Recent security breaches in both the private and public sector have highlighted the need for organizations to ensure personal information is processed and stored securely. Ever-growing collections of personal data, more remote access and the prevalence of identity related crime all create vulnerabilities. To ensure data protection is taken seriously it is essential that effective data protection policies and practices are in place.

Individuals expect the Data Protection Act to shield the security of their information. At the same time information security is increasingly at risk. The Information Commissioner's Office (ICO), the UK's privacy watchdog, disclosed its data protection strategy in March 2008. The disclosure outlined the agency's plans to promote the importance of appropriate security, use regulatory powers against organizations that neglect their responsibilities and help individuals protect their information.

In May this was reinforced when The Criminal Justice and Immigration Act received Royal Assent, creating tough new sanctions for the ICO. This new legislation gives the ICO the power to impose substantial fines on organizations that deliberately or recklessly commit serious breaches of the Data Protection Act. The act represents an expansion of the ICO's previous power of simply issuing enforcement notices.

This isn't necessarily the end of the changes and there may be more regulation to come as, towards the end of May, the European Network and Information Security Agency (ENISA), called for laws tougher than those in the US to force companies to reveal when their computer systems have been breached. In its General Report 2007 the EU's top security body said governments, businesses and consumers are still underestimating the scope of the IT security problem, in part because of a lack of transparency of data handling processes particularly when breaches occur. Mandatory disclosure of security breaches would better protect effected individuals against loss and be a step toward raising recognition of the seriousness of security threats. In the U.S., there are numerous State laws which force organizations to publish details of security breaches. For example, one is the California Breach Law (SB1386), which requires organizations doing business in California to tell customers about possible security breaches. While lacking uniformity similar laws exist in some but not all other states. A second is Sarbanes-Oxley, which obliges executives to keep informed about material aspects of their business, including security breaches.

-1-

Explore Our Topics

• BPM & Enterprise Architecture
• BPM Standards
• BPM Implementation
• BPM Best Practices
• Cloud BPM
• Continuous Process Improvement
• BPM Governance
• Service Governance

• Business to Business (B2B)
• BPM for Supply Chain
• BPM for Customer Management
• BPM for Financial Services
• BPM for Healthcare & Insurance
• BPM for Government

• Business Activity Monitoring
• Event Processing
• Process Intelligence
• Business Rules Management
• Decision Management
• Operational Intelligence

• Workflow Automation
• BPM & Enterprise 2.0
• BPM & Web 2.0
• BPM & ECM
• Case Management
• Collaboration
• Enterprise Portals
• Social BPM

• BPM & Cloud Integration
• BPM Analysis & Optimization
• Business Process Simulation
• Process Visibility & Monitoring
• Process Orchestration
• Process Discovery
• Process Modeling

Home
Webinars
Blogs
ebizQ Forum
All Topics
Subscriptions
White Papers
Analyst Corner
Follow us on Twitter
Fan us on Facebook

Explore Our Topics

BPM Strategy
BPM Solutions
Event Processing Strategy
Content-Centric & Collaborative BPM
Process-Centric BPM

About Us
Editorial Submissions
Feedback
FAQ
Advertise With Us
Site Map
Privacy Policy
Unsubscribe