Justice department blamed for personal data loss

The department of justice & constitutional development violated the Protection of Personal Information Act, resulting in the loss of more than 1,200 files.

The information regulator issued an enforcement notice to the department this week for a September 2021 IT systems security breach that led to department systems being unavailable, affecting services to the public, said the regulator.

The regulator conducted an assessment and found the department “failed to put in place adequate technical measures to monitor and detect unauthorised exfiltration of data from their environment, resulting in the loss of about 1,204 files”, said spokesperson Nomzamo Zondi.

The breach was caused by the department’s failure to renew the security incident and event monitoring licence that expired in 2020. This licence enables it to monitor unusual activity and back up log files.

Failure to renew the licence resulted in critical information in the files being unavailable, Zondi said. The department failed to take reasonable steps to foresee internal and external risks that may have arisen related to the personal information under its control. “In this regard, the department failed to establish and maintain appropriate safeguards against the risks identified and to regularly verify and update the security safeguards against malware threats.”

As the department was found to be in breach of the act’s sections 19 and 22, the regulator ordered it to take steps to protect information under its care, such as submitting proof to the regulator that the licence had been renewed. Disciplinary proceedings should also be instituted against officials who failed to renew the licence necessary to safeguard against department security breaches, said Zondi.

It will be an offence if the department fails to comply with the enforcement order within 31 days. Penalties were a fine of up to R10m and imprisonment of responsible officials.