tfpl blog

Is your information safe?

Data protection and information governance are key topics of conversation at the moment.  Indeed Data Protection and Data Privacy day was marked across the United States and Europe on 28^th Jan.  Key areas of discussion and concern were the wealth of personal data and information that is now out in cyberspace due to the popular use of social networking sites.  Whilst information sharing is all well and good it seems that people are so enthusiastic about the opportunities that they are neglecting the consequences providing some information can pose.  Dan Raywood in his article in http://tinyurl.com/y95tkhg highlights the problem for employers when the Ministry of Defence revealed that there had been 16 information leaks in the last 18 months via social networking sites.  I think that the utopia of free information sharing encouraged by the early users of the internet is a fantastic philosophy however, I do think that people now need to use this with a sense of caution too as there are, unfortunately unscrupulous people out there who are all too happy to use this to their own advantage and others detriment.

Another key discussion point was the new powers given to the Information Commissioners Office (ICO).   Under new laws that are due to come into force on 6^th April 2010 the ICO could hand out penalties of up to £500K for those companies that are found breaching data protection laws.  This I really don’t find surprising after seeing reports from the ICO that there have been over 800 data breaches in the last 2 years alone.  There have been numerous examples in the news in the recent past of laptops of data being lost on public transport etc.  This is a glaringly obvious example of breach of data protection, but is data protection law easy to follow, how is it affected by Freedom of Information?  Do you know what data/information can be released or not?  It seems to me that the law is never an easy thing to follow and there are some intricate complexities particularly involved in Data Protection.  This is further complicated by new technologies such as social media making it easier than never before to communicate and pass on information.  The ICO states “that staff should be adequately trained and organisations should give proper consideration to restricting staff from downloading large volumes of data on to memory sticks and other portable devices”.   They encourage companies to report data breaches and act responsibly.  Whilst these companies may face regulatory action it wont be as severe as if breaches are covered up and subsequently discovered.  Reference from News E Week Europe http://tinyurl.com/y9svlpu

I think that all of us should be a little more aware and conscientious about the information we are posting and passing on to others in order to protect not only other people but ourselves as well.  In addition making yourself more aware of the law and your own responsibilities under it in the workplace is of great importance given recent reports and events.

Digital Economy Bill and further copyright changes, what does it mean for you?

Since my last post on copyright the debate has heated up.  Currently Google, Yahoo, Ebay and Facebook have come together to oppose legislation, drafted in the Digital Economy Bill to increase the power to the secretary of state to change copyright law.  The legislation aims to stop copyright infringements taking place something which is all too easy in our new digital world.  However, the legislation that is causing this conflict is the ability given to closely monitor users on the internet in order to stop abusers of copyright from continuing to operate.  Google and the other internet companies are concerned that this ability is open to abuse to monitor people’s data usage regardless of whether any illegal behaviour has taken place or not.  Further details can be found at http://www.macworld.co.uk/digitallifestyle/news/index.cfm?RSS&NewsID=27970  If this is the case, will we soon be looking into the wrong use of internet monitoring information like we currently are with the misuse of CCTV footage?

The Digital Economy Bill, as currently drafted, also poses a number of difficulties for libraries offering internet access to its users, because of the question of liability for copyright infringement. 

In addition, the Intellectual Property Office have launched the second part of consultation regarding proposed changes to UK copyright legislation which will be of benefit particularly to educational and research institutions. For further details please see http://www.ipo.gov.uk/about/press/press-release/press-release-2009/press-release-20091211.htm

Our resident expert in all things copyright, Paul Pedley addresses this and other changes to copyright that effect information professionals in his suite of training courses running next year.  An introduction to copyright gives a thorough grounding in update issues affecting the information professional and how to deal with them.  The more advanced digital copyright builds on the initial course and goes into further depth on copyright issues; Web 2.0 for copyright specifically looks at how social media is affected by copyright legislation.  Paul’s recent course on Digital Licensing covered discussions on how libraries are being affected by the new Digital Economy Bill and the concerns it is raising in addition to advice and tips on how to negotiate and re-negotiate licenses for copyright.

