Chapter 8 — Privacy and data protection: failure modes
Lesson map
Lesson 08 published. Map, example, EX029.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Ways controls fail"]
N2["8.2 Classifying failures"]
N3["8.3 Detection design"]
N4["8.4 The reminder case"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX029"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Ways controls fail"]
N2["8.2 Classifying failures"]
N3["8.3 Detection design"]
N4["8.4 The reminder case"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX029"]
[Learning outcomes]
|
v
[8.1 Ways controls fail]
|
v
[8.2 Classifying failures]
|
v
[8.3 Detection design]
|
v
[8.4 The reminder case]
|
v
[Worked example] --> [Exercise EX029]
Learning outcomes
You will (1) identify how privacy controls fail; (2) classify failures; (3) design detection for each.
8.1 Ways controls fail
Leila lists ways that privacy controls can fail at Marlow: an SMS reminder sent to an old phone number now used by someone else, a referral letter emailed to the wrong clinic, an X-ray exported to a USB stick and lost, a former locum's account still active, and an automatic deletion job that stops running. She notes that most failures are not attacks but ordinary errors or silent breakdowns, and that each can expose health information about a patient to someone who should not see it.
8.2 Classifying failures
She classifies failures into four types. Wrong recipient failures send data to the wrong person. Over-retention failures keep data too long. Over-access failures let people see more than they need. Silent control failures happen when a protective job or setting stops working without anyone noticing. The classification helps her choose controls: wrong recipient failures need checks before sending, over-retention needs deletion jobs, over-access needs role design and silent failures need monitoring that someone actually reads. Each past incident at Marlow is tagged with one type, and wrong recipient turns out to be the most common.
8.3 Detection design
For each failure type, Leila designs a way to notice it. Wrong recipient emails are detected through staff reports and an outbound warning for external addresses. Over-retention is detected by a monthly query of the oldest records. Over-access is detected by reviewing audit logs for views outside a staff member's clinic. Silent failures are detected by jobs that report success daily, so that a missing report triggers an alert. She notes that a control without detection may fail for months before anyone notices.
8.4 The reminder case
Leila studies the old phone number case in detail. A patient changed numbers but did not tell the clinic, and the new owner of the number received reminders naming the patient and the clinic. Leila recommends that reminders contain only the clinic name and time, not the patient's full name or treatment type, and that reception confirms phone numbers at each visit. The data protection officer treats the original event as a personal data breach and records it, even though the risk was assessed as low.
Worked example
Leila lists failures, classifies them as wrong recipient, over-retention, over-access and silent failure, designs detection for each and reduces reminder content after a wrong-number case.
Synthetic case. Failures are synthetic; GDPR Article 33 breach recording is real.
Errors and limits
Detection depends on people acting on alerts; assign owners.
Exercises
- EX029 — Four types. Name the four failure types. Rubric: 3 = wrong recipient, over-retention, over-access, silent failure;; 2 = all;; 1 = two;; 0 = none.
- EX030 — Silent detection. How are silent failures detected? Rubric: 3 = jobs report success daily; missing report alerts;; 2 = mentions daily;; 1 = vague;; 0 = none.
- EX031 — Reminder content. What should reminders contain now? Rubric: 3 = only clinic name and time;; 2 = partly correct;; 1 = full details;; 0 = none.
- EX032 — Breach recording. Why was the wrong-number case recorded? Rubric: 3 = it was a personal data breach even if low risk;; 2 = mentions breach;; 1 = vague;; 0 = none.
Continue studying — lesson 08 (chapter 08 of 18)
← Chapter 07 · Course chapter index · Chapter 09 →
Continue to the next authored lesson.