Big Brother Watch

European Parliament approves reforms to Data Protection Directive

Following the publishing of the ICO’s annual report this morning, the European Parliament has approved reforms to the Commission’s Data Protection Directive of 1995. These are designed to give more control to individuals over any information held on them by organisations and companies, as well as placing a responsibility on those bodies to inform people of any data breaches which occur involving their personal information.

Axel Voss, the German MEP, wrote the report for the European Parliament, which had demanded more accountability from businesses with regards to data breaches. E.U. citizens will now be able to delete, correct or block their information easily.

The EU Justice Commisioner, Viviane Reding, claimed: “Putting people back in control of their personal data is a priority for me.”

By the end of the year the European Commission is expected to finalise new legislation to dramatically modernise European data protection rules.

Information Commissioner complains that most businesses refuse data protection audits

The Information Commissioner, Christopher Graham, appeared on the BBC Radio 4 Today programme this morning to discuss the unwillingness of private companies to accept free data protection audits from the ICO. In their annual report, released today, the ICO revealed around a third of the 603 breaches reported in the 2010/11 period occurred in the private sector.

Although public bodies make up the majority of the breaches, they are obligated to report them, unlike the private sector. A mere 19% of business who were contacted during the period agreed to an audit, this compares to 71% in the public sector.

Mr Graham said:

“Lenders, general businesses and direct marketing companies account for almost a third of total complaints to the ICO, and businesses were the top sector for reporting data security breaches to us last year.”

“Despite this, many of them are still resisting our offer to undergo audits. We've written to organisations we consider to be high risk, but the response has been disappointing.”

Although the ICO consider undergoing an audit to be a ‘badge of honour’, businesses appear to view them as invasive, time-consuming and worthless. It is clear that the current voluntary system of audits is not working, and an alternative is necessary to reduce data breaches.

Ban these referral fees which are costing millions of people thousands of pounds on inflated insurance premiums: An article by Frank Manning

Big Brother Watch has previously brought up the topic of insurance companies selling on referral data to no-win no-fee claim firms, which has now received widespread attention after being picked up by the media following an interview on the Today programme by Jack Straw. I personally received a text message a few weeks ago inviting me to claim “up to £3,450” after my “recent accident”.

This was news to me, considering I hadn’t been in an accident and my car was parked on the driveway undamaged. The logic of referring the contact details of people who have been in a crash makes sense despite it being morally destitute, although how they intended on securing me a payout without so much as a bump occurring seems very peculiar.

The system is fiendishly simple yet ludicrously expensive, creating a vicious circle which is making insurance ever more expensive. After a collision or a bump, a motorist must contact their insurer to inform them of the incident and detail any damage to the vehicle.

The insurer then passes on the contact details of the claimant, irrespective of whether any injury has occurred, to a no win, no fee firm, in return for a ‘referral fee’. This fee can be anything from £200 to £1,000 per case, giving a huge incentive for companies to pass on the information. Jack Straw has called for the banning of these fees to halt the rapid rise in premiums.

This system has led to spiralling insurance costs for everyone in the country. The multitude of comparison sites, deals and discounts only serve to confuse customers and disguise the rising cost of insurance. The statistics are truly shocking. The number of claims companies has doubled to 3,400 over the course of just two years, while the total cost of personal injury claims has doubled to £14 billion in ten years. This is at a time when cars are the safest they’ve ever been, vehicle crime has dropped and there are around 30% less accidents than in the late 1990s. Yet premiums still rocketed by 40% from 2009 to 2010.

Apart from the scandal of artificially high premiums supported by these dodgy practices, the passing on of personal contact details without your express permission needs to stop. We have received numerous calls from concerned people who have been bombarded with unsolicited calls and text messages at all hours of the day and night. This is a gross intrusion on privacy, especially considering it is purely for the financial gain of the claims firms, who have no real interest or consideration for the wellbeing of those in accidents.

When questioned on whether he thought it was morally acceptable behaviour, Nick Starling of the Association of British Insurers attempted to excuse it by claiming a variety of groups are doing it including the police, breakdown firms and garages as well as insurers. Basically, “We’re all at it”, despite the fact that whiplash cases cost insurance companies a shocking £2 billion.

