Recommendation 5

The BBC has developed its approach to data security since 2019 but is not yet doing enough to manage the risks arising from increased access to users’ personal data. The BBC needs to collect and hold some audience data to help it to compete in the digital space, and crucial to this is sign-in, where audiences register for and use a BBC account to access its digital services. The BBC has a sign-in strategy, with a target for 72% of digital product views to come from signed-in users by 2023. It also has an overall goal of 23.5 million signed-in users by 2023. The BBC tries not to collect or hold more data about audiences than is necessary and reassured us that it has no plans to commercialise the data that it collects. That makes it distinct from BBC Digital 7 other digital providers. The BBC appointed a data protection officer in 2019 and also set up a central data protection team. However, the increased use of personal data exposes the BBC to more potential risks and it has not shown clearly that its active management of those risks is yet sufficiently embedded. The BBC has assured us that there have been no significant data breaches in the current financial year. Recommendation 5: The BBC should review its data collection and storage policies and work out the minimum amount of data that is needed to achieve its goals, what will be sufficient for its personalisation strategy, and how it will keep that data safe. 8 BBC Digital 1 Planning and funding