Chris Spooner

Data act must not be rubbished

Businesses may run the risk of prosecution if data thieves get their hands on discarded technology, says Chris Spooner

Written by

CRN, 15 May 2008

Data protection has hardly been out of the headlines recently. It was only last year that HMRC managed to lose a CD with details of 25 million child benefit claimants. In January the Royal Navy mislaid the personal details of up to 600,000 people. And a government subcontractor recently misplaced the details of three million learner drivers somewhere in the wilds of Iowa.

Embarrassing for the government, certainly. But surely not an issue for the average business, local authority, or waste management professional?

Yet alarmingly, as the Waste Electrical and Electronic Equipment (WEEE) directive means businesses have to dispose of redundant or unwanted electronic equipment correctly, a veritable flood of data is, sometimes quite literally, thrown out on the streets.

Until the first test case, it remains unclear as to whether it is waste managers or their clients who will be liable for prosecution
in the event of data theft from materials such as hard drives. But it remains a fact that, when waste managers outsource WEEE
containing personal data for processing overseas, they have breached the Data Protection Act by exporting personal data beyond national boundaries.

When the first major fraud is committed using personal data recovered from WEEE, it is quite possible that both the businesses that created the data and the waste managers who failed to ensure its secure destruction could be liable for prosecution.

The Data Protection Act, which became law in 1998, guarantees some protection. Yet a decade ago it would have been impossible to predict the sheer volume of electronics being discarded as waste or, for that matter, the sheer proliferation of data and devices that hold it.

While organisations such as the police and hospital trusts are generally well aware of the sensitive nature of the information their discarded servers, server tapes, laptops and hard drives can hold, other businesses can be very blasé.

Even where a business is otherwise aware of data protection, there is still a perception that waste does not matter. In a recycling, reusing world, that is no longer true.