Clearly the majority of this is suspicious, as the total cost of whiplash treatment to the NHS is £8 million, while it is notoriously difficult to diagnose. It seems odd that the insurance companies, ostensibly losing money as a result of these claims, have not campaigned and lobbied harder for the referral fees to be banned.

Law Society president Linda Lee said:

"Referral fees hinder access to justice, contribute to rising costs in the justice system, and go against the interests of the consumer. We have always argued for a total ban on referral fees. Jack Straw believes they should be banned, Lord Justice Jackson in his recent report on costs believes they should be banned, and now even the insurance industry agrees they should be banned. The government needs to wake up and take immediate action."

This morning Justive minister Jonathan Djanogly criticised the payment of referral fees, but refused to guarantee the government would ban them. It is possible that the police use them to top up their finances, creating a disincentive to banning them. These forms of behaviour from insurers as well as the police need to stop; the government should reconsider banning referral fees outright.

 UPDATE: Axa have announced this afternoon they will no longer accept referral fees in personal injury claims. Hopefully they will be the first of many.

 

Frank Manning tweets at @BillyManning

European Parliament Civil Liberties Committee release report on data protection

A report by the European Parliament’s Civil Liberties Committee has called for businesses in the E.U. to make it more straightforward for customers to access and delete any data stored about them.

The report, released on Wednesday by chairman Juan Fernando López Aguilar, suggested that companies should consider the appointment of specific data protection officers to facilitate this.

It also recommended that children who use social networking websites such as Facebook and Twitter must be protected by EU data privacy rules

The report received almost complete approval from the Committee, with 49 MEPs voting in favour and only one voting against.

The main conclusions of the report can be found here.

Surrey Council Council fined £120k for e-mail data security blunders

We at Big Brother Watch have long complained about the unwillignness of the Information Commissioner to effectively use his powers to name, shame and fine those who are guilty of gross abuses of data protection law.  While these powers are used rarely, they are occasionally utilised for good effect.

One case where the ICO has shown a willingness to act is against Surrey County Council for their incompetence in e-mailing personal medical and welfare data of hundreds of people to the wrong recipients on three seperate occasions.

According to a report in the Surrey Herald:

"A member of one of the council’s Adult Social Care teams emailed a file containing sensitive personal information relating to 241 individuals’ physical and mental health to the wrong group email address.

"The group email address included a large number of transportation companies, including taxi firms, coach and mini bus hire services.

"The council attempted to recall the email, but was later unable to confirm that all the recipients had destroyed it.

"As the information was not encrypted or password protected, it had the potential to be viewed by a significant number of unauthorised individuals.

"A second misdirected email sent on June 22, 2010, lead to confidential personal data relating to a number of individuals being mistakenly emailed to more than 100 unintended recipients who had registered to receive a council newsletter.

"In a third incident, the council’s Children Services department sent confidential sensitive information, which included data relating to an individual’s health, to the wrong internal group email address on January 21, 2011."

You can view the whole story here.

Links of the day Friday 10th June 2011

Please note these are articles and opinions we found interesting, however they do not necessarily represent the views of Big Brother Watch

Council CCTV award win criticised

Hackers warn NHS over security

Cabinet Office talks to Facebook & co about new ID system

Personal data stolen from UK developer Codemasters

Facebook facial recognition tool probed by UK regulator over 'obvious' privacy issues

Two fined for mobile data breaches

CCTV car plans approved

ICO finally start to use their 'big stick' to punish Surrey County Council

After a cavalcade of data protection breaches the Information Commissioner’s Office (ICO) have finally decided to punish a council. The fine, £120,000, is one of the highest given out yet.

Surrey County Council were investigated for three separate offences, all of which they were found to be negligent for. The first occurred in May 2010, when the mental and physical health information of 241 individuals was sent to the wrong group of email addresses. Instead of the intended recipients, the details were sent to taxi cab and coach firms. Although the council attempted to recall the email, it could not be certain what had happened to the information. To make matters worse, the file was neither encrypted nor password protected, meaning anyone could access it.

The next month the council sent a second email with the personal data of several people to 100 recipients of the council newsletter by mistake. Finally, in January 2011, the Children Services department of Surrey sent confidential health information to the wrong email list.

