Sir, The first civil servant to face criminal charges for failure to safeguard personal information under the Information Commissioner’s proposed new powers (report, Dec 18) will no doubt plead that he or she lacked adequate training and technical understanding of computer security.

Given the persistent drive to outsource (most recently and ridiculously manifested in the storage of UK learner-driver details in the US) this defence is all too likely to succeed. Successful security policy requires close and integrated attention to technical and human factors and their interaction. Insofar as outsourcing means the permanent loss of in-house competences, further grave breaches may be anticipated, no matter how severe the legislated sanctions.

Julian Newman

Professor of Computing

Glasgow Caledonian University

Sir, Surely the fundamental point highlighted by the loss of driver data in the US and the misuse of Aviva policyholder data in India is that the Data Protection Act actually provides no realistic protections nor legal recourse to the wronged data subjects.

In these and in many other cases the data subjects had no practical control over the destination of their sensitive personal data. This confidential information may end up in jurisdictions where recourse against those entrusted locally with security may be an expensive, long-winded waste of time. I wonder if those in Government allow their data to be exported in this way.

Surely it is time that all personal data was barred from export to non-EU destinations until clearly defined and legally binding arrangements are in place that provide adequate punitive penalties against all those entrusted with its security, promptly payable to the data subjects.

Rob Green

Braintree, Essex

Sir, Recent events have brought a long overdue recognition of the importance of handling personal data with the utmost respect. No one can now be ignorant of the reputational and other risks of getting it wrong. This is not just a matter of ensuring adequate security — it covers, for example, ensuring that excessive personal information is not collected in the first place and that it is accurate and not retained longer than necessary. As is made clear through the privacy impact assessment technique promoted by my office, good data protection practice is closely aligned to effective risk management.

I need, however, to correct one misapprehension. I welcome the Government’s commitment to strengthen the powers and resources of my office to improve compliance with the data protection principles. But the proposals I have put forward for new sanctions for the most serious breaches do not envisage a term of imprisonment. That punishment is needed, primarily as a deterrent, for the quite separate offence in the Data Protection Act which targets the illegal trade in personal data.

Richard Thomas

Information Commissioner

Wilmslow, Cheshire

Sir, Is it not surprising that nobody has suggested fining the Civil Service for losing all those discs?

William Merton

Headley, Berks

Explore Letters

• Feedback