LWC 24/7

Is There a Data Protection Policy in Your Company?

Lee & White Consultants — Wed, 01 Sep 2010 10:50:38 GMT

One of the largest corporate insurers was recently fined by Britain's financial regulator, the FSA for the loss of customer data. Zurich Insurance PLC was fined a record £2.3m for losing 46000 customers' personal information which included identification information, details of bank accounts, credit cards and insured assets which could have resulted in significant loss to customers.

The loss of customers' data dates back to August 2008 when Zurich Insurance had outsourced data work to the company's South African unit which lost an unencrypted back-up tape. The loss however, was not discovered until a year later.

Companies would benefit from ...

Data Security vs Data Protection

Lee & White Consultants — Thu, 17 Jun 2010 08:30:49 GMT

"Data Security" and "Data Protection" are terms which seem similar and have been regarded as interchangable by many. Ask an IT manager if his organisation is complying with the data protection law and he will say "Yes, we have all the data security measures in place."

In his mind, the security measures his organisation has taken (e.g. backups, data masking, passwords) with regard to ensuring that data is kept safe from corruption and that access to it is properly controlled is "data protection" - or, "data security", if you like.

For example, many organisations feel that if they perform an information assurance process, they have ...

Overzealous

Lee & White Consultants — Sun, 16 May 2010 05:19:36 GMT

There was a recent case in the press about Google collecting and storing information broadcast over open Wi-Fi networks, attributed to the overzealous IT people who captured all data that they could technologically grab, and store it, just in case they might use it in the future.

This is a good example of what happens quite often in IT projects.

The business owner has a great idea to use a new technology to boost sales or to develop a new product.
The business analyst uses these ideas and draws up the business requirements and scope of a project to achieve ...

Let's send a mail

Lee & White Consultants — Mon, 26 Apr 2010 05:51:18 GMT

It's almost the end of the quarter, sales numbers are nearly on target, we just need a little boost to get them higher, perhaps even above target, I need that bonus.

"You know what? Let's launch a quick campaign and mail our prospects!"

I'm sure this all sounds very familiar if you are in the marketing department of any medium to large company, and it is a great initiative of course. But who shall you email? Where do you get the addresses?

We could for example mail our prospects, people who expressed some interest in one of our products; or ...

A True Story

Lee & White Consultants — Fri, 23 Apr 2010 07:49:23 GMT

A few weeks ago, Rachel called up her mobile phone service provider to change her subscription package. The Customer Service Officer who attended to her was a Mr. Hendricks who was very efficient in dealing with Rachel’s request.

A few hours after the call, Rachel received a call from Mr. Hendricks who told her that he found her voice very attractive and would like to take her out for dinner. Now, Rachel turned him down as she has a boyfriend. Mr. Hendricks was disappointed but decided he would keep calling, and after several calls and several refusals by Rachel, he ...

The ICO's new power

Lee & White Consultants — Wed, 03 Feb 2010 09:52:00 GMT

The UK's Information Comissioner's Office (ICO) has sharper teeth now to deter personal data security breaches - it can now serve monetory penalties of up to 500,000GBP to organisations for breaches of the Data Protection Act. The power is designed to deal with serious breaches of the Data Protection Act.

According to the ICO, for a data breach to attract a monetary penalty there must have been a serious breach that was likely to cause damage or distress and it was either deliberate or negligent and the organisation failed to take reasonable steps to prevent it. It gave the following ...

House for Sale

Lee & White Consultants — Wed, 14 Oct 2009 13:44:00 GMT

You are in search of a house. You visit real estate agents, you drive around, you enter the World Wide Web.

The Internet. A good place to gather as much information as you need without having to leave your home. Perfect. Let's get started.

You begin your search using the search engines available. Hundreds and thousands of links appear on your screen giving you information about houses available for sale, for rent, and other connected information. You are pleased.

You dig deeper - looking for the right area, for the right number of rooms, for the best price.

Ah, you ...

Tattletale gadgetry

Lee & White Consultants — Fri, 14 Aug 2009 14:05:00 GMT

We have all gotten so used to our gadgets that we are willing to sacrifice basic human rights to get our hands on them. People do not always know the value of their personal data, or value it so low that they are willing to give it up for peanuts (or a chocolate bar).

Often it is ignorance, and we are not aware that our gadgets or services are giving away important personal data. And then there are those of us who are aware of this fact, and are counting on our provider to treat our personal data ...

Your Personal Data is Priceless

Lee & White Consultants — Tue, 09 Jun 2009 14:16:00 GMT

Ever wondered how much your personal data are worth in the open market? Are you even aware that your personal data are being traded by and between companies and may be easily bought by criminals? Well, be assured that there is a price tag on your data.

