Slechte beveiliging personal data kan grote gevolgen hebben

A database containing contact details of 170,000 workers of oil giant Royal Dutch Shell has been emailed to campaigning groups opposed to the company’s activities. Seven non-governmental groups – including human rights groups and environmental campaigners such as Greenpeace – plus anti-Shell campaigning website royaldutchshellplc.com received the database details, which are thought to have been sent by a disaffected former employee of the company. Many of those groups are upset at the way Shell is purported to be operating in some countries, particularly Nigeria.

The database is thought to contain names, telephone numbers and further details on permanent and contract employees. A lengthy covering letter was attached to the database, purporting to be from more than 100 Shell staff. Shell has demanded that the activists delete the database. Furthermore, it said it has already launched an investigation, and argues that the breach does not pose a security risk. However, it could provide no further comment at the time of publication. 

If it is found that Shell is guilty of an offence under the UK’s Data Protection Act 1998, it could be fined. A spokesperson for the UK Information Commissioner’s Office (ICO) said: “Shell has notified us of a security breach regarding a significant amount of people’s personal details. We are looking into how this data breach occurred and will decide what, if any, regulatory action is required.” Shell – if it is found guilty – may escape lightly. Fines levied by the ICO for failing to protect against the loss of personal data tend to be under £5,000.

While the data breach may prove costly both financially and in terms of reputation, its timing is ironic. In two months' time, new rules are set to be introduced that may mean companies could be fined up to £500,000 if they are found to be reckless with personal information. The leaked database is about six months old, implying that ex-employees may have been involved. Shell cut 5,000 jobs last year.

efamro comments:
This data loss illustrates the importance of adequate data security.
Data security will not be the same in any two organisations but measures can be categorised in to four broad categories: organisational security, staff, physical security and computer security. Organisational security relates to the implementation of an overall security policy with adequate resources and support. Staff issues cover recruitment training and supervision. Physical security will include access to offices, shredding of documents and the use of locking cabinets of files and laptops. Finally, computer security is the most rapidly changing of these areas. A state of the art solution is not necessarily required but organisations must take into account technological development when they decide on security measures. Issues will include the use of adequately strong passwords, limitation of access to networks, authentication of users, the encryption of mobile devices and the secure deletion and destruction of information stored on computers.

Bron: EFAMRO monitoring 19-02-2010