Feeds

Controlling the fallout of a data loss

Being proactive saves face

Protecting against web application threats using SSL

If readers want to examine an interesting example of how to manage a data loss, have a look at what happened at the London Borough of Barnet. A data loss involving 9,000 children followed a burglary of the home of a member of staff. The loss included the council’s computer equipment (a laptop), CD Roms and memory sticks, along with other items from the house.

Like most organisations, the council had implemented procedures and policies to ensure that the personal data on the computer equipment and related portable media were encrypted. Unfortunately, in this case, there were unencrypted personal data stored on CDs and memory sticks which were stolen with the laptop. As there had been a clear breach of council policies, the member of staff concerned was suspended and data subjects (or in this case, the parents of data subjects) were contacted by a letter. So what is new in this?

Well, I think the new item is the public relations handling of data subjects (and parents). I think the council formed the view that having reported the data loss to the parents (and presumably the ICO), an undertaking from the ICO would be a likely end-point of the process. Given this, it followed that the ICO’s publicity machine would be very likely to issue its usual press statement concerning details of the council’s undertaking (if there were to be one).

So instead of waiting for the inevitable, LB Barnet took the initiative. It published full details of the data loss on its website, invited data subjects to ask questions or exercise their right of access, gave details of what it was doing to remedy the situation and provided contact details for those who had questions. The letter to the parents of data subjects and the content of the website pages were either signed by the chief exec or approved by him.

In this way, the council managed the bad news instead of the ICO managing it through his usual press release that accompanies an undertaking. This means that if there were to be an undertaking and if the ICO were to issue a press release, then the subject is “old news”. In fact, is there a need for an undertaking if the chief exec has publicly committed himself to do the things that the undertaking would require of him?

It will be interesting to see how this pans out in practice. However, consideration of seizing the news agenda when there is a data loss is something that data controllers can do. In addition, one can always follow the government’s example of identifying “a very good day to bury bad news”. Issuing press releases at 4:00pm on a Friday or the day before a bank holiday is usually a good time for a press release to be missed.

Originally published on Hawktalk, the blog of Amberhawk Training Ltd.

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.