Irish Data Protection Commissioner - Annual Report 2012

The Irish Data Protection Commissioner released his annual report for 2012. It is worth having a quick look through the press release and  report to see what are the current issues. It is especially worth reading the appendix 4 on the INFOSYS system, which gives access to data held within the department of Social Protection's system.

To quote from the press release:

• "One of the major themes in this year’s report concerns the issue of sharing personal data in the public sector which has featured regularly in previous annual reports from this Office". 

The importance of audit trails is stressed in relation to who accessed data. This is of particular importance in the public sector where you usually don't have a choice as to whether you appear in the database or not. Usually in the private sector, you have some sort of say about the sites that you use.

A number of cases are highlighted where data was accessed inappropriately by users of the INFOSYS system.

In addition, some members of the Police Force are shown to have accessed the PULSE Police system inappropriately to look at information on celebrities.

This matters. 

A few weeks ago, the Irish Independent reported on the powers that the Revenue Commissioners now have. Revenue Commissioners boss Josephine Feehily told a Government committee: 

• "that tax officials can now trawl through reams of data, including bank accounts and mobile phone numbers, to spot cheats."

This sounds like the kind of stuff that the old East German secret police could only have dreamed of - and it will only get worse. Governance in relation to how public bodies manages personal data is vital. The audits carried out by the Data Protection Commissioner are critical in making sure that there is some sort of proper security in place.

• How is this data used?
• Is this data misused and abused?
• How is the "mobile phone" and "bank account" data made available to the Revenue?
• Is it deleted when no longer necessary?
• Who has access to this data?
• Is there an audit trail of all access?
• etc.....the list goes on.

One good thing is that the Commissioner says that his office is adequately funded.

Useful links

• Irish Data Protection Commissioner - 2012 Annual Report  
• Irish Data Protection Commissioner - 2012 Press Release
• Irish Independent: 'Big Brother' software will find tax cheats, says Feehily

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot

ICO Breach Statistics 2012

In 2012 the ICO (Information Commissioner's Office) in the UK found 5 websites to be in breach of  data protection act.

The ICO lists the actions that it takes against organizations that it deems to be in breach of the Data Protection act. This also serves as a useful source of statistical information which this blog entry briefly explores. There are a number of different actions that the ICO can take.

• Monetary Penalty Notices, 
• Undertakings
• Enforcement Notices
• Prosecutions

Overall Statistics

For 2012 here are the overall statistics.

	Total for Action	Nr for Web Application
Monetary Penalty Notices	24	1
Undertakings	29	4
Enforcement Notices	03	0
Prosecutions	06	0
Overall Total	62	5

There were 62 incidents of which 5 relate to websites. Given the number of online applications that process personal information, 5 seems to be a remarkably small number.

Here is a high level overview of the web application incidents.

Monetary Penalty:

• 6th August: Sensitive personal information relating to 1,373 employees was published on the  website.

Undertakings:

• 1st March: Disclosure of personal information in training materials published on its website
• 17th April: a web design error that created the potential for unauthorised access to individual’s personal data 
• 18th April:  Two data security incidents which relate to the unauthorised disclosure of personal data on the data controller’s website.
• 30th November: A private area on the website was accessible to members of the public

The Rest of the Incidents

The rest of the cases are made up of a mixture of the usual suspects:

• Information being sent to the wrong recipient. 
• Paper files left in waste bins. 
• Unencrypted memory sticks. 
• Hard drives not securely erased at end of life.
• etc.

It is worth taking a look at the ICO website taking actions page to get a feel for the kind of problems that exist. There is no real pattern. Website issues are only a small proportion of the overall numbers. It shows how difficult it can be for a security manager to put a comprehensive security program in place.

Useful Links

• ICO Enforcement 

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot

ICO Taking Action - 2011 Analysis

Summary
I did an analysis of the UK's Information Commissioner's (ICO) "Taking Action" incidents for 2011. There were approximately 80 incidents  where the ICO took action, after personal data breaches. Of these:

• 26 were related to  unencrypted media (e.g. lost or stolen laptop or USB memory stick); 
• 24 were caused by a misadventure of some sort with paper records; 
• 14 resulted from data being electronically sent (e.g. email or fax)  to the wrong recipient;
• 12 came from an application or website issue; 
•  4 were categorised under "other".

The lesson for security managers is that most incidents involving personal data are caused by relatively mundane type events, not advanced hacking attacks. Security awareness training for people should reinforce the message: be careful when processing personal data and do not use USB sticks. Technical measures include encryption of laptops etc.

Detail
The UK's Information Commissioner (ICO) lists the actions he has taken against individuals or organisations found to have been in breach of the UK Data Protection Act. I did an analysis of the incidents for the year 2011. The main purpose is to analyze the causes of these incidents to gather metrics.


