Hello.

This is April’s newsletter, covering the last month of ICO activity.

We’re feeling nostalgic over here. We’re celebrating our 40^th anniversary, marking the occasion with an exhibition. We’re showcasing 40 objects that encompass 40 years of the ICO, which we unveiled at our Back to the Future event in November. We had speakers with a breadth and depth of knowledge and experience, speaking about a common theme – what privacy meant to them, and what object they would add to our exhibition’s empty plinth.

The millennium bug. A school dinner tray. A Tesco Clubcard. An unlikely group, but three objects that were chosen to represent privacy.

This week I was pleased to officially open our physical exhibition for public viewing at Manchester’s Central Library. Seeing our 40 objects, and the stories behind them, I was struck at just how wide-ranging and encompassing our work is. Data protection lies behind some huge stories from the past 40 years.

We’ve witnessed a lot of change in that time, from the launch of social media to new laws giving you the right to access information. And yet, in many ways, very little has changed. The use of our personal information can either improve our lives or cause us harm.

I’d encourage you to go and visit the exhibition in person if you can. It’s available in Manchester Central Library until 30 June and you can see more details on our website.

If you can’t go in person, don’t worry. We have our online exhibition up and running, which includes videos and quotes from people who were part of the story, including previous Commissioners. You can see that, anywhere and at any time, on our website.

Privacy is unique. It means something different to each of us. There are things we're happy to share and things we like to keep private. There are technologies and services we trust and others that we are more suspicious of.

What item from the past 40 years would you add to our exhibition? We’d love to hear the stories behind the objects you put forward. Our empty plinth is waiting for your submissions. You can share your ideas with us on social media, using the hashtag #OurLivesOurPrivacy.

Our investigation found that hackers accessed certain systems of Advanced’s health and care subsidiary via a customer account that did not have multi-factor authentication. 

Advanced’s subsidiary didn’t have the appropriate technical and organisational measures in place to keep its systems secure prior to the attack. This included gaps in the deployment of multifactor authentication, a lack of comprehensive vulnerability scanning and inadequate patch management.

❔ What can organisations learn from this case? 

➡️ Regular vulnerability scanning and a robust patch management process helps to identify and address security issues promptly and is essential for maintaining the security of sensitive data.   

➡️ Ensure you have suitable access control in place and multi-factor authentication.  

➡️ Processors have a role to play – while as a processor you may have less independence over the data you process, there are legal obligations you must follow, including strong security measures.

In case you missed it: DPPC is back for 2025!
 

Our free virtual flagship event, the Data Protection Practitioners' Conference (DPPC), is happening on 14 October 2025.

Aimed at people working in data protection, there will be something for everyone regardless of your experience or sector. Last year, more than 5,700 people tuned into our award-winning conference. 97% of them said they found the conference useful and 85% told us they learned something new.

So, put the date in your diary and sign up today. 

You can catch up with what happened at last year’s event on our dedicated DPPC pages.