IT Governance Blog on IT governance, risk management, compliance and information security.

Yesterday the Information Commissioner announced that he had fined Midlothian Council £140,000 for disclosing sensitive personal information to the wrong recipient on 5 separate occasions. All 5 breaches involved children’s social service reports and occurred between January and June 2011.

 Ken MacDonald, Assistant Commissioner for Scotland commented:

 “The serious upset that these breaches would have caused to the children’s families is obvious and it is extremely concerning that this happened five times in as many months. I hope this penalty acts as a reminder to all organisations across Scotland and the rest of the UK to ensure that the personal information they handle is kept secure.”

The ICO’s investigation found that all five breaches could have been avoided if the council had put adequate data protection policies, training and checks in place.

The ICO has ordered the council to review and update its data protection policy and ensure council staff and those who work with the council are adequately trained in their DPA responsibilities.

The ICO is gaining support for its request to conduct audits of local councils and NHS bodies without request.  There have been numerous public sector bodies caught in breach of the DPA over the last two years, however the actual number who are not meeting data protection compliance levels is thought to be much, much higher.

The cost-effective way to tackle this issue is to ensure you are DPA compliant now. DPA training and compliance is not expensive, especially compared to the potential huge fines that can be levied on an organisation who are found to have breached the DPA.

DPA Foundation Training – Essential for those responsible for personal and sensitive data within an organisation.

SafeXs Sticks – Essential for protecting sensitive data within an organisation. Hardware encrypted and almost bombproof, the SafeXs stick also comes as an enterprise package.

DPA Staff eLearning – A Cost effective way of delivering essential training to staff.

DPA Toolkit – Essential time saving documentation toolkit to help you create the documents you need to ensure DPA compliance.

You can read more about the Data Protection Act here >>>

Keep a step ahead, and stay out of trouble – deploy easy-to-use encrypted USB sticks today!

	SafeXs FIPS 197 USB Stick Silver Package Get SafeConsole Lite Free!   Various capacity options available: FIPS 197 from just £48 and FIPS 140-2 from just £76.50

Mobile giant 02 have suffered a couple of embarrassing gaffs this week. Firstly it was revealed that they had been inadvertently been passing their customers phone numbers on to any site that they visited when using O2’s 3G network on smartphones. With almost half of O2’s customers using smartphones, the data leakage could possibly have affected up to 15 million people.

O2 blamed a ‘technical’ glitch and has since stated the problem has been resolved and apologised to its customers. However a leading consultant at Sophos, Graham Cluley, commented that such issues had “been known about for almost two years at least”.

The Guardian reported yesterday that O2 also ‘regularly hands over subscribers’ phone numbers to sites that offer age-restricted material and premium-rate billing, whether the users realise it or not.’

What?! I hear you cry. The Information Commissioners Office’s is considering investigating the incident however it seems unlikely that that any action will be taken as a mobile phone number, in the eyes of the ICO, on its own, is not considered as a ‘personally identifying information’.

Even though, with your number being passed onto potentially anyone under the sun, you could be the subject of phishing attacks, reverse charge texts and unsolicited marketing.

These incidents further highlight what companies do with our data when we’re surfing the internet; and how little we actually know as consumers. And what can you do as a consumer? Where is the avenue for reproach? We’ll all be politely told that the issue was a ‘technical problem’ and has now been resolved. But when did we sign up for this in the first place? I mean if, when you bought your latest phone, there were questions like: “Would you like us to share your information with every single website you visited?” Or, “Would you like us to pass your details on to sex chat services?” You would tick yes to these?!

Often terms and conditions are deliberately confusing, long winded and impenetrable for consumers; allowing the service provider you’re signing with the legal ambiguity to do with your information as they wish. But in the instances referenced in this article, this wasn’t the case. One was an error and the other – passing customer details onto premium and age-restricted sites – well, no one seems to know. O2 have thus far refused to comment. Are they allowed to do this?

One thing is for sure. Such instances cause huge brand damage and loss of custom. Retaining customer loyalty and brand image is of huge importance to all businesses and organisations. I dare say that if an SME suffered an instance like this that they would have a far more difficult time of it. Protection of customer data is important. The data protection act says so.

But I often wonder, when the brand is so big and they have so much money, as in the instance of Playstation last year, and now someone like O2, are they beyond the pale?

You can read more about data protection and the Data Protection Act here >>>

Praxis Care charity  lost a memory stick in August 2011,  containing  confidential data of 160 different people. The data that was held on the unencrypted stick contained personal information such as their mental health and care records.

Since losing the memory stick and coming under the wrath of the ICO for suffering the data breach, Praxis Care is now committed to improving its data protection standards.

Christopher Graham, the information commissioner, said: “Carrying people’s personal information around on an unencrypted memory stick is clearly unacceptable.”

To avoid a situation like the above, companies need to use a secure USB sitck with hardware encryption.

SafeXs is a secure USB stick with AES 256 bit hardware encryption and is FIPS 197-certified. Over 1 million of these sticks are now in use by the NHS, helping to keep patient data and other confidential data secure.

Simply plug in a SafeXs and within minutes you can be up and running. All you need do is set a password and any data placed on the SafeXs is encrypted.

Read more about the popular encrypted USB stick >>

The Information Commissioner’s Office (ICO) website shows that £541,000 in fines were issued during 2011 between 7 organisations, making the average fine £77,285! This is not counting the fines issued by courts following a prosecution. This is an increase of 238% over 2010, when the power to issue monetary penalty notices were first introduced to the ICO.

In 2010 there were 2 fines issued for a total of £160,000. If the same percentage increase occurs in 2012, over 2011, total fines issued could be over £1.8M!

Avoid these fines for as little as £156, here’s how:

	Complete Data Protection Toolkit Price: Just £156 This complete toolkit provides all the tools and resources you need to carry out your own DPA project and become compliant quickly and cost-effectively. The proven do-it-yourself approach towards achieving DPA compliance!

The Information Commissioner’s Office has formally requested greater powers to conduct compulsory audits of local government and public sector organisations. The ICO presented the secretary of state with a business case stating that there were “particularly significant and widespread data protection compliance concerns’ within the public sector. The ICO presented statics, which included the amount of complaints of potential data protection breaches from individuals. Over the last five years local government (4,110) and the health sector (3,701) topped this list. Read the full report here. 2011 saw the ICO issue more fines than ever to public sector organisations. With these potential new powers of compulsory audit, the ICO will be clamping down even further in 2012. Ensure you are compliant with the data protection act for 2012. Complete Data Protection Toolkit (Download) Price: £156       ICT Strategy Toolkit FREE with this best selling toolkit until December 23rd 2011! The DPA toolkit contains all the tools, guides and documentation templates you need to become DPA compliant. The ICO is expected to come down even harder on those found to be in breach of the DPA in 2012. Can you afford not to be compliant? Achieve DPA compliance for less than £156 with this toolkit >>>

More products to help you improve your data handling…

Data Protection Act Staff Awareness e-Learning Course	SafeStick (CESG Approved FIPS 140-2 Certified USB Stick)

	Compliance by Design: IT controls that work by Chong Ee Price: £39.95 Availability: Immediate download Reconsider how you view compliance – and your business will reap the rewards!

More to explore …

Data Protection Compliance in the UK: Second edition

Data Protection vs Freedom of Information (eBook)

PCI DSS: A Practical Guide to Implementing and Maintaining Compliance