Ouch. Well, if I had wanted an example of the flexible and sometimes porous boundary between policy and technology in the protection of sensitive data, I couldn't have expected one much better than this, as reported on the BBC site today. According to the news item, a memory stick with personal data has gone missing after being populated with personal data in the course of work undertaken by PA Consulting: "The memory stick contained un-encrypted details about 10,000 prolific offenders as well as names, dates of births and some release date of all 84,000 prisoners in England and Wales - and 33,000 records from the police national computer."
The Home Secretary, Jacqui Smith, is reported as saying that this was data which had been 'held in a secure form' by the government, but downloaded by the contractor despite contrary provisions in the contract under which they were working. The point, surely, is that whatever technical security measures had been applied to the data, the contractors were able to access it (legitimately, one assumes, in the course of their contract work), but that when it came to preventing the resulting information from being copied onto removable media (in this case, a memory stick) the only protection in place was contractual. The Home Secretary appears to have had no reservations about placing the blame squarely on the contractor for an alleged breach of contract. Under the circumstances, I expect a number of people at PA are wondering whether the Home Office had taken all reasonable steps to secure the data technically, as opposed to relying so heavily on the contractual provisions she refers to.
One person ought to be happy, though - Michelle Dennedy, our CPO, will surely enjoy seeing one of her trademark phrases recycled* by the Deputy Commissioner at the UK's Information Commissioner's Office. David Smith is reported as saying that 'the latest loss showed that personal information could be a "toxic liability" if not handled properly'.
*In fact, on investigation, I notice that the metaphor has also been appropriated by Cory Doctorow and, indirectly, Hal Stern.
![[RSS Newsfeed]](/themes/sotto/images/valid-rss.png)
![[This is a Roller site]](/themes/sotto/images/roller-logo.gif){kind=logo}