Data breaches cost £47 per record

gallery

The study didn't take into account the social damage a massive data security event could cause. He suggested banks and other institutions take seriously the threat from terrorists, asking what would happen if an attack took UK banks offline for five days, or California was taken off-grid?

Gunnarsson and Dunkelberger took the opportunity to renew calls for UK or EU data breach notification, but said it was necessary to create one legislation for companies to follow. Dunkelberger described the oft-cited American system, which is flawed because each of the 40 states with notification laws has different legislation which requires separate filings. A multinational corporation faces even more different rules, he added.

Gunnarsson said: "The worst thing that could happen is very harsh, detailed restrictive legislation."

Dunkelberger agreed: "Government don't do a good job of legislating technology... we say use best practices."

He stressed the need for safe harbour clauses. "If you've done best practices and are at zero risk of a breach, you shouldn't be penalized," especially as the largest cost of a data breach is in lost business, he said. "Don't punish a business which has done the right thing."

Email to a friend

Print this page