HMRC manual on data protection was protected data
444751
Juniors kept in dark, then hung out to dry? Yes Minister HMRC restricted details of its security procedures to senior officials, it has emerged, just weeks after the department pilloried a junior official for loading the UKâs child benefit database onto CDs which were then lost.â¦
393826
And issues disclosure 'guidance' The Information Commissioner's Office has given a green light to councils sharing council tax information.â¦
679853
Many corporations today employ multiple techniques to protect against data loss. Unfortunately, the various approaches are often applied and managed in an uncoordinated manner. Ironically, the nightly backup, for some critical classes of applications, becomes almost irrelevant, representing a tertiary, "last ditch" level of data protection.
238171
HMRC promises light touch for honest late starters Traders in a broad range of electronic goods have three months to overhaul their systems ahead of a VAT shakeup designed to crack down on missing trader fraud.â¦
98493
Tells gov: think before you act The Information Commissioner has published some advice for government bodies that want to share information but think data protection laws prevent them from doing so.â¦
537741
As the TJX Companies data leakage incident seeped its way further toward becoming the Exxon Valdez of corporate information spills this week, researchers reinforced the notion that businesses continue to make a mess of electronic data security because they fail to foster adequate internal communication.A new report from Ponemon Institute -- which has produced a series of studies into corporate data leakage over the last several years -- concluded that the various people in charge of collecting, protecting, and managing sensitive information inside large businesses typically don't collaborate sufficiently. Those constituencies also have widely differing views regarding their respective roles in safeguarding the content, the report contends.Echoing comments made by a number of security policy experts in recent months, the study highlights the fact that companies are likely failing to protect data based on broken business processes -- at least as much as they may be succumbing to complex technological challenges.Just as many software developers complain that their applications are left vulnerable to attack because business teams refuse to wait long enough for the programs' underlying code to be made secure, the results of Ponemon's survey of 3,600 IT security and marketing executives -- located in the United States, the United Kingdom, and Germany -- illustrate a distinct lack of organizational coordination in the name of protecting data.For instance, only 30 percent of the marketing workers interviewed for the study said they actually consult security teams before collecting and using sensitive information, while 80 percent of the IT security employees surveyed indicated a belief that they are typically involved in such decision-making.In addition, while only 53 percent of IT security workers surveyed said their companies have well-coordinated data protection policies, only 32 percent of those workers who handle the information said their employers are doing an adequate job. Some 45 percent of security workers don't feel that their data-handling rules get in the way of business objectives, while only 21 percent of the people using the content feel that such policies represent roadblocks to their productivity.And in yet another blow to the perceptions of security workers, only 21 percent of the marketers using sensitive information interviewed by Ponemon said that security teams play a leading role in defending the content.At the heart of the matter is the issue of poor collaboration between all the involved parties, according to the research firm. Only 29 percent of those interviewed said their companies' current policies would be adequate to handle a major breach within 24 hours of its occurrence.Based on the results, Ponemon contends that organizations with substandard data protection collaboration policies were twice as likely as to have had a data breach within the last two years.Therein lays the ultimate proof of collaboration's impact on data protection, said executives with Microsoft, which sponsored the research report."We expect the data threat environment to continue to evolve, and at the same time, clearly, there's a long way to go based on where we are today," said Brendon Lynch, director of privacy strategy at Microsoft. "There's this major issue around the degree to which marketing professionals consult with these other involved parties; they see the policies as getting in the way of business objectives, and they're not interacting with security or privacy specialists based on that, which undermines the process change that companies are already attempting to enact."As part of its connection with the study, Microsoft is pushing the notion that companies should merge their security and data privacy operations to simplify the process of interaction between the various constituencies.Some 80 percent of all respondents to the Ponemon study said that they would support further combination of those teams to improve coordination of their data defenses."We feel that most companies need to be more holistic and bring these types of roles together," said Lynch. "All of these workers are critically important to better locking down the data, so they need to look at developing appropriate-use cases, and how to better fulfill business objectives while maintaining protection."The study is just the latest expert opinion to highlight the fact that despite the ever-expanding range of security technologies available to enterprises to protect sensitive data, many organizations could be well served to start with a review of their internal policies.In addition to getting business teams to work more closely with security and privacy pros, some experts contend that organizations could improve security risks quickly by merely retrenching the settings of their network and IT systems.Many critical infrastructure systems are installed with the idea of getting an operation up and running first, with plans to bolster security after the fact, and never readdressed, said Paul Williams, chief technology officer at IT security services provider Global Security Management.Reviewing networking gear settings to ensure that they have been sufficiently obscured, along with tweaking the features of other systems crucial to protect external attack is another way that companies can significantly bolster data security with little to no capital investment, he said."Before you learn how to defend a network, you have to take a walk on the wild side and see how you can break in yourself," said Williams. "Most networks can be made more secure by simply taking the time to go back and see how things were installed and whether or not the settings were changed in a way that promotes security; people typically look to technology solutions to address these problems, but they could begin helping themselves significantly at relatively no cost."In a presentation delivered at the Gartner IT Symposium earlier this month, analyst Neil MacDonald told attendees of the show that they could save money on their security projects if they continue to push for a more thorough, process-driven approach to data protection on a high level within their organizations."This can't be about managing a set of projects, it has to be about improving process," MacDonald said. "At the end of the day, the idea of tagging every piece of data in an enterprise for the sake of protecting it is unfeasible; it sounds great on paper, but the problem is a monumental effort with new information coming in all the time, it's not a process that's sustainable."
