Law won't help Darling's data victims

• 
• 

 1 of 2

Gallery

By Stewart Mitchell

Posted on 21 Nov 2007 at 07:46

You could seek financial recompense through the courts, but legal experts warn this is a high-risk strategy. "You can complain to the Information Commissioner's Officer, but if you can show you have suffered damages then you could bring a court case," she adds. "You can bring a case yourself but that is quite rare because you have to pay for all the costs, and if it's a big company it's too daunting for the man in the street." Even the ICO has yet to take a company to court for non-compliance, let alone the government.

In the dark

Of course, most people don't even know their data has been leaked by a company - normally because the data doesn't fall into the wrong hands. But even if companies do become aware of a data breach, they have no legal obligation to confess to the problem or even contact the individuals affected - even though swift action could allow potential victims to change passwords on accounts. "We would say best practice would be to come forward for advice, and many have, but they don't have to," says a spokesperson for the ICO. Indeed, the Chancellor waited six days before even informing the banks of the missing child benefit discs. "We'd like to see the rules changed," adds the spokesman.

However, given the choice of coming forward and risking the damage to reputation and bank balance, or keeping mum and hoping the data breach is never discovered, it's not surprising that most organisations opt for the latter. "It's like when companies get hacked," says Blyth of Glamorgan University. "Most will say 'Disk, what disk?'. Unless it comes to light and they have to respond, there is no advantage in coming forward."

The best defence is obviously not to lose data, and for most companies that means carefully monitoring firms contracted to dispose of old hardware. "You have to say that you reserve the right to do spot checks and snap inspections, and if it doesn't conform they are in breach of contract," says Blyth.

Until such checks become commonplace, the only thing really being breached is your privacy.