This catalogue of errors led to the ICO deciding a stern punishment was necessary. Christopher Graham, the Information Commissioner, claimed the fine of £120,000 reflects the seriousness of the incident in his statement:

 “The fact that the first breach saw sensitive personal information relating to the health and welfare of 241 vulnerable individuals was sent to the wrong people is shocking enough. But when you take into account the two similar breaches that followed, it is clear that Surrey County Council failed to fully address the risks of sending sensitive personal data by email until it was far too late.”

“Any organisation handling sensitive information must have appropriate levels of security in place. Surrey County Council has paid the price for their failings, and this case should act as a warning to others that lax data protection practices will not be tolerated.”

“Punitive measures are decided on a case-by-case basis," he said. "We have to look at the sensitivity of the information, whether the organisation in question did enough to prevent the breach, and the ability of the organisation to pay. Every organisation and every data breach is different.”

Christopher Graham had previously stated he didn't want to use the 'big stick' of fines to enforce data protection, but hopefully this represents the ICO taking a more hard-line approach to fining those responsible for data breaches. In recent cases there have been far too many councils and organisations given the option of signing an undertaking to improve performance rather than pay an actual fine. Here at Big Brother Watch we firmly believe that only fines will alter the behaviour of those organisations with a lackadaisical approach to the protection of sensitive information.

Citigroup suffer data breach of 200,000 customers

The banking company Citigroup has admitted to a breach of their online systems, which allowed a hacker to view the names, email addresses and account numbers of 200,000 customers. However, the information did not include birth dates, PIN codes or similar sensitive information meaning it may not be possible for their accounts to be accessed and funds stolen.

Citigroup have now spoken to U.S. police to inform them of the breach, as well as increasing fraud procedures for their online banking. Affected customers are currently being contacted but the bank will not reveal if any suspicious transactions have been encountered since the incident.

Citibank have released the following statement:

“During routine monitoring, we recently discovered unauthorized access to Citi’s Account Online. A limited number – roughly one percent – of Citi bankcard customers’ account information (such as name, account number and contact information including email address) was viewed. The customer’s social security number, date of birth, card expiration date and card security code (CVV) were not compromised. We are contacting customers whose information was impacted. Citi has implemented enhanced procedures to prevent a recurrence of this type of event. For the security of these customers, we are not disclosing further details.”

As usual with incidents like this, the potential for phishing attacks on customers using 200,000 records is extremely severe. Anyone with an account at Citigroup should ensure all communication from them is official and not an attempt to accumulate your data in order to steal from your account.

North Lanarkshire Council fail to protect sensitive data of vulnerable people

The ICO have revealed that North Lanarkshire Council have failed to protect the data of vulnerable adults after paper records were stolen from an employee’s bag. After an investigation the ICO determined there had been a breach of data laws and council chief executive Gavin Whitefield must sign an undertaking to put in place the correct policies and procedures to avoid a repeat of the issue.

The ICO claimed the council had provided inadequate guidance for its employees, leading to a Home Support Worker leaving the bag unlocked with mental and physical health records for six vulnerable adults inside.

Ken Macdonald, the assistant commissioner for Scotland said:

“It is never acceptable for papers containing sensitive personal information to be left in an unlocked bag without necessary precautions. The council's guidance on the handling of this type of information was inadequate and failed to advise staff on the best means of keeping information safe.”

Once again the ICO have avoided fining an institution that has failed to protect the sensitive information of vulnerable people.

What will it take?

Hat-tip: JC

Links of the day Monday 6th June 2011

Please note these are articles and opinions we found interesting, however they do not necessarily represent the views of Big Brother Watch

Top websites leaking our data to third party players

European Union "cookie" regulations are criticised

Airport security misery

Gov fails to have knowledge of itself on websites

Apple hit by new competition complaint as iCloud launches

Google acting as a 'political tool', says China

New Android app allows automated WiFi cookie intercepts

Eden's CCTV cameras switched off to save money

PSN hacking aftermath: Sony "Welcome Back" free gifts now available

Is the Olympic cultural events database being kept on an unsecured Excel spreadsheet?

A report on The Register has found a job vacancy on the London Organising Committee of the Olympic Games (LOCOG) website which seems to suggest that the organisation’s entire cultural events database is stored on a simple Excel spreadsheet.

