BD&F Information Security

Data Protection Law

I’d first like to define what is meant by information security and why it is important to all businesses.

Commerce is based on the exchange of either goods or services. Very few business transactions are strictly cash only and therefore the seller usually ends up receiving and storing information about customers.

Some examples of the type of stored customer data include name, postal address, email address and banking details. These details are enough to identify an individual, construct a fault identity or commit fraud against someone.

A business has to assure customers it uses information handling systems that provide the following:
• Confidentiality – personal data is kept securely
• Availability – the company is in operation when expected
• Integrity – claims coming from the company are genuine

Information Security provides businesses with the guidance and skill to fulfil these assurances. The methods used are not all technical. Increasing staff awareness and configuring applications to protect against unauthorised access can be very cost effective.

There are laws governing the protection of information and the correct use of computers. These laws apply to all businesses that collect, process and store information from customers. No business is too small to be exempt.

The Data Protection Act (DPA) is designed to protect the public from misuse of personal data and applies to all businesses that collect, process and store information that can identify a person. The basic principles state that information must be:
• Fairly and lawfully processed
• Processed for limited purposes
• Adequate, relevant and not excessive
• Accurate and up to date
• Not kept for longer than is necessary
• Processed in line with your rights
• Secure
• Not transferred to other countries without adequate protection

Information security is much more than the use of a firewall on a network. The entire system for handling data must be considered. Each point from the perimeter of the network to the data that resides in a file provides opportunity to defend the system from both internal and external threats.

Photo by jsprhrmsn : bcn

The Importance of Correct Data

Who is Mr Rollonais? My wife and I have a standard practice of throwing away all mail that comes to our house addressed to Mr or Mrs Rollonais. How did this start?

Some years ago I received the news that I was a first round winner in a well known reputable sweepstake and I needed to call to give consent to be put forward for the final draw. I felt I was on a good luck roll so I called.

I never got any more news of that final draw but I was again alerted by the same company that I was a winner and needed to call again. This time though, the mail was to Mr Rollonais. I figured they got it wrong from my last call. I wrote in to correct the mistake else I might get a cheque I could not cash. From that time on mail has been coming to Mr Rollonais from many different companies with many different offers.

The Data Protection Act (DPA) lists eight principles that a data collector should adhere to including the dictum that data should be accurate and up to date. Mr Rollonais is not my accurate name and there was no Mrs Rollonais at that time.

The DPA also states that companies collecting personal data should inform customers of the uses to which that data will be put and I do not remember reading fine print that said my name and address and that of my presumed spouse will be passed to other companies for sales promotions.

Those companies that are mailing to Mr Rollonais are now wasting their money and I hazard to think how many mismatched persons and addresses to whom they market. Apart from the lost investment there is also a danger that inaccurate information can lead to problems for both business and consumer.

I had the experience of being billed for gas and electricity for my address but not to my name, the result of someone on my street applying to a supplier. This led to a three months of calls and mails to three different utilities to clear my name and hopefully my credit rating.

Personal data is held by many businesses and the processing and sharing of this data is showing to be out of control. As a customer it is important to make every effort to ensure that businesses record your information accurately.

You are also responsible for updating your records when there is a change in circumstances. The process can be involved and fraught with missteps as in a woman’s change from maiden to married name on her driving licence and bank accounts. It is worth the trouble in the long run.

Welcome to BD&F Infosec

Information is needed to perform commercial functions. Treatment of that information is governed by a mix of laws, regulations and policies. To be nimble and complaint in order to prosper, information must be able to move freely throughout its processes under changing conditions.

BD&F Information Security provides strategic planning and implementation of data lifcycle management systems.

Welcome to this site and I hope that the information is helpful.