Once again we hear of another legal eagle being hit by the Information Commissioner for not holding personal information securely. Yet when I contact the local solicitors to try and discuss their data security all I get is silence, is this ignorance or arrogance? To my mind it is a bit of both. Very few solicitors have an in-house specialist that can handle their data protection compliance and, from experience, very few of them have a scooby about what it means to them nor do they care!
The ICO has recently published another press release relating to an advocate of all people who did not keep her laptop secured and it was stolen yet she waited 2 years to report it to the Commissioner!! Why oh why oh why do we put up with this? These people are meant to know the law yet it seems that The Data Protection Act 1998 has slipped ‘off their radar’ either that or they are blissfully ignorant and really do not care about data security, the latter I think is more the case! See what you think after reading the press release and feel free to respond with your thoughts
The ICO’s press release goes like this:
A Scottish advocate breached the Data Protection Act after failing to encrypt a laptop containing sensitive personal data which was later stolen, the Information Commissioner’s Office (ICO) said today.
The laptop was stolen from the home of Ruth Crawford QC in 2009 when she was away on holiday. It contained personal data relating to a number of individuals involved in eight court cases the advocate had been working on. This included some details relating to the physical and mental health of individuals involved in two of the cases. The device has not been recovered; however, most of the information compromised would already have been released as evidence in court papers.
The breach was only reported to the ICO on 30 August 2011 when the last case relating to information held on the laptop was concluded. The ICO’s enquiries found that, whilst Ms Crawford had some physical security measures in place at the time of the theft, she failed to ensure that either the device or the sensitive information stored on it was appropriately encrypted.
The QC has now agreed to put the necessary changes in place to ensure this type of incident does not happen again. This includes locking away any personal information stored at her home and following any future data protection guidance issued by the Faculty of Advocates or her stable.
Ken Macdonald, Assistant Commissioner for Scotland said:
“The legal profession holds some of the most sensitive information available. It is therefore vital that adequate security measures are in place to keep information secure.
“As this incident took place before the 6 April 2010 the ICO is unable to serve a financial penalty in this instance. But this case should act as a warning to other legal professionals that their failure to protect personal information is not just about potentially being served with a penalty of up to £500,000 – it could affect their careers too. If confidential information is made public, it could also jeopardise the important work they do in court.
“The ICO would also like to assure the legal profession that any information reported to this office will not be disclosed unless there is specific legal authority for us to do so. Therefore all breaches should be reported to our office as soon as practically possible.”