The Google-isation of (re)search. SLA Europe, 7 October 2009

SLA Europe had an excellent turnout for their most recent evening event.

The panel of three speakers (professor Dave Nicholas of UCL, Kathy Jacobs of Pinsent Masons and Roger James of the University of Westminster) presented their views on how Google is influencing our research behaviours, the challenges this brings to information professionals, as well as the opportunities new search technologies offer.

Some of the interesting points raised:

• We are all the Google generation - UCL has undertaken extensive research which demonstrates that older people are actually better at using Google than the young
• Digital transition means a loss of contact with our audience/user community, the decoupling of the information intermediary and the end-user.  But how significant is this?  Have we ever really known how people behave or use information?
• People want fast, direct and pragmatic access to information - so sell the abstracts and give away the PDFs
• Users want immersive social information environments - they are used to Facebook/Amazon type interfaces which recognise them and prompt them to look at related topics
•   We need to match the usability of Google when we present information - clean design, white space, no clutter, speed of access, no need for training.  Multiple user interfaces to different content sets are not a good idea
• Information literacy and search skills do need to be introduced and enforced - poor searches which yield incomplete, out of date or inaccurate information are real business risks
• In a corporate environment, consider whether it is easier to purchase a book via Amazon or via the information department?  In most cases it is easier (and quicker) to buy from Amazon
• And/or Google?  Don’t take on Google because you’ll lose.  Accept that it will be ‘and’ Google
• Creation or curation?  Are we storing old stuff or creating new? 

Neil Infield chaired the event and led a lively Q&A session which required energetic transfers of the microphone around the room. 

Melanie Goody

Director of Consultancy

PS: Roger James has uploaded his slides onto LinkedIn (you will need a LinkedIn account to view them).

Copyright, do you know what's right?

Copyright law is fast becoming a mine field.  Whilst the law itself doesn’t change a great deal, advances in technology and the way it is used are raising fundamental questions on copyright and copyright infringement with fines and prison sentences becoming more common.  A key example is what is happening at the moment with Google Book search settlement in the States.  For those of you that are not aware, this relates to a copyright infringement lawsuit that was brought against Google in 2005 by AAP/Authors Guild after its launch to digitise books from library collections.  Under the settlement publishers and authors will agree not to sue.  Google will make available to search full content of the books it has scanned, enable a user to copy and paste sections and print sections.  It plans to sell access to this resource.  A short synopsis giving more detail on the settlement   is available here.  There are 3 large library associations representing over 139,000 libraries who are asking the court to seriously consider the interpretation and implementation of the settlement to cover the broadest benefit the settlement can enable.  Key concerns are brought around the monopoly that Google will hold over digitised literature (Google has been compiling this since 2004 so it would take any other organisation a great deal of time to get to the same stage to offer the same service) and what pricing will be put on it.  This could “compromise fundamental library values including equity of access to information, patron privacy and intellectual freedom” source ALA full details and updates on the case can be found here

Our trainer and expert in this area, Paul Pedley, has written a number of articles on the subject and offers further insight with up to date examples on his courses.   One of Paul’s recent articles offers great tips and advice on how to ensure you are copyright compliant and avoid running into cases of copyright infringement.  A key tip mentioned is to avoid sharing passwords.  This was recently illustrated by a case noted in the Telegraph where a Private Equity firm, Blackstone was sued by FT for allowing multiple users to use a single ID and password to access thousands of articles between February 2006 and June 2008. 

Paul is running courses on Digital Copyright and Digital Licensing for TFPL in June and July, check the training and events section for more details.

Has the Firewall had its day?

There was a lot of talk about firewalls at the Web 2.0: Practical appplications for business benefit conference this week.

Luis Suarez said that there was no point in organisations using their firewalls to block applications such as facebook and instant messaging. People bring their mobile phones to work which gives them access to that stuff anyway. Employee are no longer dependent on the devices provided by their organisations.

Euan Semple said that firewalls give an illusion of protection, but information within the firewall is only a cut and paste away from the world wide web.

John Meakin, head of information security at Standard Chartered bank said that firewalls are increasingly failing to do the job that they are asked to do. They were designed to shield an organisation's entire network. Your firewall is tasked with protecting:

- all of your informations systems
- all of the servers that the systems sit on
- all of the devices that the systems run on
- all of the information that the systems hold

As time has gone on this task has increased in complexity. Organisations have massively increased both the number of channels through which they connect to the outside world, and the volume and variety of information they exchange through those channels.

This increased complexity means that people in information secuity roles like John's are forever having to patch and mend weaknesess in their firewall. John says that he feels like the dutch boy with the thumb in his dyke. It was a powerful image: such fragile protection against the might of the sea.

For John the answer is to give individual systems/ servers/ devices/information objects their own protection, through encryption. The challenge with encryption is getting users to apply it. The technology is freely available to the end user already (Microsoft issue it as standard in Vista) but there is no user friendly interface to it.

Standard Chartered have started an ambitious project to reduce reliance on the firewall by protecting the information itself rather than the network it is housed upon. They are building a user friendly encryption interface which will prompt people when they save or communicate information to decide:
- whether or not it needs encryption protection,
- whether or not they want to prevent recipients forwarding it on, printing it, copying it, or cutting and pasting from it.

If Standard Chartered get this right, and if their users buy into it (big 'ifs'), then they will be able to worry much less about any weaknesses in their firewall. Even if secret information did find its way out onto the web, the only people able to access it would be colleagues with the encryption keys.

James Lappin

Loss by PA Consulting of Home Office data on prisoners, serious offenders and others

The Times and the BBC report this morning that contractor PA Consulting have lost an unencrypted memory stick containing:

• personal details and intelligence on 33,000 serious offenders
• dossiers on 10,000 “priority criminals”
• the names and dates of birth of all 84,000 prisoners in England and Wales.
• information on an unspecified number of people enlisted on drug intervention programmes.

The data had been entrusted to them by the Home Office.

The rash of recent data protection reports in the UK, arising from the high profile data losses by the HMRC and the Ministry of Defence, all cited the use of removable storage devices (memory sticks, CDs, laptops etc.) to store personal data  as a major information security risk.

In the months after the data losses most central government Departments clamped down on the downloading of personal data from databases.  Many Departments eliminated the risk of human error by putting controls into their systems that denied staff the ability to download data to removable devices. 

The Cabinet Office's Data Handling Review published this June came up with a minimum set of measures that Central Government departments must abide by when handling large aggregations of personal data.  The Review stated that transferring personal data out of its host database increased the risk of information loss. Wherever possible data should remain in situ.  Controlled remote access to data is preferable to physical transfers of data on removable media such as disks and memory sticks.

The measures state that if personal data needs to moved and can only be moved by removable media then the data must be encrypted and minimised.

If contractors are handling personal data on a government Department's behalf then the Department must write in contractual clauses to ensure that the contractor protects the data to the government's minimum standards.

According to the Times the Home Office did encrypt the data when they sent it to PA consulting.  PA consulting then had to unencrypt the data to use it. The loss appears to have happened after a member of PA consulting's staff was able to download the data onto a memory stick without first encrypting the data.  PA consulting at the time of writing are yet to comment on why this unencrypted download to memory stick was allowed to happen.

The Home Secretary told the BBC that the Home Office had written clauses into PA Consulting's contract that required PA to follow the Government's standards for the handling of data.

If this is true then the loss appears to be more PA Consulting's fault than the Home Office's.  However I am wary of coming to conclusions at this stage as experience of previous data losses shows that a fuller picture only emerges days and even weeks after the incident is first reported.

