 |
HMRC loses personal data of 25
million people in post. Details included names,
dates of birth, National Insurance numbers and in some cases bank details.
This happened after a request from the National Audit Office to HM Revenue
and Customs for data on child benefit recipients. Apparently a relatively junior
member of staff downloaded the data onto two CDs and sent them by the internal
mail operated by a courier firm. The discs were lost and there are fears that
the information could get into the wrong hands leading to ID theft on an
unprecedented scale. |
|
|
The first question is how could a junior
member of staff (or anyone, however senior,) download the data with such ease?
It’s not enough simply to have procedures to protect data – human beings
are fallible and mistakes happen – data storage systems need to be
designed to prevent downloads like this unless a whole series of checks and
authorisations have been made on the system first.
|
|
|
The NAO claim they didn’t even request
or need all this data anyway. As far as data protection goes, less is always
more and only information that is absolutely necessary should ever be collected
or used. It also helps to store different items of information separately and
only join them up when this is essential. It is possible for data to be
validated without the information itself being revealed to the person making a
check.
|
|
|
Another question is why no one seems to
have queried the download. This is maybe because personal data is still not (or
was not until this incident!) widely perceived to be valuable. Many people
don’t destroy their financial information (statements, credit card receipts etc)
securely. And how often have you heard someone give away personal details in a
mobile phone call on the train? Personal data should be protected like cash –
or even more carefully - as the consequences of it getting into the wrong hands
can be more devastating than losing cash. |
|
|
Data protection training is also
essential. This should include everyone – from the most senior people in the
organisation to temporary staff and consultants – everyone who will be handling
or making decisions about personal information. A recent survey by security
firm Websense showed that organisations frequently give temporary staff wide
access to personal and confidential data. This makes it very easy for someone
with malicious intent to steal data. So access to data also needs to be
carefully controlled and fully audited. |
|
|
Data protection training emphasises that
it’s everyone’s responsibility to look after data – not just the data protection
officer’s job! Good training will give everyone an internal alarm that rings
when something is not right. |
|
|
Prevention is always better than cure –
the public reaction to this incident has been pretty angry. If an organisation
can’t look after personal information, people will start asking if it can do
anything properly. And now the Information Commissioner has advised that all
personal data in transit - on laptops, discs etc, should be encrypted as
password protection isn’t adequate. If an organisation loses data in transit
and it wasn’t encrypted, in future he will use his enforcement powers against
that organisation. And the Information Commissioner’s powers are set to be
increased with the ability to make spot checks on organisations. |
|
|
But as always, it is better to be safe
than sorry.
|
And the person who found it didn't just hand it back - they went to the
press. cue interviews with angry parents (one of whom had been described
as 'quite rough' in the confidential report ).
As far as data protection goes, the 'special purposes' exemption allows
disclosures for journalistic purposes if the matter is in the public interest
(not necessarily the same as 'interesting to the public') although it was
probably both in this case.
For the school - there are two data protection lessons.
First - it's an easy thing to print 'Confidential' or 'Do not leave lying
around ' on the cover of a document, it takes a bit more to have procedures
that follow through on that.
Second - under the 'subject access' provision of the Data Protection Act,
pupils have a right to make requests to see information about them held by
their school (and parents have a right to see their educational record).
It's unlikely that any exemption would apply, so they could have ended up
reading their entry.
(For further information , see the Technical Guidance Note produced by the
office of the Information commissioner:
'Access to pupils' information held by
schools in England' at www.ico.gov.uk under
Document library)
No doubt we all know at least one dingbat or wally but would we really want
them to know how we feel? Particularly at work where they might claim
discrimination as a result of making an access request and seeing their boss's
opinion of them! So any notes about staff should always be objective
with opinions separated from facts.