The job description states:

“The majority of the Team and Database Administrators work will be to work with the Senior Operations Manager, and Business Manager, in management of the central cultural events database (held in excel)”

Any large-scale projects which involve computers and governmental organisations inevitably seem to end up in disaster in the United Kingdom, after well known problems with schemes such as the NHS database being a prime example.

After being questioned on the matter, LOCOG released the following statement:

“The document you're asking about is just a simple list of information relating to events, it's a tracking tool not a database. ExCel [sic] spreadsheets are a common corporate tool and we use them as and when appropriate.”

“Where data is of a more sensitive nature then we impose stronger security measures and platforms according to the risk profile. Information security is of the up most importance to LOCOG and we are confident that our data is held securely with the stringent security procedures we have in place.”

If there is any truth to this story; it is a catastrophe waiting to happen. This much data, some of it very sensitive, stored on a simple spreadsheet, could potentially be hacked or stolen leading to a massive data loss.

For the extended story, click here

75% of websites leak personal information

A recent survey of some of the most popular websites on the internet has revealed that 75% of them leak personal information or identifying data to third-party tracking sites. The study was performed by university researchers, including Balachander Krishnamurthy of AT&T Labs, and Konstantin Naryshkin and Craig E Wills of Worchester Polytechnic Institute. Their report was presented at the Web 2.0 conference in California last month.

Wills, a professor of computer science at Worcester Polytechnic Institute, gave the following statement:

“No site should be exposing user information to a third party. We believe it is time to move beyond what is clearly a losing battle with third-party aggregators and examine what roles the first-party sites can play in protecting the privacy of their users.”

“Despite a number of proposals and reports put forward by researchers, government agencies and privacy advocates, the problem of privacy has worsened significantly.”

The report concluded that attempts to regulate information leaks in websites had so far been “largely ineffective”, and much more needed to be done to address the issue of online privacy. The most common types of data to be leaked included names, email & home addresses, health information and web browser configuration details. Although it was clear that some information was passed to other sites deliberately, the researchers were unable to establish whether the majority of leaks were inadvertent or not.

Although most of the information leaked was rated as being low-risk, the researchers warned that different pieces of data could still be combined to create detailed user profiles which third-party sites can then utilise to create unsolicited targeted marketing. As the authors had previously examined social networking sites, they opted to focus on alternative popular sites such as health and travel sites which require users to register and create profiles.

Links of the day Tuesday 31st May

'Spy cameras' are used to target student protesters

Cops with cameras go on the streets in west of Glasgow

Twitter forced to hand over user details to English council

'One size fits all' EU data law would undermine rights, says Clarke

Lockheed hack highlights cyber-blame snags

Banks regularly breaching data rules

Ryan Bourne: The Bank of England's inflation forecasts are getting increasingly inaccurate

David Miliband aims a swipe at Ed just days after his brother's wedding

Sony restores PlayStation Network in full

ICO lambasts data protection of charities

The Information Commissioner’s Office has found two charities in breach of the Data Protection Act after they both had laptops stolen which contained unencrypted personal data. Asperger’s Children and Carers Together (ACCT) and Wheelbase Motor Project (WMP) owned laptops which were taken from the house of an employee and an office. They contained the personal information of 130 children, including their medication, criminal convictions, names, addresses and dates of birth.

Deborah Woodhouse, director and co-founder of ACCT and Michael Clifford, CEO of Wheelbase Motor Project have both now signed undertakings to ensure all personal data is encrypted in future and all staff understand their responsibilities under the Data Protection Act.

Sally-Anne Poole, acting head of enforcement, said:

“The ICO's guidance is clear – any organisation that stores personal information on a laptop or other portable devices must make sure that the information is encrypted. Information about young people's medical conditions or criminal convictions is obviously sensitive and should have been adequately protected.”

“We are pleased that both charities have agreed to take the necessary steps to ensure that the personal information they hold is kept secure from now on.”

Chris McIntosh, CEO of ViaSatUK, said:

“Clearly it is in no one's interests to fine charities for breaches of the data protection act, not least because the money comes from the public. However, it is disappointing that the message still does not seem to be getting through.”

