Data protection training: a lesson from the Met
The Metropolitan Police has admitted up to 70% of its officers have not completed mandatory data protection training. This admission was made to the London Assembly following ICO findings of serious errors.
The ICO issued the Met with an enforcement notice and a reprimand following an investigation into two separate incidents. One involved the disclosure of unredacted documents which revealed a woman’s details to her alleged stalker. The other incident was a bulk email disclosing the identities of people linked to a high-profile criminal investigation. In the latter case, the ICO found the officer who sent the email hadn’t completed data protection training for more than four years.
The ICO found multiple weaknesses in the Met’s data protection training compliance, monitoring and governance. The Met has been given up to twelve months to up its game.
Why data protection training matters
The ICO expects all organisations to provide data protection and information security training for employees, with regular refresher training. The regulator also expects more specialist training for employees in particular roles, where relevant. Training records are one of the first things the ICO will check when investigating a personal data breach. Organisations would therefore be wise to track completion rates and treat persistent gaps as a data protection risk.
But it’s about more than this. I worry some organisations may treat this as a box ticking exercise. Grab a generic training module and get everyone to complete it on a yearly basis. This might tick one compliance box, but doesn’t necessarily arm your people with the understanding they need.
Your people are your greatest asset. Without appropriate training and knowledge employees can unwittingly make mistakes with potentially serious consequences. The quality of the training really matters.
Over the years I’ve reviewed numerous off-the-shelf data protecting training modules for clients and found hugely varying quality. Some contain glaring errors. Some feel irrelevant in the context, using examples and scenarios which just wouldn’t resonate with that organisation’s employees.
By the way, checking the training has been completed matters too!
What approach to take?
Each organisation needs to decide what approach works best for them. Some organisations, and indeed certain teams within those organisations, will handle much more sensitive data than others. But other employees may have very limited contact with personal data in their day-to-day roles.
Some may need to know how to conduct a DPIA, while others need to understand the nuances of fulfilling Data Subject Access Requests. There are the teams who need to understand more about supplier due diligence, controller to processor contracts and the rules for international data transfers, and so on.
How the core data protection principles and lawful bases are applied in practice also varies enormously for different business functions from marketing to operations, from HR to a contact centre. For example;
⏹ Marketers need to understand the rules for consent and legitimate interests, the right to opt-out, what the law says about profiling, and so on. Crucially they need to understand how UK GDPR interplays with the marketing and ‘cookie’ rules under the Privacy and Electronic Communications Regulations (PECR).
⏹ HR teams need to understand how data protection laws apply to recruitment, diversity monitoring, right to work and DBS checks, performance reviews, disputes and grievance, occupational health referrals, and so on.
‘All’ staff training
Often to cover baseline training for all employees, organisations will look to use outsourced providers’ data protection training modules. Alternatively, they may customise an external solution or develop their own training content internally.
If you use a generic outsourced module, unless you can modify it, it’s worth bearing in mind this is unlikely to include some very important messaging such as;
⏹ How to internally report a suspected or known data breach within your organisation
⏹ Who to forward privacy rights requests to
⏹ Where to go to check if a new project needs a DPIA
⏹ Which AI models they’re permitted to use and for what purposes
To be effective, additional internal materials might be needed such as policies, guides, factsheets, short videos and so on.
If you have certain roles where people’s handling of personal data is very limited, you may decide making them sit through an online training module really isn’t necessary. You could choose different methods to pass on simple, relevant and important ‘dos and don’ts’ relevant to their job, e.g. via their manager.
Specialist training
Training is likely to be most effective if it’s bespoke or tailored to the needs of the organisation and specific functions or teams. It’s helpful to provide relevant examples, such as user-journeys or case studies.
This, of course, could become time consuming and costly, so a balance needs to be struck between the benefits and resources you have. It can help to think about where the biggest risks lie in your organisation, so you can focus your efforts on the key teams which have greater exposure to, and influence, over data risk.
Does training need to focus on the sales & marketing teams, HR team, customer-facing teams, project managers and developers – anyone else?
What about SMEs?
If you’re a small or medium-sized organisation, you won’t be expected to have the kind of comprehensive training programme a large organisation would have. The ICO recognises this and has produced Data Protection Essentials, a free online training and self-assessment programme for organisations with fewer than 250 employees which don’t have a Data Protection Officer. It’s worth noting this is not aimed at smaller organisations carrying out high-risk processing.
I can’t vouch for it personally, as I haven’t been through it myself, but hopefully it’s hard to go wrong with something created by the regulator. And if it’s got anything wrong, that’s surely a pretty good excuse!
To sum up, making sure people have the right skills and knowledge for your organisation is one of the best ways to reduce the chances of data protection risks being overlooked and mistakes happening. And it’s advisable not to let this lapse for years like the Met did.
There are no legal requirements or rules about how this is delivered. Training doesn’t have to be provided in a specific format and there’s nothing to say you can’t be creative. Some organisations use online games, escape-room style challenges, bite-sized videos, ‘win a prize’ quizzes and so on. If you can add some humour all the better, a cheesy joke just might make a key message hit home. After all some of the cheesiest adverts are the ones we remember.