Better data protection 'required'
640827
The government needs to ensure greater protection for people's personal information, a think-tank  warns.
389678
The head of the U.K. National Health Service has defended plans to build a centralized database of patient records following another embarrassing loss of personal information by the government.The U.K. Department of Health admitted this weekend that nine of its regional NHS trusts have reported losing patient data. One of the trusts, the City and Hackney Primary Care Trust, in east London, lost the medical records for about 160,000 children, according to newspaper reports. The total number of records has not been disclosed.The losses emerged as part of a wider review following similar government blunders, and have revived questions about the security of building a centralized patient records database, part of the U.K.&#39;s National Programme for IT (NPfIT). But David Nicholson, chief executive of the NHS, said the project is essential and should go ahead.&quot;It&#39;s vitally important that when a doctor is sitting in front of a patient they have all the information they need at their fingertips, and that&#39;s what&#39;s been driving us through all this,&quot; Nicholson told BBC Radio 4&#39;s Today program on Monday.The proposed system will not be a single large records database, but a series of interconnected regional databases, he said. And the security system will be more rigorous than that used with most Internet banking systems, according to Nicholson.&quot;You&#39;d need a user name, a password and a smart card [to access patient records] and you would have role-controlled access,&quot; he said. &quot;So a nurse on a ward with a smart card and a password could only access a relatively small number of patient records.&quot;The information that was reported lost over the weekend was encrypted and so not vulnerable to misuse, Nicholson said.But Ross Anderson, a security expert at the University of Cambridge, told Radio 4 that whether the data is encrypted is not the main issue.&quot;One of the questions you have to ask here is not whether the data was encrypted or password protected, but why someone was able to have access to 160,000 children&#39;s records,&quot; he said. &quot;In private industry ... if someone tried to make off with hundreds of thousands of records the alarms would sound.&quot;Opposition leaders pounced on the latest misstep as evidence that the Labour government can&#39;t be trusted with its citizens&#39; data. They called for further studies to show how the proposed patient records system would protect privacy.The incident comes after the U.K.&#39;s HM Revenue and Customs lost personal records for 25 million Britons, and the Driving Standards Agency lost records for more than 3 million learner drivers.&quot;The power of technology means it can be very easy to use the information, but also very easy to lose the information,&quot; the Information Commissioner Richard Thomas said on the Today program. &quot;The events of the last few weeks have woken up everybody to the importance of taking these matters seriously.&quot;&#160;
447952
IT security professionals need to take steps to properly manage how employee-owned consumer devices are used in the workplace, analysts warned at Gartner's IT security summit in London this week.
389598
Massachusetts' new top business regulator yesterday called on retailers to start disclosing how well they protect customer credit-card and debit-card data, an idea gaining traction after a data breach at retailer TJX Cos. last month.
64993
InfoWorld - Technologies aimed at bolstering enterprise data protection remain tough to manage, but companies can derive significant benefits if they utilize the tools with a pragmatic approach, said security industry experts.
571953
Patients currently don't have any way to keep their personal information from being shared with third parties.
444751
Juniors kept in dark, then hung out to dry? Yes Minister HMRC restricted details of its security procedures to senior officials, it has emerged, just weeks after the department pilloried a junior official for loading the UKâs child benefit database onto CDs which were then lost.â¦
372995
TORONTO (CP) - Privacy guardians across the country say Canada needs to do more to protect its citizens against e-mail spam and identity theft.
245418
Tories warn of "state snooping'' as greater sharing of private data between Whitehall departments is planned.