“Organisations holding sensitive data, particularly where the vulnerable and young are involved must protect it in every way possible, ensuring that at a very minimum laptops and USB sticks are encrypted, while also carrying out regular education programmes with staff.” 

Although Mr. McIntosh is correct in his assertion that fining the charities is not in the public interest, there must be a substantial form of punishment to ensure charities follow the Data Protection Act, otherwise this type of incident will be repeated again and again. Organisations must be held accountable when sensitive personal information gets lost or stolen.

Links of the day Friday 27th May 2011

Dominique Lazanski: How the EU 'cookie' directive is impacting the UK

Patriot Act surveillance provisions extended in nick of time

Kenneth Clarke data protection speech

Civil rights group calls for standardised European copyright laws

Google wants you to leave your wallet at home to get LBS discounts while you shop

Ratko Mladic arrested: Europe's most wanted man seized in Serbia

Dan Hodges - Creating a landslide

Shane Greer – Lock 'em up

Devizes' CCTV cameras face funding shortfall

 

Co-operative Life Planning suffer data breach of 82,000 funeral insurance customers

The ICO have announced that Co-operative Life Planning (CLS) have suffered a data breach affecting 82,000 customers. In March 2011 a data file containing the personal information of customers who had funeral insurance policies was hacked into and published online. It occurred after the file had been repaired by the CLS software support contractor. The data included names, dates of birth, addresses and the contributions they had made to their insurance policies.

After being alerted to the breach Co-operative Life Planning organised to have it deleted and removed from the internet. The Information Commissioner’s Office (ICO) have now asked the managing director of CLS to sign an undertaking to install data loss prevention software across all the company’s servers. In addition, they will be expected to test every database which may be repaired in future to ensure it is secure. This is a result of the investigation of the incident by the ICO, which revealed that the software support contractor did not have permission to copy the data from the company server, and had failed to delete the information after performing the repair.

Sally-Anne Poole, acting head of enforcement at the ICO, said:

“This case highlights the need for companies to ensure their contractors are following procedures on keeping customers' personal information secure. Co-operative Life Planning's customers had an expectation that the organisation would keep their details safe and they have been let down by this breach.”

“The ICO takes breaches of the law extremely seriously and always seeks to take the most appropriate level of enforcement action. In this case, a monetary penalty was not appropriate because the information that was compromised was unlikely to cause substantial damage or distress and its disclosure didn't present a significant risk to the individuals affected.”

“Co-operative Life Planning also had appropriate policies already in place around protecting personal information stored on their servers. Our focus has therefore been to make sure the organisation commits to making improvements to stop this from happening again and we are pleased that they are being put in place.”

All data breaches which reveal personal information are concerning, but this incident raises the possibility of hackers targeting elderly individuals and using the data which was stolen to attempt to defraud them of their savings or insurance payments. The CLS must ensure all customers are aware of the data breach and realise the dangers of email hoaxes such as phishing.

Fury as Milton Keynes Council publish personal information on website by accident

The residents of Middleton have been apoplectic this week after Milton Keynes Council accidently published the results of a residents’ survey on its website, including the addresses and phone numbers of 50 of the respondents. The data breach occurred last week and lasted for 18 hours before the error was noticed and removed.

The survey was designed to determine public opinion on a controversial park in Southside Lane, Middleton after there had been numerous complaints concerning anti-social behaviour. One resident, Dr. Bob Ranger, who has been a vociferous critic against the play park, believes that his address and contact details being made available online may even have led to recent vandalism of his car. Dr Ranger said:

“They published the contact details and other sensitive personal information of about 50 persons who have filled out a residents’ questionnaire and then submitted it to the council. It was put on the council website for 18 hours.”

“Anybody could have seen all those details in the time they were online. Nobody will accept responsibility or offer a genuine apology. We got a press statement written by the council’s PR department that is supposed to count as an apology but adds insult to injury and inflames a delicate situation even more.”

David Hill, chief executive of the council, said:

“The council has apologised for publishing personal data provided by the residents on the website, with all the background information. Although not strictly required by the Information Commissioner’s Office guidelines, we have notified a breach of the data protection legislation to the ICO and launched a data protection investigation.”

This kind of basic mistake which seems to occur so often in local councils indicates both a lack of understanding of data protection and technology as well as a lackadaisical approach to the privacy of local people. The Information Commission should investigate this case and punish those responsible.

As Big Brother Watch has mentioned before, if the ICO continues to refuse to hand out punitive financial punishments for data protection breaches then they will keep occurring. Simple asking public bodies to sign undertakings to improve staff training will not solve these problems.

99.7% of Android mobile phones vulnerable to data leak

Following on from the concerns regarding location data in mobiles, new evidence discovered by German security experts at the University of Ulm has indicated that up to 99.7% of phones with the Android operating system are vulnerable to a serious data leak. Using an ‘impersonation attack’, hackers can access phones and view, modify or delete calendars, contacts and private pictures.

With the market share of Android rapidly expanding, and more than 400,000 Android phones activated every day, the potential risks for this leak are huge. Considering a vast amount of these phones are for business and corporate use, there is also the potential for industrial espionage or blackmail.

Hackers can exploit this loophole by stealing authentication ‘tokens’ used to identify the phone, then using this information to log on to websites as the legitimate owner, without their knowledge.

In a blog on the university website, the researchers explained:

“The adversary can gain full access to the calendar, contacts information, or private web albums of the respective Google user.”

“An adversary could change the stored e-mail address of the victim’s boss or business partners hoping to receive sensitive or confidential material pertaining to their business.”

Mark Evans, director at IT services provider, Imerja, said:

“That such an enormous proportion of Android phones could potentially be leaking users’ personal data is shocking. Mobile devices are increasingly used for business, more so than laptops, and their security is essential to protect organisations against data breach or other ill-intentioned activities.”

“The message to companies is clear; mobile devices must be properly secured. They should be implementing robust and enforceable security policy structures to support effective mobile working, such as encryption.”

A spokesperson for Google said:

"We are aware of this issue, and have already fixed it for calendar and contacts in the latest versions of Android. We are working on fixing it in Picasa.”

Unfortunately, not all Android phones can be updated to the latest version (2.3.4.) and over 99% are still using previous versions, so the threat is still very real. Although the researchers did not find evidence of hackers utilising the leak yet, it seems inevitable that they will in time.

Google needs to ensure all versions of the operating system are secure against this risk, and all phones are updated automatically as a matter of course to avoid a privacy catastrophe which will rival the recent Playstation Network incident in terms of scale and scope. In the meantime, the Daily Mail lists some suggestions on protecting your Android phone.

Somerset County Council sends confidential data to wrong family

Somerset County Council have been reprimanded by the ICO after an employee broke data laws by sending sensitive personal information concerning a teenager’s medical and behavioural history to the wrong family. .The incident is thought to have occurred as a result of the council employee working on two similar cases at the same time.

In addition, the council failed to act in the correct manner when the error was revealed. The recipient of the information was initially told to throw it away, then later advised that a council employee would collect it

Sally-Anne Poole, the ICO's acting head of enforcement, pointed out that despite the information being returned, "the damage had already been done". She also claimed it was very likely the incident would cause "considerable embarrassment to those affected”. “The information collected by social services departments is often extremely sensitive,” she said. “Local authorities should make sure they have adequate measures in place to keep this information secure, especially where there is the potential for human error.”         

The chief executive of Somerset County Council, Sheila Wheeler, has signed an undertaking from the ICO indicating that staff will receive additional training on data policies and procedures.

Sony issue apology after personal details of 100m customers stolen

After the furore concerning the security beach of the Playstation Network, which meant the personal information of around 100 million users was stolen, Sony have been forced to apologise and offer a $1,000,000 identify theft insurance policy to protect their users in the future. 

Sony chief Sir Howard Stringer said:

"As a company we – and I – apologise for the inconvenience and concern caused by this attack. Let me assure you that the resources of this company have been focused on investigating the entire nature and impact of the cyber-attack we've all experienced and on fixing it. We are working with the FBI and other law enforcement agencies around the world to apprehend those responsible."

There has been widespread criticism of Sony’s slow response to the data breach, which is almost unprecedented in terms of scale. The crisis led to Sony’s share price falling by 4% on Thursday alone, as investor’s concerns grew about the total cost of the attacks. Sony hope to have an improved game network with tightened security back online in the next few days, after a downtime which is approaching three weeks. All users will be forced to change their password to ensure security is maintained.

