2 USB sticks containing mental health data stolen from Enable Scotland

Data sticks or USB drives look so small but carry so much of weight, don’t they? They carry a lot of data and if lost, are difficult to recover due to their size. Thus storing data on a USB drive and carrying it around is very easy, a perfect example of ‘advanced technology’ but what if they get stolen? What if data on a USB drive is compromised?

Today’s post deals with data breach at a Scottish charity wherein their 2 USB drives (memory sticks) were stolen.

The story

A Scottish charity has been admonished for not encrypting the USB device (memory sticks) by ICO (Information Commissioner’s Office). These data sticks belonged to Enable Scotland and contained data of people with mental health issues, their addresses, and date of births which has now been stolen by thieves. The device was stolen from employee’s home that contained information of 101 people. According to the Data Protection Act rule the data should be erased after it has been uploaded on servers to avoid such data breach. It should also be in practice to knowledge the home workers how to handle such secured information in the form of memory sticks that are not routinely encrypted. Enable Scotland has admitted that the data stolen was not explicit yet it contained names of people who are connected with this charity for mental health issues. They had failed to delete it after their use. During an investigation, it was also found that mobile devices were not encrypted too that are used for storing sensitive information.

Penalty in form of money is charged for such loss of data by any organisation but this being a charity we are not confirmed as it charities are not charged penalty in form of money. However, Enable has started working on improving their agreements and policies with Data Protection Act. They will also educate their workers on data protection procedures and ensure that their mobiles are encrypted. It is pleasing that Enable reported the breach as early as they could but the information once lost cannot be regained though.

Enable has taken a good step towards data breaches to protect their customer information. However, it should be a learning for all other charities out there to safeguard their people’s sensitive information. ICO recently handed out a fine to Cheshire East Council for emailing sensitive information to wrong recipients.

Data breaches are really a matter of great concern nowadays. The amount of data loss that is taking place is worrying and many organisations do not have hundred percent protection policies towards their employees data. It is very important that sensitive information must be secured. Routine Encryption of devices must be made mandatory to avoid such losses of data otherwise there will be no end to cases like these in near future. So that even if the data is stolen encrypted devices will ensure protection of information. Businesses should have this obligation towards their society to avoid such thefts as majority of them take place outside the corporate environment.

Your system needs Alertsec!

There are no short cuts to  data security in any organization. This news stresses the need for data protection applications. In an incident which highlights the need of  Data encryption software and recovery software, the threat could have simply been reduced to an insurance matter by a mere investment of $13/month. The information would have been secure with no loss what so ever. That is certainly a small price to pay compared to what can happen if you lose confidential or sensitive data. Alertsec Xpress offers a very good and easy-to-use laptop security service that includes more than the traditional software licensing model.