If you take a look at the Swipe Toolkit Data Calculator, you will see the value of each piece of personal data. According to this tool, a date of birth is worth US$2.00 in the open market, while a postal address is worth US$9.95. Now, imagine how much your personal data is ...

Privacy Always

Lee & White Consultants — Wed, 29 Apr 2009 14:21:00 GMT

Economic crisis, downsizing, budget issues, bankruptcy. These seem to be some of the more common issues faced by many companies today - so much so that if one approaches them concerning P-R-I-V-A-C-Y, they would show you the front door!

Who has the time to bother about someone's privacy and personal data when there are more "important" issues at hand? Perhaps at first glance, the protection of privacy seems minute at times like these, and even the data subject is not too concerned about the way his data is being handled - he has more pressing matters to think about such as the possibility of losing his job, going bankrupt and ...

Permission is the key

Lee & White Consultants — Tue, 18 Nov 2008 15:34:00 GMT

Whilst unwanted electronic messages to natural persons are already taboo in the Netherlands, as of July 2009, spam will be completely prohibited - extending the illegality of spam to cover companies and other organisations. Indeed, this is the result of a modification to the existing Telecoms law.

Companies or organisations continuing to spam after the 1st of July 2009 can be punished with a maximum fine of 450,000€. If spam is still sent, then a complaint is possible on the spamklacht.nl site. The OPTA (Independent Post and Telecoms Authority, the Netherlands) will be supervising compliance to the law. Only upon explicit permission to receive such electronic messages (including SMS and ...

Data Handling Procedures

Lee & White Consultants — Mon, 27 Oct 2008 16:22:00 GMT

So, here we are again with another case in the series of data handling blunders. The recent careless use of personal data of the Luxembourg branch of Kaupthing bank confirms that proper data handling procedures are crucial. Email addresses of customers were leaked due to the misuse of email.

Inadequately defined procedures for data handling can, and will lead to improper and careless handling of personal data. We've seen this occur countless of times. For example, not too long ago, 25 million records were lost by the HM Revenue and Customs and according to the investigation, the problem was not with individual workers, but due to the lack of processes ...

Protecting People's Data

Lee & White Consultants — Fri, 29 Aug 2008 09:48:00 GMT

One of the duties of being a data controller is to adequately protect the personal data entrusted to you by your data subjects. The law remains pretty vague and does not specify how much 'adequately' is.

Amongst others it means that you need to implement adequate technical means to protect the data, and put the necessary security measures in place.

Another point tells you to limit who has access to that data, ensuring that data is accessed only on a need-to-know basis. For example, the receptionist needs to know the name and company of customers who will visit the company ...

When selling a computer is more than selling a machine

Lee & White Consultants — Wed, 27 Aug 2008 09:59:00 GMT

The frequency of one's personal data being so loosely taken care of is growing alarmingly fast these days. Then again, is it only now that such data is being mishandled, or has it been the case all along? Perhaps horror stories of mishandling of personal data have only recently emerged in the news owing to a growing awareness on the importance of privacy? If that was true, imagine the number of years gone by without our knowledge of the immensity of the abuse and mishandling of our personal data!

So what is the current horror report on personal data floating ...

When Friends Sell You Out for a Date

Lee & White Consultants — Wed, 27 Aug 2008 09:53:00 GMT

A Belgian dating website known as nicepeople.be has been sued by its competitor, toietmoi.be for requiring anyone who registers with them to give e-mail addresses of 5 friends. These people are then spammed with invitations to join nicepeople.be. It is nice to know that your friends can sell out your e-mail addresses in exchange for a bit of fun on a dating site - NOT.

Nevertheless, applause goes to the Belgian court for convicting nicepeople.be of sending unsolicited e-mails and spamming these third parties' inboxes. Punishing them with a 10,000 EUR fine is a good start and indeed, it is ...

The Early Bird

Lee & White Consultants — Tue, 19 Aug 2008 10:11:00 GMT

We manage IT projects on a daily basis, and in every project there is the returning constant of processing personal data.

I must say that most clients we have worked with show the goodwill to properly handle personal data, but sometimes other priorities, like financial limitations or time constraints, make it such that proper processing is seen to be a lower, if not the lowest priority.

Sometimes we get called in to audit a company to check existing processes and applications for compliance to data processing laws. We then need to inventorise what kind of data is kept and where, ...

How your personal data is collected on a website.

Lee & White Consultants — Wed, 30 Jul 2008 10:14:00 GMT

When you surf on the Internet, and browse through a website, do you realise some of the methods by which your personal data are collected?

Well, there are several ways:

Personal data visibly collected on the website
If you are aware that you are providing personal details on a website, then the website is visibly or explicitly processing personal data. To that extent, you can control the type of personal data you wish to divulge.