432256
Data protection officials from 27 European countries have warned Google it is storing data on people&#39;s searches for too long-- but Europe&#39;s top privacy guardian, the European Data Protection Supervisor Peter Hustinx, believes Google&#39;s efforts to respect the privacy of European citizens in its Internet search software &quot;is not just window dressing.&quot;
381789
What exactly does the law mean by "data quality," and what does it have to do with privacy?
528623
Vormetric&#39;s CoreGuard helps Ocwen protect confidential information in its online exchange for the mortgage industry. By Steven Marlin.
497236
Long ago, when businesses kept sensitive information locked away in file cabinets and safes, it was relatively cheap and easy to store valuable data and control who had access to it. Today, enterprises invest millions in security, storage, and compliance technologies -- all in the name of increasing visibility into where vital electronic information lives and how it is being defended.
451187
Analysis No delay in EC anti-trust compliance
147030
(InfoWorld) - Data protection officials from 27 European countries have warned Google it is storing data on people's searches for too long -- but Europe's top privacy guardian, the European Data Protection Supervisor Peter Hustinx, believes Google's efforts to respect the privacy of European citizens in its Internet search software "is not just window dressing."His comments at a conference in Amsterdam on Thursday come a week after the data protection officials wrote to the company, expressing concerns that the company could be breaching European laws by holding on to details about people's Internet searches for too long.The officials from each of the 27 member states of the European Union sit on a Europe-wide data protection committee called the Article 29 Working Group, which is chaired by Hustinx.The group has asked Google to justify why it needs to retain the data for up to two years, and whether the company has "fulfilled all the necessary requirements" on data protection. European Justice and Home Affairs Commissioner Franco Frattini said Friday that the questions posed in that letter are "legitimate."But speaking on the sidelines of a data protection conference in Amsterdam, which Google's global privacy chief Peter Fleischer was also attending, Hustinx played down the inquiry."I see a company which has very powerful tools, thinking about integrating privacy solutions -- that's the big picture," he said.Google's efforts to respect people's privacy "isn't just window dressing, but we will hold them to what they are saying," he added.His comments came directly after Fleischer made a presentation explaining how Google's personal search function works. Users can opt in to this more refined search tool, using a log-in identity and password. Once they have done so, the search engine takes their Internet searching history into consideration when picking results for new searches.For example, if you have been searching for cars recently and you tap in the search term "golf", the results will focus on cars of that model rather than on the sport, Fleischer explained.Users of the personalized search function can delete searches they made in the past, in order to prevent them influencing the search results they get in future, Fleischer added.By allowing people to opt in to the personalized search function and by giving them the ability to customize their search history, Google was respecting people's privacy, Fleischer said.Google stores information about all searches, both personalized and normal, he said, but details of normal searches can't be linked to an individual."Google does have the information but it can't link it to you," he said.In the past, Fleischer has said that the company needs to keep details of people's searches for security reasons, to help guard against hacking.Information about people's searches can also help track criminal activity such as child porn rings, but security agencies are mainly interested in the information Google stores on the users of its e-mail service, Gmail, he said.The police aren't interested in the information about people's general searches, he said. He declined to comment on whether details about subscribers to the personalized search function had been accessed by the authorities.European data protection law limits the amount of time companies can hold on to personal data gleaned from electronic networks to the amount of time the information is required for billing purposes. The law was written mainly with fixed and mobile phone technology in mind, but it also applies to data gathered from Internet searches.Fleischer said the law, passed in 1995 when Google hadn't been born, is totally out of date and he urged European lawmakers to update it to take account of new technologies."The technical architecture has changed a lot since 1995, even though the basic principles of privacy still apply. The time has come to re-think some of this process," he said.In particular, the way the law deals with international transfers of data has to be reviewed, he