IT Week: What are your thoughts on the recent Information Commissioner’s annual report on data privacy?
Fudge: That report really brought data security to the forefront of people’s minds. When this happened in the US, it led to California introducing SB1386, a data breach notification law whereby even if you think you might have lost some customer data you must make a public disclosure. This is likely to be the next step over here too because the UK Data Protection Act has no teeth. However, you may see complacency from a customer standpoint if a breach notification law is introduced, until they actually become a victim.
How has the recent PCI data security standard affected the industry?
I see it as having as much or maybe more impact over time as any data
breach notification laws because it could potentially have more teeth and force
firms to protect data in additional ways. There have been some high-profile
incidents in the US, such as the Veterans’ Association data loss, that have
brought the standard to the forefront and made the government at least get very
proactive. Washington is now one of our largest customers.
So how far ahead of the UK are firms in the US in terms of their data
protection and data breach mitigation strategies?
In the US, there is more pressure on companies to put overall data
protection policies in place. In the UK, we have to educate customers as to the
policies and procedures, but in the US they already know them well and are
looking at the technologies that can put them in place. We’ll see that cycle
speed up in the UK soon. The Information Commissioner’s report has added greater
visibility and urgency to these issues.
A recent report by a House of Lords committee recommended technology
vendors be held liable for security flaws in their products. How practical do
you think this is?
If it became law it would definitely force vendors to have better
development practices. We follow the Electronic Mass Casualty Assessment &
Planning Scenarios (Emcaps) requirements, which not only look at the
functionality of products but the entire engineering process how to document
requirements, what kind of quality assurance processes you need and so on.
Were the Lords right to criticise the UK’s fraud reporting system?
The police need more resources to investigate this type of crime
because as technology proliferates and more people do business online it will
continue to get worse. Criminals are now going after the data and governments
around the world have to respond and put organisations in place to respond to
this.
