1,000 Breaches of Data Protection

The Information Commissioner’s Office (ICO) has urged organisations to be extra vigilant in the way they handle personal data, after the number of reported data protection breaches reached 1,000.

Anyone who processes personal information must comply with the eight data protection principles laid down in the Data Protection Act 1998 (DPA) in order to make sure that it does not end up in the wrong hands. This means having in place procedures to avoid wrongful disclosure and ensuring that staff are adequately trained in applying them.

Many data security breaches are the result of human error. The ICO has the following tips on how to ensure personal information is protected:

1. Make sure that you know to whom you are disclosing personal information. Have you checked that they are genuine and that they are entitled to the requested information?

2. Beware of the dangers of email. Be particularly careful when selecting recipients of personal information from drop-down lists to ensure you get the right ones. Do not click on ‘reply to all’ when handling personal information. For more sensitive information, simple email disclosure may not be sufficiently secure;

3. Check that automated systems (e.g. for stuffing envelopes) are working properly and do some dip sampling to verify this;

4. Beware of window envelopes. Make sure that only the name and address can be seen through the window;

5. Check the positioning of computer screens, particularly in open areas or by windows where there is a danger they might be seen by members of the public; and

6. Train your staff in the risks of wrongful disclosure and make sure they adhere to strict procedures when passing on personal information.

The ICO has also published a Code of Practice explaining the approach the DPA applies to the collection and use of personal information online. This gives practical advice for organisations that do business over the Internet and are therefore subject to the DPA.

Guidance on how to comply with the DPA can be found in the ICO’s Guide to Data Protection.