Home : Networking : News

CEOs to account for data losses

But analysts have said that tighter data protection laws could force datacentres offshore.

By Stephen Pritchard, 7 Dec 2007 at 14:53

Tighter laws could make UK chief executives directly responsible for breaches of customer data, such as those suffered by HM Revenue and Customs or the retailer TK Maxx.

According to a presentation by Information Commissioner Richard Thomas to the House of Commons' Justice Committee, chief executives would have to certify that companies had safeguards in place to protect personal data.

Failure to ensure such safeguards could become a criminal offence, and UK companies could be forced to disclose information security breaches.

According to IT security company Symantec, more than 30 US states have data disclosure laws. European Union law currently regulates how companies collect and store data, but makes few provisions for how businesses must handle security breaches.

"The types of measures [presented to the Justice Committee] could be useful if they make sure that information assurance has senior level attention," said Ilias Chantzos, Symantec's European director of government relations. "But there are a number of European member states that already have criminal sanctions and we are not sure how regularly these are enforced. I certainly don't know of anyone going to jail."

Nor might the measures put an end to high profile security breaches, industry experts warn. Instead, they are likely to add to compliance costs, especially for smaller firms. The rules could even prompt some organisations to move their data centres offshore, to countries with less onerous safeguards.

"There will be a lot of companies who don't know how to secure their data," said Carole Theriault, senior consultant at information security vendor Sophos. "Education should be the first point of call, rather than criminal sanctions. If I am burgled because I've left a door open, I want the support of the authorities, not punishment."

However, Theriault added that the public often blames the organisation that suffers a data loss, not the cyber criminals behind the attack.

A recent survey carried out by Sophos found that if a local government department lost personal data, 86 per cent of the public would hold the local authority responsible.