Some ways in which personal data can be visibly collected include:

Forms
Most websites have more than one type of form, depending on the purpose ...

Basic understanding of your duty as the data controller

Lee & White Consultants — Mon, 30 Jun 2008 10:28:00 GMT

A person's privacy is a fundamentalright which requires recognition and protection. Whilst it is incapable of precise definition, the concept has been linked with data protection, which interprets privacy in terms of management and handling of personal data.

With this right, we are able to strengthen essential values such as the freedom of thought, conscience and religion and the freedom of expression.

And alongside this right is a duty to protect it. This fundamental duty affects everyone as employers/persons processing personal data. Basically, if you determine the purposes and means of processing personal data, whether or not you are ...

Spam Not

Lee & White Consultants — Tue, 20 May 2008 10:30:00 GMT

About 75% of mail in Belgium is spam, usually associated with shady products or dodgy deals. But spam is just another word for unsolicited publicity mail - an email which you didn't ask for and which is completely useless to you or your business.

If you are sending out emails, be it just one email or in bulk, then consider very carefully if your email is going to be useful to the recipient. The best - and only legal - way is to actually have that recipient ask for the email in the first place - the opt-in. At any ...

What's the big deal anyway?

Lee & White Consultants — Thu, 01 May 2008 10:35:00 GMT

"What's the big deal anyway?". A remark we hear very often when discussing personal data issues."Nothing to be concerned about, who would be interested in my personal data, and what can they do with it anyway?"

Everyone agrees that a credit card number or bank account number is not something you should share (even Jeremy Clarkson eventually). But what can people do with my name and address, social security number or date of birth?

Personal data can be used for identity theft - impersonating someone by using as much as you know about that person to get financial or ...

How much is your personal data worth?

Lee & White Consultants — Fri, 18 Apr 2008 10:37:00 GMT

How much or should I say, what would it take for you to give out your personal data? A trip to Paris? A brand new car? Or perhaps, a bar of chocolate would do? Apparently, based on a survey conducted by Infosecurity Europe on 576 office workers outside Liverpool Street Station in London, a free bar of chocolate is good enough for 45% of women and 10% of men to give out their passwords. Only 21% surveyed were unwilling to give their password of which 60% later provided personal data such as date of birth. 60% of men and 62% ...

The fine print

Lee & White Consultants — Sat, 01 Mar 2008 11:42:00 GMT

Finally something is happening in the Belgian Data Protection World.

OIVO, the research and information centre of the consumer organisations in Belgium, has filed a complaint against the Belgacom group to the Privacy Commission and the Federal Ministry of Economics.

OIVO states that the privacy notification on the invoices sent out by Belgacom clause is a violation of the Data Protection law. This notification states that 'customer data is stored in databases of the Belgacom group (Belgacom nv, Belgacom Mobile, Telindus, Skynet) and can be used by any member of that group for customer management and to ...

Our Printers Are Spying On Us!

Lee & White Consultants — Wed, 20 Feb 2008 11:43:00 GMT

If you worry about your DNA and personal information being used to invade your privacy, now you have something else to add to your worries. According to a research by theElectronic Frontier Foundation (EFF) documents you print on your colour laser printer are able to indirectly identify you by encoding information that is not visible to the naked eye. Tiny dots are scattered on each page of your document. The information encoded includes time, date and the serial number of your printer. These are just the information that the EFF has managed to crack at the moment.

So, who ...

Toothless lions need more bite

Lee & White Consultants — Thu, 17 Jan 2008 11:45:00 GMT

Yesterday, the UK's Information Commissioner's Office (ICO) foundCarphone Warehouse, and its sister company TalkTalk, in breach of the Data Protection Act after investigating complaints concerning the way in which both organisations processed and stored personal information. It has now ordered both these companies to refine their data protection practices or be prosecuted.

We must applaud the ICO for taking enforcement action on this matter. Without a doubt, the ICO seems to be taking centre stage these days with the heightened number of privacy breaches in the UK (and believe me, with the rest of the world too). ...

The privacy breach of one Dutch company

Lee & White Consultants — Mon, 14 Jan 2008 11:48:00 GMT

Dutch care insurance company, CZ, recently made the headlines as a result of a faulty online quote system. Personal information of about 55000 people with regard to past applications could be retrieved by other parties. Such information included the
date of birth, bank numbers, social fiscal numbers, gender, name, address, post code, phone number and email address of these people. The online quote system has been removed from CZ's website.

The blunder was first discovered by two programmers who used the system for a quote and found the leak. CZ was informed of this but five days later, the ...

Who is abusing my email?

Lee & White Consultants — Tue, 08 Jan 2008 11:53:00 GMT

Summary: This article will show you how to stop people abusing your email address or at least find out who did.

You start a company, you register a domain and you get yourself a nice email address with your name in it, firstname.lastname@mydomain.com, and everything is great.

