Joint investigation launched following Prospect data breach

It involves the information commissioners from the UK, IOM, Jersey and Guernsey

A joint investigation's been launched by the UK and all the Crown Dependencies into a cybersecurity incident involving Prospect Union.

It's the first time all four jurisdictions have collaborated an investigation.

The incident happened in June, when the union's data was compromised in an attack.

It has more than 160,000 members, including around 2,200 in the Isle of Man, and holds members' personal information including financial data and sensitive information like ethnic origin, sexual orientation, disability, and religious belief.

The investigation is looking at the scope of personal information exposed, the potential harms, whether Prospect had adequate measures in place to protect the data it holds, whether it upheld its notification obligations and if it took appropriate steps in its initial response to the incident.

Dr Alexandra Delaney-Bhattacharya, Isle of Man Information Commissioner, said: "People place enormous trust in organisations when they hand over their personal information, and that trust must be honoured. By undertaking this coordinated investigation into the incident at Prospect, we are strengthening our collective ability to safeguard individuals’ data."

John Edwards, UK Information Commissioner said: "When people share their most sensitive information with an organisation, they do so with the expectation that it will be handled responsibly and securely. 

"We will be scrutinising the cyber incident at Prospect to check whether those expectations were met. This joint investigation demonstrates our determination to work more closely with our international counterparts to ensure that data protection standards are upheld across all jurisdictions."

Data protection legislation allows the authorities of the UK, Guernsey, Jersey and Isle of Man to work together on matters of impact across the jurisdictions and each regulator will investigate compliance with the law that it oversees.

The information commissioners say the opening of the investigation should not be taken to mean that a conclusion has been reached about whether Prospect has, or continues to, infringe data protection law.

No further comment will be made while the investigation is ongoing.