The Canadian Privacy Law Blog: Developments in privacy law and writings of a Canadian privacy lawyer, containing information related to the Personal Information Protection and Electronic Documents Act (aka PIPEDA) and other Canadian and international laws.

Search this blog

Recent Posts

On Twitter

About this page and the author

The author of this blog, David T.S. Fraser, is a Canadian privacy lawyer who practices with the firm of McInnes Cooper. He is the author of the Physicians' Privacy Manual. He has a national and international practice advising corporations and individuals on matters related to Canadian privacy laws.

For full contact information and a brief bio, please see David's profile.

Please note that I am only able to provide legal advice to clients. I am not able to provide free legal advice. Any unsolicited information sent to David Fraser cannot be considered to be solicitor-client privileged.

David Fraser's Facebook profile

Privacy Calendar



Subscribe with Bloglines

RSS Atom Feed

RSS FEED for this site

Subscribe to this Blog as a Yahoo! Group/Mailing List
Powered by

Subscribe with Bloglines
Add to Technorati Favorites!

Blogs I Follow

Small Print

The views expressed herein are solely the author's and should not be attributed to his employer or clients. Any postings on legal issues are provided as a public service, and do not constitute solicitation or provision of legal advice. The author makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the information contained herein or linked to. Nothing herein should be used as a substitute for the advice of competent counsel.

This web site is presented for informational purposes only. These materials do not constitute legal advice and do not create a solicitor-client relationship between you and David T.S. Fraser. If you are seeking specific advice related to Canadian privacy law or PIPEDA, contact the author, David T.S. Fraser.

Tuesday, November 20, 2007

UK loses sensitive personal data on 25m people 

A lot of stuff I read about privacy incidents leaves me scratching my head in wonder. In thinking about the staggering number of privacy breaches coming out of governments (Canadian, US, UK, etc.), I wonder:

  1. Are we hearing about all these incidents because employees who handle personal information for governments are idiots?
  2. Are we hearing about all these incidents because governments are more likely to come clean when bad things happen?
  3. Are we hearing about all these incidents because citizens are more likely to go to the media?
  4. Are we hearing about all these incidents because governments handle such vast quantities of personal information, but statistically are no more likely -- per capita / per employee / per whatever -- to mishandle personal information?

I am thinking that it probably isn't #2.

The latest is from the UK. An employee of the Revenue & Customs sent CDs of unencrypted personal information about almost every child and parent in the UK via regular internal mail. The CDs never reached their destination. The minister responsible has admitted that this has occurred on multiple occasions. When are governments going to learn?

See: Taxman loses sensitive personal data on 25m people - Times Online, via UK tax-man repeatedly hemorrhages personal financial info of 25 MILLION Brits - Boing Boing.

Labels: , , ,

11/20/2007 09:28:00 PM  :: (2 comments)  ::  Backlinks
While I think that goverments are more likely to disclose breaches (it's harded to replace your government than your bank), I think that we've seen that most breach disclosures don't lead to the sky falling, and so we're seeing more of them.

I talk about this regularly over at Take a look at the breach analysis archives.

Possibility #5 - private industry takes privacy more seriously.

No, really, I mean it.

I'll admit my sample size is lousy - I work in private industry with a terrible privacy track record, but I have no relevant experience in the public sector.

In my business, confidential data often also has commercial applications. If you lose this data, not only are there privacy and reputational issues, but there may also be a genuine profit hit: competitors may steal your clients, employees may be taking money to which they are not entitled.

As a result, the people who have access to confidential data are a defined number of people, with well-defined responsibilities. Other people are in charge of making sure those people are doing their jobs correctly.

The Economist says something very similar (albeit in a much more erudite way) in its Nov. 22editorial dealing with the loss of the HMRC data (

"Large databases have their uses, doing away with paperwork and speeding things up. But the centralisation of so much data also has drawbacks, as this week's mess shows. In its enthusiasm for huge technology projects, such as its plan for a national identity card, the British government has failed to take such dangers sufficiently seriously. And why should it, when its departments face no penalties for ignoring procedures and losing data? If organisations were confronted by the risks of building large databases and forced to balance them against the benefits they provide, they would design them differently and monitor their use more closely. "

The private sector is, to a greater extent, confronted with the risks of building (and running) large databases, and so does design and monitor them more closely. Not perfectly, not constantly, but more closely.
Post a Comment

Links to this post:

Create a Link

This page is powered by Blogger. Isn't yours? Creative Commons License
The Canadian Privacy Law Blog is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 2.5 Canada License. lawyer blogs