This incident is likely to call  into question whether contractual clauses are a strong enough protection for personal data being processed on the government's behalf by contractors.  PA Consulting are an established reputable firm who perform a lot of work in the military and security sector:  if they are making these errors then one presumes that other contractors will have similar weaknesses.

James Lappin

Transforming HMRC in response to its data loss

Review of information security at HM Revenue and Customs by Kieran Poynter

The Poynter Review is no ordinary information management consultancy report.  But then HMRC's loss  in October 2007 of disks containing the addresses and bank account details of 7.5 million child benefit recipients was no ordinary data loss.

• The review cost a staggering £3.6 million.  It encompassed a full investigation of the circumstances leading up to the loss in October 2007;  a detailed assessment of 15 HMRC business units against criteria derived from the Information Security Standard ISO 27002; and the review of an audit that HMRC carried out of its information outputs across the organisation.

• The consultant, Kieran Poynter is Chairman and Senior Partner of Price Waterhouse Cooper.

• The findings go further than purely information security: they set out a new strategic direction for HMRC.

• As soon as it was published the Information Commissioner slapped an enforcement order onto the HMRC for breach of the Data Protection act.  The order requires HMRC to periodically report back on how they are proceding in implementing the report's recommendations (effectively making the findings mandatory)

The findings of the Poynter review set out to do two things: to change the organisational design of HMRC, and to change the culture of HRMC, both in order to improve information security

Changing the organisational design of HMRC

Poynter states that:

• The main vulnerability to personal data loss occurs when data transfers from one system or process to another.

• The great many different types of taxation and benefit that HMRC administers each have seperate systems for capturing, maintaining and using personal data about the individual citizen/business.  This increases risk of personal data loss.  It necessitates the maintenance and control of large number of different systems which hold significant aggregations of personal data; and it multiplyies the instances where data moves from one system or process to another.

• In the short term HMRC should try to increase its level of information security control over these different systems, but the fragmented nature of the existing organisation design will always leave HMRC with a higher than desirable level of vulnerability to data loss.

• HMRC should start moving on a long term direction of travel towards keeping one central record for each individual citizen and each business.  Each seperate process for the administration of a particular form of taxation or benefit would then draw from that central record, and update that central personal data as and when they worked with that individual.

• This model would change HMRC's relationship with individual citizens and businesses.  Individual citizens and businesses would be able to update their own tax and benefit record.   

• Individual citizens and businesses would benefit by no longer having to give the same information to different parts of HMRC on different forms.

• HMRC staff time could be concentrated on cases where citizens needed their help in completing information (hard to reach groups) and on improving the tax yield by reducing miss-payment and fraud.

Making information security a management priority

We information professionals have long complained that senior managers do not take good information governance seriously enough.

The HMRC data loss was so large and so traumatic that Poynter has had carte blanche to map out what world class information governance would look like for HMRC.  These are the features that emerge from Poynter's recommendations:

• Set information Security as a corporate objective. Keeping personal data about taxpayers and benefit recipients accurate and secure should be seen as a central role of HMRC as the UK's tax administrators.  It should be written in the list of HMRC's departmental objectives, and translated down into specific objectives for each line of business.

• Articulate an information security strategy.  The strategy should identify critical risks; key responsibilities; how information security will be integrated into the working of HMRC; and what HMRC's approach will be for ensuring compliance.

• Identify key responsibilities at a senior level. The Chief Finance Officer should also be designated the Senior Information Risk Office (SIRO). This is in line with the Cabinet Office's recommendation that all Central Government departments should nominate a SIRO at board level.  Reporting to the Chief Finance Officer should be a Chief Risk Officer, who should head up three teams:  a risk management team, an information security team and a  physical security team.  The information security team should be headed up by a Chief Information Security Officer reporting into the Chief Risk Officer.

• Ensure that managers have access to good quality information security advice.  Prior to the data loss HMRC recruited internally for information security roles. Poynter recommends that the HMRC should recruit strong professional expertise for its central team of information security experts.  It should also embed an information security expert in each of its four Lines of businesses. The central team should take responsiblity for co-ordinating and monitoring information security across HMRC, and keeping up to speed with the implications of new technologies, new ways of working and new threats.   

• Ensure that HMRC has professional capability in risk management. Poynter identified a lack of professional risk management expertise in HMRC prior to the data loss.  This resulted in a bottom up approach to risk management where business units identified and managed their own risks.  There was insufficient consideration of risk at board level.  Poynter recommends the appointment of risk management professionals to support the new Chief Risk Officer and to provide corporate risk management support for the different Lines of Business.

• Establish clear local accountabilities for information security.  Within each Line of business, the line management of each business unit should be fully responsible for, and accountable, for information security.  Each unit should appoint a Data Guardian to advise line management on information security issues and to work on ensuring that colleagues are have the knowledge, skills and motivation to apply information security measure in their work.  Data Guardians should report to the Line of Business's Information Security Professional.

• Ensure senior manager are held acountable for information security in their area.  Poynter recommends that the Chief Executive and his advisors should have regular performance review meetings with each individual Line of Business Directors-General, and that information security should be one of the items on the agenda for these meetings.  The Chief Information Security Officer and Chief Risk Officer should provide advice for the Chief Executive at these meetings.

• Tailor policy, procedures and advice to staff in each area.  A key role of the information expert in each Line of Business is to translate corporate information policy and procedures into specific advice tailored to the needs of their Line of Business.   In the short term very clear and very specific guidance should be given to staff working in areas identified as a high information security risk.

• Build information security into management and leadership training.  HMRC can not entirely eliminate information risk.  Information security is not HMRC's only priority. Determining what level of information risk to accept for any particular process requires the business knowledge of managers as much as it needs specialist knowledge of information security experts.  Poynter wants the HMRC to define its own leadership development programme for its senior managers and to include in that a module on information security.  Poynter also wants information security to be built into HMRC's Process Programme (PaceSetter)  The central plank of Pacesetter is a methodology called LEAN, which enables managers  to analyse their area's business processes and to identify how they can be made more efficient and effective.   Poynter wants the LEAN methodology to be enhanced to equip managers with the ability to identify the information risks of their current processes and of any changes they propose to these processes. He also wants those processes that have already been changed by the 'LEAN' methodology to be re-examined to check that their re-design hasn't added an unacceptable level of information risk.

• Ensure that staff are aware of the importance of information security from the moment they start the process of joining the organisation.  Include mention of the importance of information security in the recruitment advert and the job description, mention it at interview, in the letter of appointment, and in the contract of employment.  Itemise responsibilities in the job description.  Include information security as a mandatatory part of the induction process.  Don't let staff graduate through the induction process until they have completed the information security element.

• Ensure that new staff understand what constitutes a data breech and the disciplinary consequences. 

• Provide annual information security refresher training for all staff in information security on an annual basis.  Face to face training for staff working in areas of high information security risk, and a e-learning package for the rest.

Bridget Treacy of law firm Hunton and Williams has posted a well-informed article on the Poynter Review here

Lessons learned from the HMRC Data loss

Independent report into loss of data related to child benefit by the Independent Police Complaints Commission (IPCC)

Reading the IPCC report into the HMRC data loss is like reading one of Shakespeare's tragedies. 

When you start watching Romeo and Juliet you already know that the couple will end up dead in each other's arms.

When you start reading the IPCC report you already know that on 18 October 2007 an HMRC official (Employee J) in Washington, Tyne and Wear, will place two password protected but non-encrypted disks into a yellow transit envelope adressed to an auditor at the National Audit Office, London.  The disks will contain contain the names, addresses and bank account details of 7.5 million child benefit recipients.   He will say the words 'Its gone now' as he places the envelope into an out tray, but the envelope will never reach its destination.

The IPCC report gives you a blow by blow account of the the minor errors of judgement and misunderstandings that led up to the loss.  The deeper fundamental causes of the loss are dealt with in the Poynter Review.  The drama of the IPCC report stems from the contrast between the triviality of the errors of judgement with the enormity of the loss itself, and the genuine anguish that it caused officials.  IPCC found no evidence of deliberate neglect or disregard for the law, or for internal HMRC policy, by officials.

The report illustrates perfectly the point that every time personal data is copied from one system to another it increases the risk of personal data loss.

HMRC had very robust controls in place to limit the circumstances in which HMRC Business Units could obtain copies of data from the main child benefit database.  The child benefit database was based in Long Benton, Tyne and Wear, and operated by a contractor (EDS).  To obtain a data scan from the database a Business Unit  had to fill out a 'URAC' form, specifying what data they wanted copies of and why.  The form had to be costed, approved and signed off by the Information Management Solutions Business Unit (IMS).

But there were no similar controls in place to govern what a Business Unit did with that data once they had obtained it.

Every six months HMRC's Claimant Compliance Business Unit followed the URAC form procedure to order a full scan of the records of every child benefit recipient, which they used to determine a random sample of cases to investigate to check against fraud.  The data-scan was sent to Claimant Compliance on unencrypted disks.  Claimant Compliance then loaded the data from the disks onto a stand alone computer in a secure room.

In the spring of 2007 a National Audit Office auditor asked his contact at HMRC (a junior official anonymised as 'employee D'' in the report) for a scan of all new and completed child benefit cases, so that the external auditors  could come up with their own sample of child benefit cases to inform their audit. 

Employee D worked in the Benefits and Credits Business Unit.  She decided not to go through the formal URAC procedure (which could take weeks or months and incur a cost of several thousand pounds).  Instead she asked Claimant Compliance Business Unit for a copy of their latest routine six monthly scan.

In March 2007 the disks containing a six monthly scan of the entire child benefit database was handed over to the auditor in person, when he visited on-site.  He returned it safely several days later.   In the autumn of 2007 the auditor made a similar request for a similar sample of data.  This time he was not due to visit the site and asked for the disks to be sent to him (the file was to big to be sent by electronic means through the government secure intranet).  The official in IMS (Employee J) who put the disk into the transit envelope was not accustumed to sending physical media in the post.  He mistakenly beleived that the postal system he was using was a tracked courrier system with an audit trail of packages.    The package did not reach the auditor and could not be traced once the loss of data was reported.

Key contributory factors to the data loss included:

• The option to reduce the data scan so that the auditor only got the data he needed was not taken up.   The data in the Compliance scan was far more detailed than the auditor required.  He didn't need or want the most sensitive data:  bank account details and home addresses.    Providing this data breached the third principle of the Data Protection Act (that data should be relevent and not excessive for the purpose for which it is required), and massively increased the adverse impact of the data loss.  The auditor had asked for the data to be removed.  His contact at HMRC (Employee D) was concerned about the cost and time implications of filtering the data,  and advised the auditor to discuss his needs with officials from HMRC's  Knowledge, Analysis and Intelligence Business Unit  at his forthcoming meeting with them.  The discussion never took place.  During the investigation into the data loss it transpired that software existed on the Compliance Directorate's stand alone computer that that could have filtered out the unwanted data without cost.

• It was not clear who was responsible for authorising the sending of the disk to the auditor.  At various points in the e-mail correspondence that preceded the (succesful) transfer of disks to NAO in March 2007 colleagues in  both Compliance Directorate (the directorate who possessed the datascan) and IMS (the directorate who had obtained the datascan for Complaince Directorate)  expressed concerns about the amount of data that was proposed to be sent to the NAO.    But neither directorate knew which of them was responsible for making a decision on whether or not the data is released.  These concerns were never escalated to a responsible officer or senior manager for a decision to be made.  The IPCC's interviews and forensic examination of the e-mail boxes of the official's involved show that no senior manager knew at any stage that this amount of data was due to go off site. The March 2007 transfer passed off without incident, but it set the precedent for a similar but failed transfer in October 2007.

