By Natasha Lomas, 12 December 2007 16:23
NEWS
Another week, another data breach. Personal details of thousands of drivers in Northern Ireland have gone astray after two CDs sent by courier failed to arrive at their destination.
An internal inquiry has been launched after staff at Northern Ireland's Driver and Vehicle Agency (DVA) admitted losing data on a total of 7,685 vehicle owners and their vehicles. The missing information consists of the owner's name and address and details of the vehicle, including its make, model, colour, registration and chassis number.
silicon.com's Full Disclosure campaign - what we are asking for...
silicon.com wants the government to review its data protection legislation and improve the reporting of information security breaches in the public and private sectors.
We are calling for greater public debate and for the government to consider legislation that would require organisations that suffer information security breaches to alert their customers if there is a chance the breach has put individuals' sensitive personal data at risk.
We want to hear your views about this campaign and the issues it raises. Make your voice heard by leaving a Reader Comment below or emailing us at editorial@silicon.com.
The data, which was contained on two CDs, was being sent from the DVA in Coleraine to the DVLA (Driver and Vehicle Licensing Agency) in Swansea in response to vehicle manufacturers needing to contact owners about potential faults with vehicles. The CDs went missing in transit after being sent via a Parcelforce Worldwide tracked courier service.
In a statement about the breach to the Northern Ireland Assembly, Department of Environment minister Arlene Foster said the CDs had been tracked at every stage of the handling until they reached the company's central hub in Coventry but said there is no record of the packages leaving the depot.
She said: "Parcelforce believe they were dispatched to their Swansea depot but did not arrive there. In spite of extensive searches at the depot, they have not yet been found."
The data has already been resent to the DVLA via a different method but Foster said courier delivery has been used for sending "this type of data without incident for many years".
She said: "Due to the nature of the data on the disks, encryption was not used. It is ironic that an internal review instigated by the Agency after the child benefit disks went missing in GB identified this method as a systemic weakness a week after the disks had been sent."
The DVA has written to every vehicle owner involved and each record has been flagged to alert staff in the event of any misuse of the data, according to Foster. A helpline has also been set up for customers to call with any concerns. But "in view of the limited nature of the data on the disks", it is not likely any of the people involved would need to take any action, she said.
Foster added: "I sincerely regret that this error has occurred and any inconvenience or concern caused to the keepers of the vehicles involved. As well as the internal review carried out by the Driver and Vehicle Agency, all issues regarding the handling and transmission of data are being examined urgently as part of the review across all departments on the security of personal data.
The data protection watchdog the Information Commissioner has been informed and has agreed to carry out an audit of data security in the DVA.
In related news, a consultation has been launched into how personal information is used and shared in the public and private sectors, as part of an independent review of data-use announced by the UK government back in October. The consultation is being led by the Information Commissioner, Richard Thomas, and Dr Mark Walport, director of the Wellcome Trust and a member of government advisory body the Council for Science and Technology.
Among the questions it will consider are whether the Data Protection Act offers sufficient safeguards and whether there are lessons the UK can learn from other countries.
Comments
There are 8 comments. Join the discussion
1. Karen Challinor
so basically it's a shopping list for a car thief so they can steal to order and plan their thefts in comfort instead of having to wander around in the cold night air
and of course now the data is (possibly) in the public domain then the DVLA can't sell it to third parties for as much as they would want
let me see HMRC data, pensions data, a fantastic number of laptops with sensitive data on ... oh you get the idea.
HMG + our personal private data = bad idea
our data may as well be worn on a placard round our neck once HMG has it .. except we wouldn't be able to wear it within a kilometre of the houses of parliament
and HMG is still storming ahead with the ID card project and not listening to any objections because this project will be different, to all the preceding HMG instigated major IT projects presumably, and will be managed better with the data kept secure .. see note re hmrc, pensions et al
pass me the tissues I feel the need to weep
2. GALLEY SLAVE#41
They're 'aving a larf!!!!
3. Don Tregartha
For crying out loud this is DATA! - why can't this be supplied via secure ftp?
4. Robert Wingfield
It might have been safer mailing an encrypted file across the Internet one thinks. Do these people not have email?
If I made it up in a novel I'd be laughed off the circuit. On the other hand...
5. Simon Allen
Now, let me try to remember ... when was I first working on a project for encrpyted transfer of valuable data????
Oh yes, that was it - 1988 and it was all 'old hat' by then. The kit was expensive and the bandwidth was expensive but we controlled all aspects of it. I think it a reasonable guess that the price of kit and bandwidth has come down a bit.
<insert smiley of choice at this point!>
6. CPK Smithies
As Karen says, it would have been better really if they had sold this information to criminal organizations. At least criminals are motivated to keep it secure, for fear lest its free availability reduces its market value. As it is, I don't see any real need to worry about criminals getting their hands on this stuff. Within a few months you will just be able to google for it.
A great revenue opportunity missed by our government, and meanwhile they will squander more and more of the taxpayer's money getting front-line services to search for it, and more and more on machinery to do what our front-line services should have been doing but didn't have time for, et cetera.
It is high time we switched our identity - and political - paradigms. The last lot are melting down, even as we grumble.
7. ruth
You really couldn't trust this lot with your dead goldfish could you? Never mind our personal data for their ID cards. Worthwhile taking a look at
http://www.no2id.net/
I think.
8. Andrew Bedford
Its nothing to do with the DP Act. Its to do with having an effective management system.