It is impossible to tell if privacy fears will affect the market share of the Playstation 3 in the future, but Sony are offering a months free Playstation Network premium service “to make up for lost time” That may be their line, but many will be wary about the network for a considerable amount of time after a data breach which encompassed nearly the entire populations of the UK and Spain combined.

ICO: We don't need to use our "big stick"

At Big Brother Watch, we've long been critical of the repeated refusal of the Information Commissioner Christopher Graham (a very nice man) to use the powers he has to prosecute those who violate the UK's data protection laws. 

In an article published today on Public Service Online, the Commissioner stated that the "big stick is there, but doesn't need to be deployed all the time to have an effect".

We disagree.

The Information Commissioner has proved himself to be hugely effective at policing public bodies who fail to discharge their obligations under the Freedom of Information Act - naming and shaming the worst performers, from central government to local authorities.  He has also demonstrated an occasional willingness to get tough with organisations who lose sensitive personal information (the example of the large fine handed to Ealing and Hounslow Councils recently being one such example).

He has not, however, been pro-active in taking action to protect members of the public from online privacy infringements.  In particular, he refused to pursue what he termed "knee-jerk" action against Google after they collected sensitive personal information from the home WiFi systems of thousands of people and has yet to pick a fight with any of the numerous online shops who have irresponsibility leaked client information.

While we appreciate the ICO is attempting to take a softly-softly approach in order to achieve long-term incremental improvements, he has his "big stick" for a reason.  Occasionally, he needs to hit someone with it.

Southwest Ambulance involved in data theft

It has been revealed that a former employee of Southwest Ambulance in Arizona took the patient records of 581 people, including their names as well as their financial and medical information. The records were subsequently recovered and the affected customers were made aware of the data breach.

The data theft was discovered when a landlord cleared out the employee’s residence after they had moved out. According to the company, the records had been taken over the course of a number of years, and used primarily for training purchases. However, Southwest Ambulance have refused to disclose anything about the employee, including whether they left the company before or after the incident was discovered. In a bid to rectify the situation, Southwest have agreed to pay for credit-monitoring services for customers affected by the data breach.

Company officials claim there is no evidence that the stolen information was shared with any third parties or used inappropriately, although there is always the threat of targeted ‘phishing’ attacks. Holly Walter, spokesman for Southwest Ambulance, said this:

"We found nothing to indicate those records were used inappropriately,"

The company consider the breach to be an isolated incident, and assured customers that they regularly train their employees in how to handle and protect sensitive medical information.

It is shocking that someone involved in healthcare could abuse their position in this way. People have a right to expect their confidential financial and medical information to be kept safe.

The NHS breaches public trust... again

Two UK healthcare bodies have received serious warnings from the Information Commissioner’s Office after the mishandling of paper records led to breaches of the Data Protection Act. NHS Liverpool Community Health lost papers relating to the medical history of 31 children and their mothers when they moved premises in October 2010. After a full investigation, the ICO ruled that NHS Liverpool had failed to enter into a contract with the removal company to organise the handling of personal data. In addition, no processes had been created to ensure the data being moved was secure.

In an unrelated incident, the Council for Healthcare Regulatory Excellence (CHRE) were also found to be in breach of the Data Protection Act after a possible loss of documents from complaint review files, which contained sensitive personal data. The ICO was particularly unimpressed that due to the data management failings of the CHRE, they had no idea whether the data had fallen into the wrong hands, been lost or destroyed.

Sally Anne Poole, enforcement head at the ICO, said:

"These incidents highlight significant weaknesses in both organisations' data handling procedures. These incidents should act as a warning to other organisations who handle sensitive papers of the need to make sure their paper records management processes are as robust as their electronic data systems. The protection of data in all formats must be taken seriously."

Bernie Cuthel, the chief executive of NHS Liverpool, has signed a formal undertaking stating they will ensure written contracts are always in place with third parties responsible for the handling of personal data in future. Staff will also receive additional training on how to keep information secure when moving offices.

Harry Cayton, chief executive of the CHRE, has also signed an undertaking with the ICO, assuring them that all future information containing personal data sent between the data controller and regulators will be adequately protected.

