"ComplianceSpeak"

MORE laptop thefts!

Reported in - Computerworld Dec 14th 2006.

A laptop containing the personal information on 382,000 current and retired workers of Boeing Co. was stolen from an employee's car earlier this month, according to Boeing spokesman Tim Neale. 

The information included employees' Social Security numbers, home addresses, telephone numbers and birth dates, as well as salary information [D'Oh!], Neale said.

Although the laptop was turned off and was password protected, Neale said the data on it was not encrypted.

Want a good, cheap encryption solution?

Check out TrueCrypt.

Boycott the 'Hate Mail'

The Information Commissioner has named and shamed the newspapers he says are breaking the law in their pursuit of stories. Richard Thomas has published a report to Parliament on information theft which contains a league table of alleged offenders.  See report here.

No surprise who tops the list of newspapers who go in search of 'newsworthy' stories of dubious provenance, yes it's the Daily Mail!

I expect the reporters responsible are all Albanian immigrants anyway ;-)

£300, you're 'avin a laugh!

So, Liverpool City Council have the dubious honour of being the first to be prosecuted for failing to act on an Enforcement Notice from the Information Commissioner Office (ICO). See press release.

The District Judge at Liverpool Magistrates’ Court said the council had shown an ‘appalling breakdown of communication’ and ‘a clear lack of compliance’ with the Data Protection Act 1998.

So what did they do? Basically this;

• Former employee submits Subject Access Request (SAR) and is provided with some data.
• Employee thinks the council is holding back medical data, so she complains to the ICO.
• ICO investigates and asks Liverpool CC to respond; they don't!
• ICO brings this (and the matter of another investigation) to the notice of the Council CEO.
• CEO fails to respond!
• ICO takes them court.

The outcome? Liverpool CC receives a fine of £300

Am I alone in thinking that the message this sends to all of the data controllers out there is;

1. If you get a SAR that looks a bit tricky SIT ON IT, and withhold the difficult stuff. 
2. If the data subject is knowledgeable (concerned) enough s/he might complain and the ICO might investigate.
3. If they do, IGNORE them, they might go away, and we will 'get away' with it.
4. If they do rock up on the doorstep, say we're sorry and take the £300 fine.

That's a lot cheaper than having to put in place people, process and technology to ensure that we process data in accordance with the data subjects' rights.

Jeeeez!