14 DAY TRIAL // A laptop containing the personal information of approximately 100 youths who were enrolled in an inclusion program was stolen from the house of a contractor in January.
Newcastle Youth Offending Team reported the breach to the Information Commissioner’s Office to comply with the Data Protection Act. As it turns out, the act was breached due to the fact that the private data was stored on the laptop, but it was not encrypted in any way.
Even though the Youth Offending Team had a contract with the company of the man from whose home the device was stolen, the contractor failed to make sure their employees take the necessary security measures to prevent such unfortunate situations.
“The data controller [Youth Offending Team] shall implement such other security measures as it deems appropriate to ensure that personal data is protected against unauthorised and unlawful processing, accidental loss, destruction, and/or damage,” read the organization's undertaking.
It is highly unfortunate that these incidents happen because of someone's carelessness. Even though in this case only 100 people were involved, each one of them can now easily become a victim of identity theft.
We must realize that it's not easy for a company to protect its networks in front of cyberattacks, but they have no excuse when they fail to protect the private data belonging to their customers and employees.
“Encryption is a basic procedure and an inexpensive way to ensure that information is kept secure. But, to their detriment, not enough data handlers are making use of it. This case also highlights how important it is to ensure that watertight procedures are in place before any work is undertaken by contractors,” said Acting Head of Enforcement, Sally-Anne Poole.
“Organisations shouldn’t simply assume that third parties will handle personal data in line with their usual standards. I’m pleased that Newcastle Youth Offending Team has learned lessons from this incident and hope that it encourages others to heed our advice.”