Information Commissioner's Office demands encryption of mobile devices
Demonstrating the increasing appetite of the Information Commissioner's Office (ICO) to take enforcement action, Virgin Media Limited is the latest organisation to be held to account for a breach of the Data Protection Act 1998 (DPA). The breach seems to have occurred earlier this year following the loss of a compact disc that was passed to Virgin Media by Carphone Warehouse. The disc contained personal details of various individuals' interest in opening a Virgin Media Account in a Carphone Warehouse store.
In this instance, the ICO has not gone straight to issuing an enforcement notice (by contrast to the treatment of the Liberal Democrat Party last week), but has instead obtained a formal undertaking requiring Virgin Media to undertake certain steps to improve its security measures. The breadth of the obligation to use encryption will surprise many organisations.
Virgin Media is required, with immediate effect, to encrypt all portable or mobile devices that store and transmit personal information. Further, the company is to ensure that any service provider processing personal information on its behalf must also use encryption software and this requirement has to be clearly stated in all contracts. We suspect that in practice not many organisations expressly state this in their contracts. Most - if they deal with security at all - will contain the generic security language contained in the seventh principle of the DPA.
The ICO has not yet issued clear guidance on the level of security it expects companies to adopt in order to comply with the seventh principle of the DPA, a position which is increasingly frustrating. It is, however, becoming rapidly clear in the wake of the recent spate of public security breaches that the ICO views encryption as critical. Particularly where mobile devices are involved.
The ICO's patience on this has clearly worn out, as over the past few months laptops (Marks & Spencer), DVDs (HM Revenue and Customs), and memory sticks (PA Consulting) have all gone astray, with the potential loss of thousands of records. In a number of cases the 'culprit' has been a service provider (hence the insistence on wording being included in the contracts of the service provider) albeit that the organisation appointing them is still held responsible as the data controller (eg M&S).
We would, therefore, urge you to consider whether you are treating this topic with the scrutiny required in contracts, as well as operationally. Those in the public sector are already trying to get to grips with the outcome of the Data Handling Review and the subsequent requirement from the Office of Government Commerce to include new security-related clauses in contracts under which data will be handled. The Office of Government Commerce also strongly urges a review of existing contracts.
However, the impact on those having to implement the recommendation does not seem to have been thought through; nor does the impact on the service providers who suddenly find themselves required to meet significantly higher security standards that were not built into their cost models.
With newly granted powers of the ICO, including the ability to levy fines for serious breaches, now is the time to undertake a serious review of the security applied to personal data that you process and how this is treated in your contracts. The scale of fine the ICO will be able to inflict remains unknown.
For those wanting guidance on good or bad security practice, the Financial Services Authority recent guidance on its expectations for data security provides a useful reference point. Follow this link to our e80 on this subject in April 2008
This article is reproduced from Eversheds e80 service. You can find out more about Eversheds e80 and search the Eversheds e80 archive at www.eversheds80.com.
e80 is provided by Eversheds for information purposes only and should not be regarded as a substitute for taking legal advice. It is reproduced here by kind permission of and is © Eversheds.
|