388261
(InfoWorld) - An overwhelming percentage of businesses still fall far short in their efforts to comply with industry data-handling regulations and reduce their likelihood of experiencing a serious leakage incident, according to a new survey. In a report to be published by the IT Policy Compliance Group on July 18, the consortium of IT compliance and security experts concludes that some 90 percent of all businesses still do not have sufficient policies in place to meet data governance regulations and adequately limit the risk of a breach. In the survey of 475 companies, a third of whom reported revenues of more than $1 billion last year, the industry group found that an overwhelming majority of the firms expect to deal with at least six business disruptions related to major data incidents per year along with five or more instances of information loss or theft. While businesses continue to invest policy enforcement software, and other technologies aimed at helping them meet data-handling regulations, said James Hurley, managing director of IT Policy Compliance Group, most are still struggling to fill all the gaps left in their systems that leave them open to potential incidents. Hurley is also a senior research manager at security software maker Symantec, a member of the compliance policy think tank, along with such organizations as the Computer Security Institute, Institute of Internal Auditors, ISACA, and IT Governance Institute. Along with well-known federal guidelines, such as the Sarbanes-Oxley Act, many companies are having trouble responding to new statewide data protection measures crafted after the California 1386 bill, which requires businesses to make public notice of severe data incidents, he said. "When it comes to protecting data, a lot of organizations still find information all over the place that they may not even have control over," Hurley said. "People are finally discovering this is a difficult problem and that the controls they thought they have in place may not be adequate; that they need to rethink those controls and find out where the data inventory actually is because in most organizations, it's not under control." In addition to gauging what percentage of companies remain at risk for a data breach, the survey also attempted to measure the impact of such an event on the average company. Based on its respondents' replies, businesses that are forced to report major incidents publicly can expect to experience an 8 percent loss of their stock price and an equal 8 percent of their customers. Companies can also expect to report an 8 percent falloff in their quarterly revenue along with additional costs for litigation, customer notification, and subsequent settlements averaging $100 per each record they lose. In a nod to the increased challenge of meeting regulations and lowering data leakage within enterprises, the report concludes that larger companies are more likely to have incidents, based on its research. Organizations with less than 1,000 workers average roughly 8 percent in revenue and customer losses per event, whereas companies with more than 100,000 employees can expect to lose 12 percent of their sales and clientele. While some researchers have tried previously to divine the overall expense of having a major data breach, such as the one reported by retailer TJX Companies in early 2007, it has been hard to guess just how much such an event truly costs said Mike Money, associate director at Protiviti, an auditing services specialist that is also participating in the consortium. "We finally have some data on this because of the state laws that have gone into effect, so hopefully some companies see this report and understand the extent of the problem," Money said. "People are finally starting to focus on the issue because they see the newspaper headlines every day, and until you've been through one of these types of events, it's hard to understand all the implications." Unsurprisingly, the report also finds that companies that allocate the highest budgets for compliance automation technologies are faring better in their efforts than those who spend less on the issue. In a shift from previous studies completed by IT Policy Compliance Group, however, it appears that most organizations are realizing they need to adjust their budgets to account for the tools, Hurley said. "The difference is that these state regulations have put this on the front of the radar screen, and they are realizing that they need to spend money to solve security problems that benefit compliance goals," said Hurley. "There's a clear linkage between having better controls and experiencing fewer data losses and business disruptions, as obvious as that may seem."
612635
The Conservatives on Wednesday demanded a government statement on the handling of data on foreign crime suspects after authorities admitted they had failed for a year to match details sent by the Dutch police on 15 serious crime suspects held in the British DNA police databank.
157181
Dear Sir, you personal data has been made public... The European Commission has published proposals for a law change that would force telecoms firms to notify regulators and customers of all breaches of their data security.â¦
191107
Tougher rules over travel insurance are needed to protect holidaymakers, an MPs' report says.
95459
A "horrifying" number of organisations have breached data protection rules in the past year, a report says.
694442
Data security concerns are raised after it emerges celebrities and MPs cannot submit tax returns online.
432256
Data protection officials from 27 European countries have warned Google it is storing data on people&#39;s searches for too long-- but Europe&#39;s top privacy guardian, the European Data Protection Supervisor Peter Hustinx, believes Google&#39;s efforts to respect the privacy of European citizens in its Internet search software &quot;is not just window dressing.&quot;
374369
Traditional antivirus technology may be too slow to protect users, researchers say.