You now have a prestigious address at your own company and as nobody knows the email address, you receive no spam.

And then you register with a few online websites, known or not, and suddenly the spam starts to trickle in, more and more each day, until it turns into a flood ...

Jeremy Clarkson - wise guy humbled.

Lee & White Consultants — Tue, 08 Jan 2008 11:51:00 GMT

How many of you know Jeremy Clarkson? The wise guy host of Top Gear?

Well, like many people who do not seem to grasp the importance of keeping their personal data secure and ensuring that those who handle their personal data do the same, he has also thrown caution to the wind.

But that is quite alright. According to the BBC, he has been superbly proven wrong. The man recently revealed his account numbers in the Sun newspaper after ridiculing the commotion over the loss of 25 million people's personal details on two computer discs in the UK. He wanted ...

The secret of a good password

Lee & White Consultants — Wed, 02 Jan 2008 11:55:00 GMT

Numerous incidents of data loss or theft have occurred all through 2007 and before. A recurring cause of these incidents is the human factor. Information Technology these days is quite secure, and scam artists are turning more and more to the human factor as it is much easier to crack than those highly protected IT systems.

If you look at the incidents that happened in 2007, you will notice that most were due to human error: a junior sending CDs with unauthorized copies of databases, mail getting lost, laptops and thumb drives getting stolen, gullible and greedy people getting scammed, ...

Personal data goes missing again!

Lee & White Consultants — Wed, 26 Dec 2007 11:59:00 GMT

Will it not end? Will we have to keep reading (almost on a daily basis now) about the security breaches involved concerning personal data?

Where is the fire this time? NHS Trusts in the UK, it would seem.

According to Reuters, nine National Health Service trusts have lost the records of hundreds of thousands of adults and children, in the latest embarrassing loss of data by official bodies.

Ever since the concern for data protection was augmented not too long ago by the UK government when it acknowledged it had lost CDs with the names and bank account details ...

Where did Microsoft go wrong with Vista?

Lee & White Consultants — Wed, 26 Dec 2007 11:57:00 GMT

Microsoft has some serious thinking to do about its latest operating system - Vista. I'm sure we were all very excited when the eagerly awaited, glossy Vista was released early this year.

There is no doubt that Microsoft did an excellent job with the graphics and animations for Vista. However, is that all there is to Vista? A pretty image on your screen? It certainly does not do much if it is slow and hangs every few minutes. It would seem like Microsoft paid full concentration on visuals to make Vista trendy looking with its cool sidebar, and the animated ...

'Tis the season to be spamming - Not!

Lee & White Consultants — Wed, 19 Dec 2007 12:03:00 GMT

It is remarkable how far Christmas and New Year celebrations have been utilised for commercial gain. From selling ridiculous products under the pretext of Christmas gifts to spamming, Christmas has become nothing more than a time for advertising and marketing.

So what is Christmas spamming? Well, under the guise of sending you a Christmas and New Year wish through an email, these companies are actually trying to lure you into some new product or service. Yes, it is a commercial email and in many cases, there is no opportunity to unsubscribe from such emails and you might find yourself receiving ...

Toyota Brussels botches up on privacy

Lee & White Consultants — Thu, 13 Dec 2007 12:05:00 GMT

It has happened again. It seems to be getting more and more frequent these days for organisations to lose or mishandle personal data belonging to employees, clients and/or suppliers. Proper security measures and procedures are not instituted or even if they are, these procedures are not complied with in the daily operations of the organisations.

It is a great shame that these companies cannot grasp the simple concept of privacy and its extreme importance. I cannot emphasize how vital the protection of personal data is. How many times must those advocating for privacy and the protection of personal data repeat ...

On the persistence of the Internet

Lee & White Consultants — Fri, 23 Nov 2007 12:07:00 GMT

When we talk to people about the risks of publishing their own personal data on personal websites or social networking sites, their first reaction would usually be that they enjoy the fact that their friends or family members can see how they are and keep contact with them. They usually do not understand the implications of publishing on a world wide web without boundaries.

1. Search Engines

Search engines such as Google index and cache the information you publish on the web and keep this for an undetermined time on their servers. This can happen within seconds, so even accidentally ...

When parents should think more than feel

Lee & White Consultants — Wed, 21 Nov 2007 12:10:00 GMT

When it comes to children, which parent does not want to announce to the world all about theirs?

And let me add, what better way to "boast" (for lack of a better word) than by setting up a website displaying all possible information about your child/children?

Indeed, from the start of the child's life to his/her daily development, many uninformed parents today seem to be putting up websites with all kinds of personal information regarding themselves and their children. Some soon-to-be parents even set up websites counting the days to their child's birth.

You will usually and easily find the ...