Home : Networking : News

ICO tells M&S to get encrypted

The Information Commissioner's Office (ICO) has found the high street retailer in breach of the Data Protection Act after a laptop was stolen last year.

By Nicole Kobie, 25 Jan 2008 at 12:53

gallery

Marks & Spencer (M&S) has been told to encrypt its laptop hard drives by the Information Commissioner's Office (ICO), after the watchdog found the high street retailer in breach of the Data Protection Act following a stolen laptop last year.

The unencrypted laptop, which went missing from an M&S contractor's home in mid-April of last year, held personal pension data on 26,000 of the retailers' employees.

Following an investigation, the ICO has issued the retailer with an Enforcement Notice ordering all laptop hard drives to be encrypted by April 2008. It is a criminal offence if M&S fails to follow the notice, the ICO said.

Mick Gorrill, Assistant Commissioner at the ICO, said: "It is essential that before a company allows personal information to leave its premises on a laptop there are adequate security procedures in place to protect personal information, for example, password protection and encryption."

He added: "Organisations which process personal information must ensure that information is secure - this is an important principle of the Act. If organisations fail to introduce safeguards to protect information they risk losing the trust and confidence of both employees and customers."

According to the notice, the ICO served the retailer with a preliminary notice in July, asking M&S to comply with the act, specifically the seventh section concerning information security. In the notice, the ICO said that M&S said it was willing to take steps to reach compliance, but only if it was not made public - which the commissioner said was "not acceptable". However, the document also shows that the retailer had started the process of encrypting its hard drives by October 2007.

In response, an M&S spokeswoman said the retailer was a bit "bemused" by the situation, and "at a bit of a loss to understand why the ICO has done it".

She said that M&S had been in continual contact with the ICO since the laptop theft, and had made a decision to encrypt its laptops in October. "We're well ahead of the game," the spokeswoman said, adding the retailer is doing everything it can to meet the April deadline.