Recent security breaches in both the private and public sector have highlighted the need for organizations to ensure personal information is processed and stored securely. Ever-growing collections of personal data, more remote access and the prevalence of identity related crime all create vulnerabilities. To ensure data protection is taken seriously it is essential that effective data protection policies and practices are in place.

Individuals expect the Data Protection Act to shield the security of their information. At the same time information security is increasingly at risk. The Information Commissioner's Office (ICO), the UK's privacy watchdog, disclosed its data protection strategy in March 2008. The disclosure outlined the agency's plans to promote the importance of appropriate security, use regulatory powers against organizations that neglect their responsibilities and help individuals protect their information.

In May this was reinforced when The Criminal Justice and Immigration Act received Royal Assent, creating tough new sanctions for the ICO. This new legislation gives the ICO the power to impose substantial fines on organizations that deliberately or recklessly commit serious breaches of the Data Protection Act. The act represents an expansion of the ICO's previous power of simply issuing enforcement notices.

This isn't necessarily the end of the changes and there may be more regulation to come as, towards the end of May, the European Network and Information Security Agency (ENISA), called for laws tougher than those in the US to force companies to reveal when their computer systems have been breached. In its General Report 2007 the EU's top security body said governments, businesses and consumers are still underestimating the scope of the IT security problem, in part because of a lack of transparency of data handling processes particularly when breaches occur. Mandatory disclosure of security breaches would better protect effected individuals against loss and be a step toward raising recognition of the seriousness of security threats. In the U.S., there are numerous State laws which force organizations to publish details of security breaches. For example, one is the California Breach Law (SB1386), which requires organizations doing business in California to tell customers about possible security breaches. While lacking uniformity similar laws exist in some but not all other states. A second is Sarbanes-Oxley, which obliges executives to keep informed about material aspects of their business, including security breaches.

1

• Next

Home
Webinars
Blogs
Subscriptions
White Paper
Analyst Corner

Goals

Enabling Business Agility and Reuse
Improving Business Processes
Leveraging Information and Intelligence
Governing the Infrastructure
Leveraging the Connected Web
Securing Enterprise Applications
Supporting Industry Solutions

About Us
Editorial Calendar
Feedback
FAQ
Advertise With Us
Site Map
Privacy Policy
Unsubscribe