UK companies must comply with strict government security legislation

2002-08-26 admin

Businesses that fail to comply with the latest security legislation, such as the Anti-Terrorism Act, not only risk prosecution and fines but also considerable damage to their corporate credibility.

In response to this danger, Computer Associates (CA) has developed an in-depth guide to help companies understand the implications of the latest government Acts.

"A recent DTI report identified that the average cost of a serious security breach to a UK company is £30,000. In any normal conditions, this is a significant sum, but in an economic downturn this isn’t a problem most board directors would want to land on their desks," said David Love, head of Security Advocacy Group at CA.

"Security has traditionally been done in a piecemeal fashion, which dramatically reduces its effectiveness. We’re trying to help businesses take a proactive approach to security and make them aware of the legislation surrounding this area."

"There’s been a lot written about the likes of the Data Protection Act, but no definitive, plain-speaking guide to what these laws actually mean for business, and what happens if you don’t adhere to them," he added.
"Senior executives are increasingly paranoid about making sure everything is done by the book - this White Paper will help set their minds at rest."

Data Types

According to research, there are 3 main types of data which are valuable to businesses:

Corporate, Customer and Employee data

The Data Protection Act 1998 ("DPA") Customer and employee data will consist almost entirely of personal data, as defined in the DPA. Corporate data may also contain personal data and so issues of data privacy are therefore highly relevant.

The DPA is the principal piece of privacy legislation in the UK. It has a very wide ranging scope and provides data subjects with certain protections and rights with respect to their personal data

The Obligations

The following obligations are imposed on data controllers
in connection with data security and storage by virtue of the data protection principles:

Appropriate technical and organisational measures must be taken at all times against unauthorised and unlawful processing and against accidental loss, destruction or damage of personal data. The state of technology available at the relevant time is a
factor in what is considered
"appropriate". What is considered to be industry standard, or best practice, will also be an influencing
factor in determining compliance (ISO 17799 is the standard in many industry sectors, for example). Sensitive personal data
will require additional security controls to those employed for
personal data, as will data which is commercially sensitive even although it is not 'sensitive' according to the definition set out in the DPA. An example of commercially sensitive data is financial information. The security measures must ensure a level of protection appropri-ate
to the harm which might result if the data are accessed in
an unauthorised or unlawful manner, or if the data are accidentally lost or damaged. Cost will be a relevant factor - data controllers need only employ such security measures as are reasonable in
the circumstances, bearing in mind the nature of the data and the purposes for which they are being processed.
Data controllers should not be complacent in this regard. If they fail to upgrade existing systems to take account of technological advances, they may find themselves inadvertently breaching the
seventh data protection principle. What is essential is that once security solutions are in place, they must be monitored to check how effective they are. Firms should have a security policy in
place and an on-going monitoring programme.
Any breaches should
be investigated and steps taken to prevent future similar incidents.

If a data processing operation is carried out on behalf of the company by a third party (including another member of the same
corporate group) a data processing contract must be in place, which obligates that third party to take equivalent and appropriate security measures to those utilised by the data controller. If, as
part of that processing, data will be transferred outside of the EEA (e.g. if a US company is providing hosting facilities for the corporate website) particular care must be taken to ensure compliance with the first, seventh and eighth principles in particular.

Data controllers must take reasonable steps to verify the accuracy of any data obtained about data subjects. What is reasonable for each data controller will depend on the circumstances. This means that read only files will not be compliant with the DPA since by implication, if data is out-of-date or inaccurate, it must be able to be corrected.

Data must not be kept longer than is necessary. This will be of prime importance when considering data retention policies and
storage facilities. What term is appropriate to retain the data will depend on the type of data, the purposes for which it was originally obtained and for which it continues to be held. For example, certain regulatory requirements apply to the type of data held by financial institutions. Under Financial Services Authority Rules, accounting records and financial reports, together with details of internal control procedures, should be
kept for 6 years. Generally, transactions involving client money, bank reconciliations and details of custody of documents of title in possession or control of the financial institution should be
retained for 3 years. Different data retention periods will be
appropriate for other types of data.

Bookmark/Search this post with:

Comments

Post new comment