Another story of the ignorance among businesses about their obligations under the Data Protection Act hit the headlines recently: firms are "falling into data protection pitfalls" (ZDNet), playing "data protection roulette" (Techworld) and "gambling with [the] Data Protection Act" (PC Advisor). This follows research conducted for Compuware indicating that 44% of senior IT managers use "live" customer data to test applications and that 48% of them are only "vaguely" aware of their obligations under the Act.
In short, businesses using the personal data of their customers risk breaching the Act in a number of ways: they may fall short of their obligation to use appropriate technical and organisational measures to protect the data (seventh principle); and the use may be outside the scope of the original purposes for which the data were collected (first and second principles). Data protection practitioners will not be surprised to hear that companies are sailing close to the wind with the uses to which they put customer data.
This story follows news of the recent security breaches in India and the Information Commissioner's decision to issue his first enforcement notice against the owners of a website for using electoral roll data from before 2002 following 1,600 complaints received by the ICO's office.
See later post http://www.typepad.com/t/trackback/5415691
Posted by: Des | July 19, 2006 at 10:09 AM