said. Europe has one of the toughest data protection regimes in the world. The law forbids the passing of personal information about European citizens to other parts of the world with more lax data protection regimes.The U.S. is considered to offer inferior data protection, so companies operating on both sides of the Atlantic have to sign complicated get-out clauses in order to pass information about their staff or customers to offices in the U.S."The Internet is all about international transfers," Fleischer said. He wants the different parts of the world to cooperate in order to create a single approach to data protection "We as a company have a single approach to privacy right across the world. We can't run a system that has different privacy levels for, say Google.com and the Dutch site Google.nl -- that would be crazy."So if we can do it why can't policymakers?" he asked.He called for a global privacy treaty. "It will be complicated and will probably take a decade, but the technology of the internet has been a wake-up call for policymakers that this is needed. We need to start talking now. We in the industry have to start the debate," he said.
550193
(InfoWorld) - Financial data transfer company Swift can continue to pass details of European citizens' transactions to U.S. authorities provided the firm signs a formal get-out clause granting it immunity from European data protection laws, the European Commission said Thursday. The Society for Worldwide Interbank Financial Telecommunication SCRL (Swift) has been at the center of aÂ transatlantic dispute over data protectionÂ since being ordered to share millions of pieces of information about people and companies from around the world with U.S. agencies after the terrorist attacks on Sept. 11, 2001. The information was deemed essential in tracing the financing of terrorism and Swift complied with the order. However, European data protection laws forbid transfers of European citizens' personal data outside the European Union, if the country receiving the data has a weaker data protection regime than Europe's. The U.S. is considered such a country under European laws. In June 2006, The New York Times revealed that Swift had been sharing the data with U.S. authorities for years, sparkingÂ investigations in EuropeÂ into how the European laws could so easily have been breached. In an agreement reached between the European Commission, the German government, which currently holds the E.U.'s presidency, and the U.S. Treasury department, Swift can continue to share the information if it signs the safe harbor agreement, and as long as individuals are informed by their banks that the information will be passed over to U.S. authorities, the Commission said. If these conditions are met, then U.S. authorities are free to keep the data for up to five years, said European Commission spokesman Friso Roscam Abbing. The safe harbor agreement has been signed by many large multinationals including Microsoft. By signing it, companies agree to respect Europeans' private data once it leaves the E.U. "The E.U. will have now the necessary guarantees that the U.S. Treasury processes data it receives from Swift's mirror server in USA in a way which takes account of E.U. data protection principles," said Commission Vice President Franco Frattini, the commissioner responsible for justice, freedom and security. "I welcome the United States Treasury Department's unilateral representations and the opportunity the Treasury has given the European Union to have its views and concerns duly reflected in the representations," Frattini added. "As well as Swift joining the Safe Harbor and its compliance with the Safe Harbor privacy principles, we now look to Swift and to the financial institutions which use its services to ensure that they fully comply with their information obligations under European data protection law. We urge them to take all the necessary steps to ensure their quick compliance with European data protection law." Swift has promised to sign the safe harbor agreement in the coming days, while banks that use Swift to transfer funds have agreed to set up systems that will alert their customers of data transfers to the U.S. by Sept. 1, Roscam Abbing said. However, it remains unclear what happens if customers decide that they don't want their information shared, the Commission spokesman added. Â
241506
Well-insulated contacts A sales agent has won the right to retain a customer database built up while working on behalf of an insulation company. The UKâs High Court ruled that the agent was the âfirst ownerâ of the database under the EU Database Directive.â¦
385883
Photocopying wallet information pays off.
427937
'Fraught with disagreement and difficulty' The House of Lords will clarify how data protection and freedom of information laws should work together if it hears an NHS appeal against an order to release clinical data. Any ruling would be a defining one for the two emerging areas of law.â¦
690455
Hewlett-Packard Co has added to its HP-UX 11i v2 operating environment by extending data protection for its HP Integrity servers.