiable.
Read the worked answer
The delegate list is personal information, and dietary requirements may imply health information, which is sensitive information. The company must protect it and only use it for the purpose collected. Sending it to an external supplier is a disclosure, and the 40 delegates who opted out make the risk higher. The company should contain the breach by contacting the supplier, asking them to delete the email and confirm in writing, and not to use or share the data. The company should assess the risk of serious harm. If there is likely serious harm, it may be a notifiable data breach and the regulator and affected individuals should be notified. Even if not notifiable, the company should consider informing affected delegates. Record the breach, the assessment, and the actions. Review the email process, use secure sharing, and train staff.
2. How would you communicate with delegates and the supplier, and what would you change to prevent recurrence?
Read the worked answer
To the supplier, send a clear written request to delete the email and any copies, confirm destruction, and remind them of the confidentiality agreement. To delegates, if notification is required, explain what happened, what information was involved, what has been done, and what they can do, such as watching for phishing. Apologise and provide a contact. For the 40 who opted out, be especially careful and confirm their details are not used by sponsors. To prevent recurrence, use a secure portal or password-protected file, restrict the distribution list, require a second check before sending external emails, and train staff on privacy. Review the supplier agreement and the consent process for sponsor contact.
3. The conference is in three weeks. How do you manage the operational risk while handling the breach?
Read the worked answer
Separate the privacy response from the event delivery. Assign one person to the breach response and keep the event team focused on the conference. Check whether the supplier's catering role is affected and whether a replacement is needed. Confirm the delegate list used for badges and catering is the correct version. Brief the registration team on what to say if delegates ask. Keep a log of actions and deadlines. Escalate to senior management and legal if needed. After the event, conduct a review and update the privacy policy and procedures.