The Shared Spreadsheet at Ballyduff Community Trust
Ballyduff Community Trust is a charity with 3 paid staff and 42 volunteers. It holds records for 2,800 donors and 900 grant applicants in a single spreadsheet on a cloud drive, shared as "Anyone with the link - Editor", because volunteers work different evenings. Columns include full name, home address, email, phone, donation amount, and a free-text notes field where staff write things like "mentioned she is undergoing treatment" or "son has additional needs". The monthly newsletter is sent by pasting all 3,000 addresses into the To: field. Last month a volunteer's laptop was stolen from a car; it held an offline copy of the file with no login password and no disk encryption. A local journalist has emailed asking whether a named donor is on the charity's books. The trust has no privacy notice and nobody has been made responsible for data protection.
1. Identify the data protection failures in this setup and rank them by risk. Justify the ranking rather than just listing.
Read the worked answer
Rank by likelihood × number of people affected × sensitivity.
1. Newsletter in the To: field (already happening, monthly). This discloses 3,000 email addresses to 3,000 recipients, some of whom are grant applicants who may not expect the two groups to be linked. It is a personal data breach occurring on a schedule, it is trivial to fix (BCC, or better a mailing service with per-recipient unsubscribe links), and it is the single largest population affected.
2. The notes field. Health information and information about a child's additional needs are special category data. Holding them in a free-text box means the charity cannot say what it holds, cannot apply a retention period, and cannot honour an erasure request cleanly. The legal risk is disproportionate to the charity's size, and the fix is mostly deletion: stop recording it, and scrub what exists.
3. "Anyone with the link - Editor". No authentication, no audit trail, no way to revoke access for the 20 volunteers who have since left. Anyone who ever received the link retains edit rights forever.
4. The stolen laptop. Low likelihood, high impact - but it has already happened, and it is aggravated by storing special category data in an unencrypted local copy.
5. No privacy notice, no named owner. Not itself the cause of the harm, but it explains why every item above went unnoticed.
2. Redesign how the trust stores and shares this data, given 3 staff, 42 volunteers, and roughly no budget. Explain how each measure addresses a specific failure.
Read the worked answer
Access control. Replace link-sharing with named accounts on the drive, one per person, and revoke on exit as a checklist item. Better, split the file: a donors sheet the 3 staff see, and a volunteer view containing only name, email, and the events they helped at. That applies data minimisation and need-to-know together, and it means a leaked volunteer link exposes 40 fields' worth less.
Storage. Move the records out of a shared spreadsheet into a simple database or a properly permissioned donor-management tool (many are free or heavily discounted for registered charities). A spreadsheet has no row-level permissions, no audit log, and no way to enforce a retention period - that is not a training problem, it is the wrong tool.
Notes. Agree a rule: no health or disability information in free text. If the charity genuinely needs it (say, dietary requirements for an event), it goes in a specific field with a defined retention window, not a catch-all box. This is the cheapest fix and the highest-value one.
Devices. Full-disk encryption and a login password on every laptop and phone that ever holds the file, plus a rule that offline copies are deleted when no longer needed. Encryption does not stop the theft, it stops the disclosure.
Comms. A mailing service with BCC-equivalent sending and one-click unsubscribe; a short privacy notice stating what is held, why, and for how long.
Ownership. Name one staff member as data protection lead, with a written one-page procedure for access requests and incidents. A 3-person charity cannot rely on everyone remembering.
3. What must the trust do now about the stolen laptop, and how should it respond to the journalist's question about the named donor?
Read the worked answer
The laptop. Treat it as a suspected personal data breach and run a short assessment: what exactly was on it, was it encrypted, whose data, how sensitive (here: addresses plus special category notes → high risk). Because the loss is likely to result in a risk to people's rights and freedoms, the charity must notify the Data Protection Commission without undue delay and within 72 hours of becoming aware, describing what happened, the categories and approximate numbers affected, the likely consequences, and the measures taken. If the assessment concludes a high risk to individuals - an unencrypted file with health notes suggests it does - the affected people must be told directly and clearly, so they can watch for fraud or phishing. Write down both the decision and the reasoning, including if the conclusion is not to notify; the record is the defence. Fix the device policy the same week.
The journalist. Do not confirm or deny anything about an identifiable person, and do not send data. A journalist is not the data subject and has no right of access to someone else's record. Ask for the request in writing, and if the donor themselves later makes a subject access request, verify identity, respond within one month, and provide a copy of their data plus the purpose and recipients. Point the journalist to the charity's public privacy notice and press the DPC's guidance if pushed. Also tell the donor that an enquiry has been made, since they are the person whose interests are at stake.
The general point: "we are a small charity" is not a lawful basis, but proportionality is real - the response should scale to actual risk, not to panic.