We entrust health bodies such as these with some of the most personal and private data that exists about us, our medical histories, and we expect them to take their protection far more seriously in the future. These undertakings must be acted upon, and the ICO should monitor the behaviour of these organisations to ensure mistakes such as these do not happen again.

Millions of email addresses stolen from Marks & Spencer

The email addresses of millions of customers on Marks and Spencer’s database were stolen by hackers recently as part of a major data breach of the internet marketing firm Epsilon. Epsilon, who call themselves “the leading provider of multi-channel marketing services”, have 2,500 corporate clients worldwide and send 40 billion emails a year to their customers.

Files containing the names and email addresses of customers were accessed by unauthorized entry into their computer system. Tesco are also known to use Epsilon for their marketing, however they categorically deny that any of their customers’ details have been stolen.

M&S were forced to send an email to all their customers stating:

'We have been informed by Epsilon, a company we use to send emails to our customers, that some M&S customer email addresses have been accessed without authorisation. We wanted to bring this to your attention as it is possible that you may receive spam email messages as a result. We apologise for any inconvenience this may cause you. We take your privacy very seriously, and we will continue to work diligently to protect your personal information.’

M&S refused to release the amount of customers affected by the data breach. After realising the hack had occurred on April 4^th, Epsilon released a statement regarding the incident:

"A rigorous assessment determined that no other personal identifiable information associated with those names was at risk."

Coming after the recent debacles involving Play.com and Trip Advisor, it no longer seems possible to use the internet without seriously threatening the security of your information. As the hack is thought to have occurred on Epsilon’s American servers, the Information Commissioner’s Office are powerless to intervene.

Internet security expert Dr Stefan Fafinski, explained how spammers will use the information:

“Spammers will have a list of good, known and verifiable email addresses that comes straight out of M&S. Once they have names as well as email addresses, the spammers can personalise the emails they send out to look much more like a genuine company communication.”

Marks and Spencers has a diverse demographic of customers, many of whom will not be fully aware of the dangers of internet scams and ‘phishing’. For advice on how to spot these types of emails, visit www.scambusters.org

Royal Cornwall Hospitals Trust reprimanded by ICO

The Royal Cornwall Hospitals Trust has been reprimanded by the Information Commisioner’s Office (ICO) after it breached Data Protection rules twice in the last year. The first occurred in July 2010, when an individual received information relating to a different person when they submitted a subject access request. The second was in December 2010, when the very same person submitted a second subject access request, and again received information for a completely different person.

The ICO found that both events breached the Data Protection Act, and forced the chief executive of Royal Cornwall Hospitals to sign an undertaking to ensure that procedures for dealing with subject access requests are clearly defined and managed and that all staff receive the appropriate training and support in how to follow them.

Acting head of enforcement at the ICO, Sally-Anne Poole, said:

“More and more people today want to find out exactly what information their GP or hospital holds about them, making subject access requests an increasingly popular tool. However, just because staff are busy with requests, this does not mean they can stop doing adequate checks before information is sent out. I am pleased that Royal Cornwall Hospitals NHS Trust has agreed to take the necessary steps to make sure this sort of incident doesn't happen again.”

It is absolutely shocking that this NHS Trust managed to make an identical mistake to the same person twice. We hope they take the undertaking to improve their approach to data protection very seriously, and avoid making similar mistakes again. People have a right to expect their private medical histories to be kept secure.

BP loses the data of 13,000 oil spill victims

As if the oil spill which hit the US's Gulf Coast last year causing significant environmental damage and economic hardship for home and business owners wasn't bad enough, it has today been revealed that the details of 13,000 of the victims of the disaster have been lost by BP.

According to a report published on the Info Security website, full details are still emerging of exactly how the data loss occured but it appears likely that it happened following the loss of a company laptop.  Rather than encrypting the details of the 13,000 people whose information was held on the laptop, it appears that the computer was only protected with an easy-to-circumvent Windows password.  In specific, the laptop contained the details of those who had made claims to the company for financial compensation. 

Sadly, cases like this are all too common - be they the loss of personal medical information by the NHS at one end, or the compromising of the data of 7 million users of the Play.com website.  It is absolutely crucial that, in order to avoid mass data losses such as this, that information held on USB sticks or laptops is fully encypted so as to render it useless in the event is is stolen or misplaced.

You can view the whole story here.