Insurance giant rapped on knuckles over DPA breach
Amicus in doghouse over stolen, unencrypted laptop
Ensure Ease of Recovery with Asigra’s Agentless Software
Insurance firm Amicus Legal has been put on notice for breaches of the Data Protection Act, after it failed to protect sensitive customer data on a laptop that was subsequently stolen.
The laptop, privately owned by a contracted consultant, contained an estimated 100,000 unencrypted customer records. The sensitive data held on the machine in plain text included details of legal advice.
The Information Commissioner’s Office (ICO) has obtained a legal undertaking from Amicus Legal that it will ensure proper protection of sensitive data is maintained in future. For example, Amicus has promised to use encryption on portable computers and USB sticks.
Breaches to the agreement could result in enforcement action by the ICO. In a statement, the data privacy watchdog said the case illustrated that firms are responsible for the security practices of their contractors.
Sally-Anne Poole, head of enforcement & investigations at the ICO, said: "This case was serious because it involved the data of 100,000 customers, including sensitive information relating to legal advice. This breach illustrates that even though a contractor lost the data, it is the data controller (Amicus Legal Ltd) which is responsible for the security of the information. It is vital that personal information is handled properly and in compliance with the Data Protection Act."
"Since November 2007, 161 data security breaches have been reported to the ICO by the private sector. We urge all CEOs and their senior management teams to take personal responsibility for treating data protection as a corporate governance issue affecting the whole organisation. They have to make sure that safeguarding the personal information of customers and staff is embedded in their organisational culture." ®
COMMENTS
Compensation?
Maybe there should be a massive fine for breaches like this. How about it being a fixed rate with an escalator for subsequent offenses from the same organisation? I would suggest that it works on the number of records, so £100 per record for the first offense. £200 per record for the second offense --- £300 for the third and so on.
Then there is the compensation for the victims of the transgression. Let's say £10,000 each for the first offense --- £20,000 each for the second --- £30,000 for the third and so on.
Of course, to escape other than the first one they would work out something like a 'hive down' so that it is a 'new' organisation. Okay, ANY company which employs a director of a previous offending company will automatically carry the number of previous offenses by any and all comapnies in which any of its directors were employed.
So director one comes from a two time offender and director two comes from a one time offender. That gives you THREE on the card to start with so YOUR first offense will be a FOUR TIMES PAYOUT !!
You want your laws to work, then you need to make them work.
Oh....I almost forgot....what about the employee who was stupid and careless enough to lose the stuff? Automatic dismissal (as a legal requirement) and add a code to his/her NI number making it ILLEGAL to employ (£1,000,000 fine for any breach) them anywhere remotely near sensitive data --- for life !
Yet another loss!
And government want us to have ID Cards!
The former Data Commissioner who warned us about "Sleepwalikg into a surveillance society" today stated there had been at least 200 breaches of data, some serious, since the last review.
There's only one way to solve this ... open prosecution and massive fines for breaches. Hit companies and personnel in their pockets and in the courts.
And government want us to have ID Cards! Are we mad?
who paid when the Nationwide paid for this ?
The people who paid the Nationwide fine of £980,000 for a similar breach of the DPA a couple of years ago were the victims of the data loss, account holders like yours truly who own this non-profit making mutual. I still prefer it being a mutual to it being a private bank.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Enabling efficient data center monitoring
Agentless Backup is Not a Myth
Top 10 SIEM Implementer’s Checklist