• The relevant data protection and information security policies were insufficiently visible and insufficiently specific. None of the officials involved in the sending of the data were aware of the content or whereabouts of relevant information security and data protection policies.  Information security policies were stored on the intranet and were difficult to find.  HMRC did have a policy on sharing information with the National Audit Office, and it stated that transfers of data to the NAO should be 'cleared with a senior manager'.  If officials had been aware of this and followed it, this may have prevented the data loss.  However the policy was insufficiantly specific:  it did not identify which senior  manager should authorise the transfer and by what procedure the authorisation should be sought and recorded.
  

• The protective marking allocated to the information on the disks meant that the disks were not required to be encrypted. When EDS produced the disks of the data-scan for the Claimant Compliance Directorate the data received the protective marking of 'Restricted'.  It was these disks that would later be sent on to the National Audit Office.  Information in the category 'Restricted' was not required to be encrypted when it is communicated electronically.  This is not a weakness unique to HMRC, it highlights a weakness in the Government's Protective Protective Marking Scheme that guides all Government departments in how to handle sensitive information.  The Marking Scheme had not taken into account the fact that when large amounts of personal data are aggregated in one place the  impact of any loss is magnified.  The Cabinet Office's Data Handling review has adressed this issue by creating a new protective marking specifically for large aggregations of personal data.

The element that gives the report its drama is the e-mail trail that leads up to the data loss.  The report illustrates the disadvantages of e-mail when it comes to making decisions that require the input at different stages of different people.   People appear on the address lines of e-mails, only to drop off those address lines as the plot unfolds.

• The senior manager with ultimate responsiblity for the NAO audits of Child Benefit was copied into an initial e-mail indicating that a small sample of data would be sent to the auditor at the NAO in March 2007.  He was not copied into any e-mails thereafter as the  data transfer escalates to a full download of all records on the Child Benefit database.

• The e-mail trail leading immediately preceding the data loss in October 2007 resembled an electronic version of pass the parcel.  The NAO's auditor asked his new main point of contact at HMRC (Employee C), for a copy of a similar data-scan to the one he had used in March.   Employee C passed him on to Employee E in Claimant Compliance Directorate because they held the data-scan.    Employee E referred the auditor by e-mail to Employee J at Information Management Solutions.  Employee E told the IPCC that he made the referral because he felt that IMS were the directorate best placed to provide or refuse authorisation for the disks to be sent.  But Employee J in Information Management Solutions interpreted the e-mail as constituting authorisation from Claimant Compliance for the disks to be sent.  So he obtained the disks and sent them.    No-one had consciously made a decision on whether or not to authorise the sharing of the data or the posting of the disks.  No discussion had taken place, instead an e-mail trail with attendant miss-readings and blind spots had led to a disastrous loss.

The Information Commissioner Richard Thomas, and Mark Walport, state in their Data Handling Review that there was no problem with the HMRC sharing personal data of benefit recipients with the National Audit Office for the purpose of informing their audit.  The problem was the unnecessarily large amount of data shared, and the insecure methods used to share it.  They describe the HMRC loss as  a 'multiple-systemic failure':  failure across a range of fronts including cultural (low priority for data security), technological (insecure data storage and transfer methods) and procedural (lack of appropriate authorisations and failure to use data redaction methods to minimise data shared).

The diverse nature of these failings, and the fact that they were by no means unique to HMRC, has resulted in the wide scope of the Government's response to the loss.  The Cabinet Office's set of minimum measures that Central Government departments must put in place when handling large aggregations of personal data include measures to address issues of culture, responsibility, training and technology.

James Lappin

Data Protection comes of age

Five important data protection reports were published in the UK in June and July 2008.

