Scamlink Legitimate Interests Assessment
Introduction
The following is a record of the legitimate interests assessment that Cifas has carried out for the processing of personal data within the Scamlink Signal Sharing Programme. It identifies the processing involved and the legitimate interests that exist in relation to Scamlink, and the balance of those interests is considered in conjunction with the safeguards that exist.
What processing is there?
Scamlink Signal Sharing is a product designed to share data relating to scams. We work with our member organisations and with our partners to detect, disrupt, and stop further scam activity.
When a customer of our members reports that they have been affected by a scam, our members ask for details of how the scam was carried out. Our members will collect the following data, known as scam “signals”:
- URLs including social media handles
- IP addresses
- Domain names
- Email addresses
- Phone numbers
These signals are from and are about those individuals carrying out the scam. Importantly, signals do not include any details of those affected by a scam.
Our members will then share the signals they have collected with Cifas.
We will then pass on those signals to relevant partners, who will use this information to protect others against scams, prevent financial loss and disrupt the methods used to carry out scams. Our partners include Meta and the Global Signal Exchange (GSE). We do not pass on to our partners the name of the member who shared any specific signal.
Cifas may also share signals received as part of Scamlink with our Intelligence team for further analysis. These signals may then be distributed (e.g. if there are notable patterns) to members as intelligence reports through our Intelligence Service.
Our partners will share with us general aggregated feedback on how signals have been used.
What are the legitimate interests?
The General Data Protection Regulation gives fraud prevention as an example of a legitimate interest (Recital 47). Scamlink is intended to support the prevention and detection of scams and fraudulent conduct by enabling the effective sharing of scam signals between Cifas members, Cifas and relevant partners.
It is also in the legitimate interests of members and partners to prevent and disrupt fraud in the form of scam activity, in order to be able to continue in business by providing its products or services, and protect their reputation. For partners, scam signals are invaluable for investigating and suspending account information for preventing future fraudulent conduct.
Cifas has a legitimate interest in enabling members, partners and customers to prevent fraud to carry on its business in preventing fraud.
It is a key legitimate interest of victims of scams and the wider public that fraud against them is prevented. Scams can cause financial loss, emotional harm and loss of confidence in online platforms, financial services and digital communications. By improving the ability of relevant organisations to identify, investigate and disrupt scam activity, Scamlink supports the wider public interest in reducing fraud and financial crime. It is important for consumers to have access to realistically obtainable financial products, and other goods and services, which may otherwise be unavailable or limited if widespread fraud occurs.
Is the processing necessary?
The processing is necessary because the benefits set out above cannot be achieved to the same standard without the sharing of scam signals to Cifas members and partners.
Scammers commonly operate across sectors and platforms, and the same signal may be used repeatedly until it is identified and disrupted. Sharing signals through a coordinated scheme enables relevant partners to investigate and take action more effectively than fragmented or ad hoc reporting by individual organisations. This action includes identifying and closing down accounts which prevents further scam activity.
The sharing of certain mandatory signals is necessary so that scam activity can be properly identified and disrupted. Sharing the full signal is also necessary because a hashed, redacted or obscured version would materially reduce the ability of partners to identify matching accounts, communications, domains or other indicators of scam activity.
Direct reporting to law enforcement already takes place, but law enforcement bodies do not have the same platform access, moderation tools or technical capabilities as the platform and technology partners that can take disruptive action in relation to their own services.
Obtaining consent and preference management are not feasible in this context. Notifying individuals whose signals are included may prejudice the purpose of the processing by alerting individuals involved in scam activity to what has been detected, allowing them to change their approach before disruptive activity can take place. This defeats the purpose of fraud prevention.
Scam prevention is a non-competitive issue and as a not-for-profit membership organisation, Cifas is trusted by organisations public and private to ensure that the data sharing is lawful, reciprocal, and fair.
Balancing the interests
It is reasonable to expect that organisations will take steps to prevent scam activity against themselves, their customers, and the wider public. Members of Cifas using Scamlink and potential victims of scam activity face millions of pounds in losses each year. Scamlink helps its members and partners safeguard individuals from scams. If those losses are not prevented or reduced, then consumers will continue to feel the emotional, psychological and financial impacts of being a victim of crime and the costs of financial products would be higher – a significant negative impact upon the wider public.
The individuals whose personal data may be included in scam signals have interests and rights in relation to how their personal data is used. The use of their data may have an impact on those individuals, particularly where a partner uses a signal as part of wider investigation or moderation activity. Possible outcomes may include account suspension or deletion, or referral to law enforcement.
However, the processing is directed at signals associated with reported scam activity. Those engaged in scams or associated fraudulent conduct should reasonably expect that information used in the course of such activity may be shared and used to prevent crime, protect others and support investigations. The interest in preventing and disrupting scams is strong, particularly given the potential financial and non-financial harm caused to scam victims and the wider public.
Accuracy is a relevant factor in the balance. Cifas does not independently verify or validate each signal, but the risk of inaccurate signals is mitigated by the structure of the scheme. Signals are submitted by Cifas members in connection with scam reports, and members are required to use reasonable endeavours to transmit information accurately without alteration. Cifas reviews submissions against mandatory fields before onward sharing, and corrections can be relayed to partners when notified.
Transparency is another relevant factor. A Fair Processing Notice for Scamlink is made available publicly at www.cifas.org.uk/fpn, but direct notification to individuals whose signals are included would be likely to prejudice the purpose of the processing.
Taking these factors together, and subject to the safeguards described below, Cifas considers that the legitimate interests of Cifas, its members, partners, scam victims and the wider public outweigh any interests, rights and freedoms of the individuals whose personal data is included in scam signals i.e. the individuals carrying out the scam activity.
Operational safeguards are in place to minimise any negative effects to scam victims or other innocent individuals.
What safeguards are in place?
Scamlink is subject to a number of safeguards designed to ensure that the processing remains necessary, proportionate and appropriately controlled. These include:
Signals can only be submitted by Cifas members and only in connection with a scam or fraudulent conduct report, reducing the risk of malicious or spurious submissions.
Signals submitted to Cifas are limited to defined data points: URLs including social media handles, IP addresses, domains, email addresses and phone numbers.
Details of the victims of scams are not included in Scamlink signals.
Signals are used by Meta/ GSE members as part of wider moderation activities and investigations, and are unlikely to be used in isolation to take action against individuals.
Cifas is certified to ISO/IEC 27001, the international standard for operating an information security management system, and to Cyber Essentials, the online security scheme run by the Government’s National Cyber Security Centre. Scamlink runs in the Microsoft Azure UK cloud, which is itself certified to ISO/IEC 27001 and many other international security standards, and so benefits from the Microsoft global incident response team. Cifas commissions regular penetration testing of all systems by independent experts approved under the CREST scheme.
Conclusion
The legitimate interests of Cifas, its members, partners, scam victims and the wider public in the processing of Scamlink signals, subject to the safeguards described above, are significant, and outweigh the very limited competing interests of individuals carrying out the scam activity. Cifas therefore concludes that the processing may be undertaken on the basis of those legitimate interests.
Cifas' Data Protection Officer can be contacted at dpo@cifas.org.uk or through the main Contact Us page.
