West Berkshire Council found in breach of the Data Protection Act for second time in six months following USB stick loss

[security curmudgeon <jericho () attrition org>]

http://www.scmagazineuk.com/west-berkshire-council-in-breach-of-the-data-protection-act-for-second-time-in-six-months-following-usb-stick-loss/article/171575/

West Berkshire Council found in breach of the Data Protection Act for 
second time in six months following USB stick loss
Dan Raywood
June 02, 2010


West Berkshire Council has found to be in breach of the Data Protection 
Act following the loss of a USB stick containing the sensitive personal 
information of children and young people.

The memory stick, which was unencrypted and not password protected, 
contained information relating to the ethnicity and physical or mental 
health of the children, among other details.

The Information Commissioner's Office (ICO) found that unencrypted 
devices, in operation before the council introduced encrypted memory 
sticks in 2006, were still being used by members of staff.

Further enquiries revealed staff had not received appropriate training in 
data protection issues and monitoring of compliance with the council's 
policies was found to be inadequate.

Sally-Anne Poole, enforcement group manager at the ICO, said: .It is 
essential that organisations ensure the correct safeguards are in place 
when storing and transferring personal information, especially when it 
concerns sensitive information relating to children.

[..]
_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/

Get business, compliance, IT and security staff on the same page with
CREDANT Technologies: The Shortcut Guide to Understanding Data Protection
from Four Critical Perspectives. The eBook begins with considerations
important to executives and business leaders.
http://www.credant.com/campaigns/ebook-chpt-one-web.php