PC Probe: Critical data goes out of the back door

• 
• 

 1 of 2

Gallery

By Stewart Mitchell

Posted on 5 Sep 2008 at 15:08

On top of costs to reputation, loss of data could also attract large fines from the Information Commissioner's Office, which enforces the Data Protection Act. Firms have to protect personal data, and face sanctions if they lose sensitive information but often they don't own up to data breaches. Even if they do, it's cheaper to pay the fines than implement expensive software for monitoring exchanges.

"In the US, people and companies are much more aware than in Europe because the legislation is much stronger," said Gondicart. "In Europe, many large company can live with the fines - they're not high enough to make the investment worthwhile."

Another problem that hampers keeping data in-house is the scale of records that mount up. There are different rules for how long to hold records. In banking and accountancy it's seven years, if it's medical it's for the life of the patient. "Rules about retention take no notice of whether the communication was on paper or in an email," said Rosemary Jay, a data protection specialist at law firm Pinsent Masons.

"If you were talking about a contract or records, you'd need to keep the email for at least the duration of the contract. The longer you have to keep data, the higher the chance of losing it."

As data mountains continue to grow, the odds of more and more information seeping out of organisations seem greater than ever.