Taken together the reports signpost a change in attitude to data protection:

• moving away from passive, lacklustre compliance, where data protection is seen as the preserve of a small number of staff with designated roles.
• moving towards a far more dynamic approach to data protection where organisations whose business depends on the collection and use of  personal data see the good stewardship of that data as a fundamental part of their operations.

The characteristics of this new approach are that: 

• information risk is actively addressed as a management issue

• awareness of data protection and information risk is identified as a key competency of those staff whose role involves the handling of sensitive personal data

• every significant aggregation of personal data in the organisation has a guardian actively responsible for ensuring the protection and proper maintenance and use of that data

• data protection policies are written clearly, tailored to staff in particular roles, and actively communicated, monitored and enforced.

Three of the reports stemmed from the loss of personal data by HMRC (Her Majesty's Revenue and Customs) in 2007.

• A report by the Independent Police Complaints Commission's  (IPCC) describes the specific circumstances that led up to the HMRC data loss

• A report by Kieran Poyntyer (chariman and senior partner of Price Waterhouse Cooper LLP) looks at the fundamental causes of the HMRC data loss, which he identifies as a failure of management to take information security seriously, and an organisational design ill-suited to information security.   

• A Cabinet Office report sets out a core set of measures that all central government departments must take to ensure that a similar personal data loss does not occur elsewhere in Government

The fourth report also relates to a data loss:  Sir Edmund Burton's report into the loss of a Royal Navy recruiters laptop containing unencrypted personal data of 600,000 people.

The fifth report has a wider ranging topic and theme: it is a review of data sharing by Richard Thomas and Mark Walport, which examines ways in which the data protection regime can be improved to allow beneficial data sharing whilst still protecting personal privacy.

I took the reports on holiday with me, and in the next few blogposts I'll be drawing out the key messages from each one.

Parliamentary Question on Google's enforced disclosure of You Tube user data to Viacom

A fortnight ago I blogged about the privacy implications of the US Court order which forces Google to reveal You Tube user data to Viacom.  Last week Sarah Teather MP asked a Parliamentary Question about it:  here is Hansard's record of her question and the response that she received:

Sarah Teather: To ask the Secretary of State for Business, Enterprise and Regulatory Reform what assessment he has made of the implications for the privacy of British internet users of the requirement for Google to disclose to a third party the viewing log of people who have its YouTube service. [217419]

Malcolm Wicks: BERR officials made contact with the company on this issue and this is an unfolding situation which we are regularly monitoring. Although the US federal court granted Viacom's petition for disclosure of traffic log data including computer IP addresses, against Google, who own YouTube, the court has specified that Viacom cannot use the disclosed data for any commercial purposes, or to pursue individual users for copyright infringement whose computers might be identifiable from the log data. There is a protective order in the case that prevents information designated as highly confidential from disclosure to anyone but Viacom's lawyers and experts.

(Thanks to Paul Pedley at the Economist Intelligent Unit and his new subscription information law service KWtL for the tip off.)

The controversy over the court's ruling in favour of Viacom adds potency to the ongoing debate over whether Google has the right to retain details of our searches for such long periods of time.

Google retains details of every search you make on the Google search engine.  After 18 months Google anonomyises your search by removing details that could identify you as an individual (such as the IP address of your computer).

The European Union's Article 29 Data Protection working party has questioned whether Google has the right under European privacy law to hold onto data that could identify an individual searcher for as long as 18 months.  They want Google and other search engines to anonymise or delete personal data after 6 months.   This post by EDRI describes the strongly worded letter that the working party sent to Google in May this year.

And this week Outlaw.com reports that the same Article 29 Working Party has presented a Privacy Seal award to a search engine called lxquick that deletes its search logs 48 hours after the search is made.

I like the idea of a search engine that doesn't keep hold of my IP adress and link it to my searches.  The only problem is that on the evidence of a trial search I made on it, lxqwick is nowhere near as effective as Google.