Saturday, February 04 2012

Temp

Data protection doesn't appear to be top priority for Irish companies


Wednesday June 24 2009

Bord Gais must have spent a fortune in the past six months on its media campaign to get people to switch from the ESB but the kind of free publicity it received in the past week following the theft of company laptops was some it certainly could have done without.

With identity fraud so rife and people's bank accounts and credit cards being the subject of sophisticated and not so intricate scams, it behoves companies holding such personal details to be extra careful.

Bord Gáis Energy say a burglary took place on June 5th at one of its Dublin offices. During this incident four laptops were stolen, one of which contained customer information and bank details for 75,000 Bord Gáis Energy electricity customers. Apparently such sensitive information was not encrypted.

The Gardaí and the Data Protection Commissioner were immediately informed and a full investigation is said to be continuing.

The company says that on the basis of a risk assessment, it did not publicise the incident as it may have hampered the investigation.

How alerting its customers about the fact their details were now in the hands of criminals could in any way hamper a Garda probe I don't know. Talk about giving the criminal a headstart!

Bord Gáis says it has worked closely with the Gardaí, the Data Protection Commissioner and the Irish Banking Federation since the burglary and that it will be in direct contact with all affected customers.

The laptop is said to have contained details such as account numbers, home addresses and branch details of people who recently switched from the ESB in search for cheaper electricity.

Apart from closing down bank accounts there's no foolproof way for a customer to ensure he or she doesn't lose out. Indeed, the cost of such an exercise should be levied on the company that makes the blunder.

The customer can call the charge a 'documentation fee.' It would be, if it was the other way around.

It wasn't the only laptop theft last week. The HSE started an inquiry into the taking of 15 laptops, two of which were not encrypted, from its Roscommon town offices.

One of the laptops is said to contain case notes of families dealing with social workers.

In this day and age with banks and practically every other institution encouraging us to do nearly everything online, such information is priceless.

Some criminal gangs specialise in nothing else but identity fraud. Bank accounts can be cleaned out, loans applied for in your name plus a whole range of other services charged to your accounts.

In October last year, the HSE was at the centre of another laptop theft. Then, a laptop was stolen from an office in Dublin which held the records of medical cardholders.

This followed the news that 380,000 social welfare recipients' details were contained on a laptop stolen from an audit room used by the Comptroller and Auditor General's Office at the Department of Social and Family Affairs last August.

In April 2008, Bank of Ireland admitted that the personal details of 10,000 customers had been taken. There have been countless other examples and the one thing that is very clear is that security around personal data seems to be very lax.

Bank customers heed all the advice about keeping account numbers safe, even covering pin numbers from prying eyes at ATMs but what's the point if the the institution they deal with is so careless on their end?

The banks and other similar bodies in possession of critical data should not only have to bear the cost of cleaning up the mess in the aftermath of a laptop theft, and that means paying compensation for the distress caused to customers, but they should also face punitive sanctions from the relevant regulatory body if such thefts are not reported on time and if it can be shown that security was lax in any way.

It's the only way they'll learn. Protection of customer information is vital and there's no excuse for not having a secure data protection system in place.

Certainly, if I was one of those people who received a letter this week from Bord Gais outlining how their personal details had been stolen I wouldn't stop complaining to them for at least a week!

I'd certainly be looking for a credit off my next bill at the very least.

Unfortunately though we don't complain enough in this country.

That's why hotels in Dublin can double and treble their accomodation rates on the nights of a big concert in the capital and get away with it. By the way, one hostelry attempted to charge a customer in town for the recent Take That concert in Croke Park €3-€6 for the privelege of parking overrnight in their car park which is quite a distance from the city centre.

The same regular customer had paid €150 for a room (the previous and subsequent nights could be got for €60) plus around €50 on food/drink. Or try booking to go to Manchester on a day/night United are playing. Airline fares either side of the date can be got from between €30 and €50 but can suddently jump to €250 on matchday. Rip-off

Ireland I think it's called.

pauldeering@sligochampion.ie