Croydon council has to pay a heft fine for data breach

Data related to children is the most sensitive one, especially when it is about sex abuse victims. This data ought to be ‘heavily’ guarded in the sense that it must be encrypted so that it does not get into the hands of hackers. Misuse of such data can lead to dire consequences. Today’s story talks about negligence shown by the Croydon Council wherein children data was stolen.

As the story unfolds

The ICO (Information Commissioner’s Office) fined CROYDON Council n amount of £100,000 after a bag carrying papers related to child sex abuse victim was taken from a pub.

According to the ICO CROYDON Council had breached the Data Protection Act because it did not encrypt the data and failed to follow security measures.

Well, obviously the council is not happy about it and is considering appealing the verdict. It feels this fine is a bit too heavy.

Apparently a social worker, an employee of the council, had taken this bag along to a pub that he was visiting. Needless to say the bag was unlocked. A perfect opportunity for a thief and he made the most of it! This happened in April 2011. The worst part is that these documents were related to a child abuse case and 6 other people who were a part of it.

ICO head Stephen Eckersley’s comments:

“We appreciate that people working in roles where they handle sensitive information will – like all of us – sometimes have their bags stolen.

“However, this highly personal information needn’t have been compromised at all if Croydon Council had appropriate security measures in place.

“One of the most basic rules when disclosing highly sensitive information is to check and then double check that it is going to the right recipient.

“Norfolk County Council failed to have a system for this and also did not monitor whether staff had completed data protection training.”

The council did inform the concerned parties immediately but that cannot be given as an excuse for leaving vulnerable data unattended. The bag has not been found till date.

CROYDON’s comment:

“The council is perplexed and frustrated by the commissioner’s general criticism of our data protection and information handling guidance, as many of our internal measures and policies appear to have been disregarded in reaching this judgment.

“The council also believes, having taken advice, that the level of fine is wholly disproportionate to the breach.”

Time to implement security measures and quality assurance technology

The above story shows we are living in a volatile world where anything and everything can go wrong in a jiffy. We have to be prepared for the worst, especially this information world of Internet. Information is flowing at an immeasurable speed hence all the more need to secure it from falling into the hands of the wrong people. The above report is a wake-up call for all the council and Information companies. In short check and double check.

As of now it is not mandatory for private bodies to disclose data breaches. But sooner than later, that law will come into effect and hopefully the common-man will breathe a sigh of relief.

Bring in Alertsec

Alertsec has created a web based encryption service that radically simplifies deployment and management of PC encryption by using industry leading Check Point Full Disk Encryption (former Pointsec) software. There are no short cuts to Data security in any organization. This news stresses the need for data protection applications. In an incident which highlights the need of Data encryption software and recovery software, the threat could have simply been reduced to an insurance matter by a mere investment of $13/month. The information would have been secure with no loss what so ever. That is certainly a small price to pay compared to what can happen if you lose confidential or sensitive data. Alertsec Xpress offers a very good and easy-to-use laptop security service that includes more than the traditional software licensing model.