Losing Personal Info On A Laptop Could Get You Charged

E5Rebel writes "The UK's data protection watchdog has called for legislation that would punish corporate or government officials with access to the public's personal data ... who lose it. Unencrypted laptops with this personal information which are lost or stolen will see their owners facing criminal charges. 'HM Revenue and Customs is among the organisations that have recently suffered high profile data security breaches as a result of laptops being lost or stolen. The HMRC laptop containing taxpayer data was encrypted - but other organisations have often failed to encrypt their machines.'"

Comments

Surely we should take intent into consideration

[BadAnalogyGuy]

I'm all for hardening our security systems in order to both prevent these types of accidents in the first place and to minimize the impact of such accidents in their inevitable occurences. I can't think of any reason a laptop would need to carry that sort of data, much less have it contained on the hard disk in an unencrypted filesystem.

But what I can't fathom is the animal-like need for vengeance against the poor government employees who lost the data as the result of one of these accidents. Unless we can show that the person was deliberately taking the information off-line and then staging the theft, how can we possibly in good conscience ruin this person's life just because he forgot a rule. These aren't the Queen's guards, we're talking about. These are people who work for the government (take that in any way you want).

Why are we not holding banks liable for having a system that encourages identity theft by making it as easy as stealing a laptop? Or holding wallet makers responsible for not securing wallets with anything stronger than a clasp? The reason is because we realize that there are limits to the abilities of these companies that can't be stretched much further. Government employees are mentally stretched to their breaking points. How dare we threaten them with jail time when we can't expect any more from them in the first place?

Might as well squeeze blood from a stone.

Re:Surely we should take intent into consideration

[FireHawk77028]

Giving your identity information to a bank is optional, you can choose not to do business with that bank. You cannot choose not to provide that information to the US Government. Tax dollars pay for that government. Encrypting hard drives doesn't require any special abilities. Maybe a couple of brain cells.

Re:About Bloody Time

[Anonymous Coward]

What a vague rant. Near as I can tell, you disagree with punishing people who break the law, think that when people break the law there's "no recourse", and confuse media hysteria over gun crime with the actual facts (the whole of the UK has about fifty fatal shootings per year, hardly a crime wave).

Did you actually have a point, or did you just want to rant against the English? Do you even know the difference between England and the UK? I see no reason to single out the English for UK policies.

Enforcement?

[afidel]

How do they propose to enforce this. I would bet damn near 100% of data breaches are self reported by the losing party. If you are suddenly going to face criminal charges I bet it will be a damn rare case where thefts actually get reported. So the statistics will show that data loss is at an alltime low and yet people will actually be at MORE risk due to the fact that companies that would have previously reported the incident and paid the couple hundred thousand for identity protection for a year or two will now keep things quite. Beyond which I also know from published studies that lost information devices have resulted in basically no known identity theft but lack of shredding (dumpster diving) and unsecured databases have led to a heck of a lot of cases.