Data Loss Prevention: Keeping Sensitive Data Out of the Wrong Hands

Data security breaches pose a serious threat to business, according to a report from consultants PricewaterhouseCoopers (PwC).

The recent Survey revealed that more than two-thirds of organisations do not maintain an inventory of user data or a list of locations and jurisdictions where this information is stored.

The survey found that only half of all companies have a policy that addresses the protection, disclosure and destruction of data and, although many organisations operate a security encryption policy while transmitting data, very few use encryption for data which is “at rest” i.e. information in databases, file sharing and storage, laptops and back up facilities

According to PwC, companies cannot afford to take data security lightly. Identity theft is rampant, accounting for about one-third of consumer complaints received by the Federal Trade Commission last year- whether you’re a security leader or a business line executive—now is the time for you to start better protecting your company’s customer data, core intellectual property, trade secrets, and regulated data.

Speaking at the launch of the report, Ciaran Kelly of PwC Ireland said: "With consumers and regulators demanding more control over sensitive data than ever, it is clear that now is the time to start better protecting your company's customer data."

In Ireland It is the legal responsibility of ICT data controllers to comply with Data Protection legislation. EU Data Protection Directive 95/46/EC specifies the general obligations of data controllers as to how personal data is handled. The Directive is transposed into Irish law as the Data Protection Act 2003; this in turn adds to the provisions of the Data Protection Act 1988.

While managing and protecting current data is important, companies also need to be extremely careful when disposing of IT equipment that contains sensitive data. There are many reports of computers, with their hard drives intact, being found in open markets in the third world and there is also a market for used data tapes. Deleting files or even reformatting a hard drive does not remove the information, as this can be restored using readily available software

The problems associated with data security for end of life equipment can be eliminated by using reputable IT recycling companies, who can provide certified data destruction services as part of their asset management or equipment recycling processes.

Apart from a company’s responsibilities under the Data Protection Act, there is also a continuing responsibility under the Waste Management Act 1996 (amended 2001) for IT equipment, until it has been proven that it has been disposed of properly. If the cannibalised remains of a company’s equipment are disposed of illegally, it is the company that is responsible, not the person who took it away for disposal.

When replacing or disposing of end of life IT equipment, companies need to ask their new equipment vendor, waste service provider or facilities manager, what exactly happens to their equipment once it leaves their control.