Thursday, November 22, 2007

Data protection.

The Treasury have been left with extremely red faces following the revelation that computer disks containing personal details of everybody claiming child benefit have been lost in the post. The main criticism seems to relate to the fact that they were sent in the ordinary post, rather than by recorded delivery or registered. But I don't think that's really the point - whilst using those methods would certainly have reduced the possibility of loss, they are not really designed for that purpose, but more for providing compensation if loss does occur - and clearly here no amount of compensation would have solved the problem. As a one-time manager myself, I saw an important aspect of my job to be constantly thinking "what if?" and designing strategies to prevent or limit the damage caused if things should go wrong - because, depend upon it, sooner or later they will. In this case it seems to me that standard operating procedure should be for any transmission of personal data to be in encrypted form, so that if it does go missing it will not be of any use to any third party who might come across it.

No comments: