Posted by SecExtra on January 26th, 2008

Marks & Spencer have been found guilty of breaking data protection rules by failing to secure the personal details of some 26,000 employees. This breakdown in security happened when a Laptop was stolen during a burglary at a contractors house and the theives got away with pension arrangement details of the M&S staff.

Thefts are not uncommon, and often the data that goes missing on laptops was not the original target. Indeed it would also not be a bonus for any standard criminal as they likely do not know what they have in their hands and just look for the quick sell. The problem in this instance with M&S is that the data on the Laptop was not encrypted and not even protected by a basic password. This means all the data was being kept unsecured on a personal Laptop.

ICO Assistant Commissioner Mick Gorrill said: “It is essential that before a company allows personal information to leave its premises on a laptop there are adequate security procedures in place to protect personal information, for example, password protection and encryption.”

The ICO is the official watchdog set up to police the Data Protection Act and the Freedom of Information Act. They have now run an investigation and found M&S in breach of the DPA. As a result it has ordered the retailer to ensure all its laptop hard drives are fully encrypted by April of this year.

With all the data loss issues in the UK recently we are suprised that this has even been allowed to happen, especially with such a large retailer. It just goes to prove that everything is only as strong as its weakest point… go encrypt your data now.