Here’s a challenge.. What about you and I hold each other accountantable for any tasks until the end of the year.. lets have a “daily , or weekly phone call if thats what it takes.. What do you think ?

Thanks

chris

Thanks again!

Relax, Focus, Succeed

Actually I’m thinking of writing a book about it, which is provisionally entitled “Chalk up a Lark”.

Sometimes though, there are just those periods where you have to stick it out. After all, it’s your business.

The longer and harder you work does not necessarily mean the more you’ll get done.

Sometimes it’s good to take some time out, relax, and come back at things with a fresh perspective. This could be going to a Business Conference that will energise you with ideas, or taking a long weekend to relax, or even something as simple as reading a chapter of a book. Anything that focuses your attention on something other than the day-to-day grind.

I’ve observed that people who are “too busy” to work on important things that will move them forwards are typically still to be found in the vicious circle of fire-fighting and getting stressed many months (or in some cases, years) later.

I love the phrase “If you carry on doing what you’ve always done, don’t be surprised when you get the same results”.

As service providers I agree that you now run a tightrope walk with your customers on this issue. Encryption and resolving an issue in the event of hardware failure is as has been pointed out a time consuming exercise. However does it cost £80 per record retrieved which is the average cost thus far(four fines in total have now been issued by the ICO) for each record lost? Your customers naturally are trying to keep costs low and productivity high, without the right explanation and open minded approach of your customer you do run the risk of pushing them towards less diligent IT professionals who will of course either a) not bring this issue up or b) suggest that TrueCrypt or another free software is certified and thus will do the job. If your software is not FIPS 140-2 or 197 certified then it is not recognised as being a valid protection method.

http://www.ico.gov.uk/news/current_topics/Our_approach_to_encryption.aspx

I believe the only way forward is education and information auditing.

Understand what data your customer owns is covered by the DPA
Where is it on their network?
Who has access to it?
Does it leave the network?

From these simple questions you can understand and highlight the machines that will cause you as service professionals issues if you were to remove them and then subsequently lose the data. This way you can mark the boundaries between your customers’ liability and your own. Not knowing will not save a fine here.

Educating your customers as to the risk is probably more difficult although the news story that Rob highlights and the one back in November involving an SME which lost one laptop with 24,000 records on it may help with this however you will always get customers who will fix the problem after the event and will either do nothing or look for an alternative provider. Although paying customers are the cornerstone of any business you must consider how good a customer they are if they are prepared to run this risk and put your business at risk also.

As for insurance I agree with you Rob that the insurers will not want to pay out for negligent breach of regulatory compliance, we can be assured that if anyone is taking steps to cover themselves then these guys probably already have in anticipation of a wave of these fines which no doubt will be regular news stories. Insurers don’t cover you against a speeding fine or a parking ticket.

There is a test case in the making somewhere here and I don’t think anyone wants to be sat in the ICO’s dock when this does happen.

Rob great post! Would you like a copy of my Data Protection Act guidance and questionnaire document?

James

As always, these are very wise words. Sadly in this type of situation it is unlikely that insurance will cover this nor will the other points, though this is open to debate. I believe that there are only two ways in which you can truely cover yourself:
1) Do not remove any equipment, which contains information covered under the DPA, from the clients site.
2) Have a written contract in place which covers all of these aspects.

Although, to be honest I believe that only in the first instance will you fully be covered, like I say just my opinion.

Rob

As you say, in encrypting client data we do add another level of complexity when things go wrong. This in turn will inevitably drive up costs to the client as well as increase the time required to resolve issues. In the short term I believe that this will create a situation whereby some clients will be ‘driven’ to lower cost providers that do not acknowledge or understand the implications that this new presidence brings. They will only understand when things go wrong, which is inevitably when it is too late.

Rob