I divided the incidents into 5 categories:

• Unencrypted Media - this includes such items as loss or theft of unencrypted media such as USB sticks or laptops. 
• Loss of Paper Records - including incidents where physical documents are misplaced, lost, found in a waste bin, or similar.
• Electronic Records Missent - where personal data is sent electronically to the wrong recipient using either email or FAX
• Website/Application Issue - where the action results from some sort of application or website issue.
• Other - which did not fit into any other category

Results
The following table shows the results:

Category	Number Incidents
Unencrypted Media	26
Loss of Paper Records	24
Electronic Records Missent	14
Website/Application Issue	12
Other	4
Total	80

The ICO does not usually say whether an actual loss occured as a result of any incident. There are a number of incidents where you get two for the price of one. For example a laptop is stolen along with paper records.

The results show that the majority of incidents have  relatively simple or mundane causes. Advanced hacking techniques were generally not employed. The lessons to be taken from this analysis are that basic security measures will prevent the majority of these incidents:

• Security awareness training to reinforce the message that people should be careful when pressing the send button.
• Do not use USB sticks
• Encrypt laptops (and USB sticks if they must be used)

I hope to do a more detailed analysis of the Website/Application issues in a future blog entry.
There is a spreadsheet on Google Docs of the analysis (See Useful Links)


I did a similar type analysis of ICO enforcements in 2010 (See Useful Links)

Useful Links

• ICO: Taking Action - Undertakings, Enforcements and Monetary Penalties
• UK Information Commissioner (ICO) Enforcements and Website Hacks  (Entry on this blog)
• ICOTakingAction - Google Docs Spreadsheet analysis of results

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot

Swiss Data Protection and Online Applications

Update:18/9/2011 Major Revision


If you are developing online applications in Switzerland which process personal information, what does Swiss Data Protection Legislation require you do to?

This post looks at the major technical items and some of the implications that it may have for your online development project. There are two main items:

• Federal Act on Data Protection
• Ordinance to the Federal Act on Data Protection (OFADP)

Federal Act on Data Protection
The main piece of legislation is the "Federal Act  on Data Protection".  There are 39 articles divided into 8 sections. This blog reviews some of these articles and what it may mean for your development. It is not comprehensive but just a guide. It does not consider the later sections such as those dealing with processing by Federal Bodies

Art. 3 Definitions

Implications: Use the definitions section to decide if the legislation applies to your application and whether you are processing personal or sensitive personal information

Art. 4 Principles

Implications: The development should have a privacy statement or similar, which describes how personal data is used.

Art. 5 Correctness of the data
Implications: The application should somehow allow users view and update their personal information. This can be done either directly (by the user) or indirectly (e.g by an administrator).

Art. 6 Cross-border disclosure
Implications: You need to be careful about transferring personal data outside of Switzerland. In particular be wary of development teams and test teams who are based outside the country. "Test data" that they are using might still be real personal data.

Art. 7 Data Security
Implications: This is the main artcile on security. It states that: "Personal data must be protected against unauthorised processing through adequate technical and organisational measures". This is where good security practices such as the OWASP Top 10 come into play

Art. 8 Right to information
Implications: The application will need to allow persons to view their information.Typically the user be able to logon and view their information. The other main method is that the user can request to see their information from the data controller. The controller must then be able to retrieve the information from the application and make it available to the user.

Art. 10a Data processing by third parties
Implications: You may outsource processing to a third party. However the third party must have adequate levels of security in place.


Art. 11a Register of data files
Implications: Under certain circumstances you may need to register with the commissioner. For example, if you process sensitive personal information.


Ordinance to the Federal Act on Data Protection (OFADP)
The OFADP is the second major element of Data Protection legislation. From a security perspective there are two significant articles: 8 and 9.

Art. 8 General measures
Implications: Article 8 (general measures) states that people who process personal information:

• shall ensure the confidentiality, availability and the integrity of the data in order to ensure an appropriate level of data protection

The security measures that you take depend on a number of items, including the purpose and extent of processing, current state of the art and "an assessment of the possible risks to the data subjects". So some sort of risk analysis should be undertaken.

Art. 9 Special measures
Implications There are 8 (a-h) special measures.These talk about typical security controls such as security during transmission and storage, authentication, access control, etc. Of particular interest is clause h which states:

• input control: in automated systems, it must be possible to carry out a retrospective examination of what personal data was entered at what time and by which person.

Therefore, Clause h implies that your application must have a proper audit trail.

So if you are implementing a system which processes personal information, then it is worth while reading down through the information in the following links.

Useful Links:

• Federal Act on Data Protection
• Art. 7 Data security

• Ordinance to the Federal Act on Data Protection (OFADP) 
• Art. 8 General Measures 
• Art 9 Special Measures 

Note: These are English links. As each link says - "English is not an official language of the Swiss Confederation. This translation is provided for information purposes only and has no legal force."  However you can find links to all four official languages on the top of the HTML pages. This way nobody is offended - or everybody is offended equally.

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot