Councils 'must encrypt sensitive data'

Fri 05 Feb 2010

Local authorities have been reminded of the need to ensure all sensitive data is properly encrypted.

Wigan Metropolitan Borough Council recently experienced a data security breach in which an unencrypted memory stick was lost on a train.

The use of a memory stick was in breach of council policy, which states that personal data stored on council laptops has to be encrypted.

Hardware encryption specialist Stonewood said the breach of council policy by members of staff shows that more education of employees is needed.

Chief executive Chris McIntosh praised Wigan Council for extending its encryption programme, but insisted that data should be encrypted at all times, regardless of whether it is stored on a laptop, central computer or memory stick.

He said this would mean organisations can be confident that sensitive data cannot be used for malign purposes in the event of it being lost.

James Oxley, a solicitor at Winckworth Sherwood LLP, commented: "This shows that Data Protection policies must be followed up with effective training.

"The Information Commissioner's impending ability to impose fines of up to £500,000 and the courts' impending ability to impose custodial sentences makes awareness and compliance with the Data Protection Act 1998 even more important."

This comes shortly after this year's Data Privacy Day, a Europe-wide initiative designed to raise awareness about data protection issues.