A twenty-five page report by security outfit Symantec has concluded that contractors and employees are the main cause for person data breaches in the UK. According to the report,
thirty-six firms in the UK covering eleven different industries has experienced data breaches during 2011 which resulted in a notification to the Information Commissioner.
Apparently the data breaches were caused over a third of the time by "a negligent employee or contractor" whilst "system glitches" were responsible for another third of the instances. The glitches account for "a combination of both IT and business process failures," the report said. Malicious or criminal attacks were the cause of the remaining one third of cases.
Symantec expressed the view that the amount of information breached on average had fallen and that a larger number of customers were remaining loyal to companies that had lost data. "The average abnormal churn decreased from 3.3 percent in 2010 to 2.9 percent this year," the report said. "However, certain industries, such as financial services and pharmaceutical companies, are more susceptible to customer churn, which causes their data breach costs to be higher than the average. Taking steps to keep customers loyal and repair any damage to reputation and brand can help reduce the cost of a data breach."
Companies also experienced lower costs relating to business lost through data breaches, the report said. Those costs – which account for factors such as losses to businesses' reputations as well as diminished goodwill – "sharply decreased from £913,910 in 2010 to £779,414 in 2011".
The study said breaches as a result of criminal or malicious attacks were "the most costly". "..Organisations need to focus on processes, policies and technologies that address threats from the malicious insider or hacker," it said. In 2011, global companies such as Sony, Nokia and Acer all had personal data stored on their systems stolen by hackers.
All companies and businesses (including internet service providers) are required to notify affected customers and the Information Commissioner's Office (ICO) of personal data breaches immediately, as provided for in the Privacy and Electronic Communications Regulations.
Since April 2010 the ICO has had the power to issue monetary notice penalties of up to £500,000 for serious data breaches of the Data Protection Act (DPA). It rarely imposes such fines, according to some sources.
© Brian Miller, solicitor, 2012.
Brian can be contacted at Stone King, Solicitors. For further news and information on legal topics of interest, please visit Brian's other blogs: