As a web development agency we're currently taking on a site rebuild for a recruitment agency. The current site allows applicants to register as temporary workers for the agency ( our client ) who will then be assigned short-term contracts as and when required.

The application form on the current site for these workers captures and enormous amount of really sensitive data including bank details, contact details, education and even detailed medical history of the applicant. Amazingly it does this on a regular HTTP connection without SSL, and the data is stored in a mysql DB also used by the site. IMHO it's negligent at best.

Our client wants the same behaviour on the new site we're developing, but obviously we have strong concerns about the legality and the security concerns of implementing the current business logic.

Can anyone give any guidance about what can legally be stored, how best to store the information and maybe any alternative scenarios that we can put to the client? To clarify we're subject to UK (EU) data protection laws for this site.

Obviously the first step we're taking is to serve the new site via HTTPS, but other than that the best we can come up with so far is to just capture the non-sensitive information, and require the recruitment agency to make separate enquiries of the applicants to obtain the nasty stuff like bank account numbers and medical history.

any help much appreciated......

  • Unfortunately you figured it out wrongly. If at all, it's law.stackexchange.com which is appropriate. – techraf Dec 8 '16 at 8:10
  • I admit this is a bit of a shot in the dark... – bharling Dec 8 '16 at 8:19

When talking about data protection, you can refer to this page for the UK. The gist of it is below:

Everyone responsible for using data has to follow strict rules called ‘data protection principles’. They must make sure the information is:

  • used fairly and lawfully
  • used for limited, specifically stated purposes
  • used in a way that is adequate, relevant and not excessive accurate
  • kept for no longer than is absolutely necessary
  • handled according to people’s data protection rights
  • kept safe and secure not transferred outside the European Economic Area without adequate protection

There is stronger legal protection for more sensitive information, such as:

  • ethnic background
  • political opinions
  • religious beliefs
  • health
  • sexual health
  • criminal records

Now the part that says "kept safe and secure" is to be implemented based on the interpretation of the person implementing the security. The fact is that a judge will look at the measures you took and then deem if those measures were adequate.

There is no law that says you need to use HTTPS perse, but not using it might be considered as not inline with the industry good practices. Therefore meaning you are not adequately protecting the information.

Note that there are many other things to consider as well such as regular patch management, controlled change management,etc... . With regard to medical info there will be even more stringent measures they would expect to be in place, including a good auditing and accounting system to supervise who accessess what records at what time.

In terms of fines the GDPR which supersedes the DPA prescribes penalties – up to 4% of annual global turnover or €20 million.

| improve this answer | |
  • Thankyou, this is a helpful distillation. It is confusing unfortunately, it would be handy if some part of the legal guidance said you need to configure servers in X arrangement, and use Y security protocols etc. – bharling Dec 8 '16 at 8:21
  • regarding access to the data, they have already granted us as the new agency complete access to the data they currently hold which is scary! – bharling Dec 8 '16 at 8:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.