UK data laws to grow some teeth

IT Week: What are your thoughts on the recent Information Commissioner’s annual report on data privacy?

Fudge: That report really brought data security to the forefront of people’s minds. When this happened in the US, it led to California introducing SB1386, a data breach notification law whereby even if you think you might have lost some customer data you must make a public disclosure. This is likely to be the next step over here too because the UK Data Protection Act has no teeth. However, you may see complacency from a customer standpoint if a breach notification law is introduced, until they actually become a victim.

How has the recent PCI data security standard affected the industry?
I see it as having as much or maybe more impact over time as any data breach notification laws because it could potentially have more teeth and force firms to protect data in additional ways. There have been some high-profile incidents in the US, such as the Veterans’ Association data loss, that have brought the standard to the forefront and made the government at least get very proactive. Washington is now one of our largest customers.

So how far ahead of the UK are firms in the US in terms of their data protection and data breach mitigation strategies?
In the US, there is more pressure on companies to put overall data protection policies in place. In the UK, we have to educate customers as to the policies and procedures, but in the US they already know them well and are looking at the technologies that can put them in place. We’ll see that cycle speed up in the UK soon. The Information Commissioner’s report has added greater visibility and urgency to these issues.

A recent report by a House of Lords committee recommended technology vendors be held liable for security flaws in their products. How practical do you think this is?
If it became law it would definitely force vendors to have better development practices. We follow the Electronic Mass Casualty Assessment & Planning Scenarios (Emcaps) requirements, which not only look at the functionality of products but the entire engineering process ­ how to document requirements, what kind of quality assurance processes you need and so on.

Were the Lords right to criticise the UK’s fraud reporting system?
The police need more resources to investigate this type of crime because as technology proliferates and more people do business online it will continue to get worse. Criminals are now going after the data and governments around the world have to respond and put organisations in place to respond to this.