[BreachExchange] 6.9 Million Dutch Donors Face Identity Theft Scare

[Destry Winant]

https://www.cisomag.com/6-9-million-dutch-donors-face-identity-theft-scare/

Earlier this week, BRIC, an implementing body of the ministry that
manages the Dutch donor register, informed Hugo de Jonge, the Dutch
Minister of Health, Welfare, and Sport, of the physical loss of two
external backup hard drives (HDD). The Minister, in turn, wrote a
letter to the Parliament informing them that these hard drives
contained 6.9 million donor records registered from 1998 to 2010. The
physical loss of these drives has sparked concerns of identity theft
among registered Dutch donors.

BRIC began digitizing the donor records in 2011, wherein, the
paperwork was replaced by a digital version. The backup of these
records is maintained in external HDDs which are kept in a highly
secured and guarded vault. BRIC recently started disposing of the
paper archive of the Donor Register as part of their physical document
clean-up process. The cleanup guidelines suggested to check for a
corresponding digitized copy of the donor record and only then proceed
with the physical destruction of the paper record.

While doing so, the agency discovered that two backup HDDs were
missing from the vault. To make it worse, BRIC’s spokesperson
confirmed that the drives were unencrypted. The donor details in these
drives include donor details such as first and last name, gender, date
of birth, the then-address, organ donation choices, identification
numbers and a copy of the user’s signature.

However, BRIC has maintained that the data stored on the drives do not
contain “special personal data” as mentioned under GDPR and thus the
risk of identity theft is very low. The loss of drive and
corresponding Dutch donor records has already been reported to the
Dutch Data Protection Authority and, as of now, the investigation
revealed no incidents of identity theft.