Watchdog claims theft is leading cause of data breaches

 

Gallery

By Stewart Mitchell

Posted on 11 Nov 2009 at 11:42

Burglaries and theft are the biggest causes of data security breaches, according to figures released by the Information Commissioner's Office (ICO).

Of the 711 security breaches reported since the 25 million child benefit records went missing two years ago, 231 have involved theft. Under new proposals companies with inadequate security in place could face fines, ICO says.

“Since November 2007 we have taken action against 54 organisations for the most reckless breaches. Some of these breaches would trigger a significant fine for organisations were they to occur after the introduction of monetary penalties in 2010,” says David Smith, deputy information commissioner.

Organisations, especially NHS bodies, should ensure that the level of security at premises is commensurate with the type of data they are holding

“We are keen to encourage organisations to achieve better data protection compliance and we expect that the prospect of a significant fine for reckless or deliberate data breaches will focus minds at boardroom level.”

New powers scheduled to come into force in 2010 will enable the ICO to impose substantial monetary penalties on organisations where there is evidence of a reckless or deliberate data protection breach.

Regardless of how thorough infrastructure and network security, the ICO says plain physical security is too lax in many organisations – and singled out the NHS for criticism regarding protection of its hardware assets.

“We have investigated organisations, including several NHS bodies, that have failed to adequately secure their premises and hardware, which has left people’s personal details at risk,” says Mick Gorrill, the assistant information commissioner with responsibility for investigations.

“Organisations, especially NHS bodies, should ensure that the level of security at premises is commensurate with the type of data they are holding. Many breaches are avoidable and are often the result of poor management processes.”