The annual report of the data protection commissioner (DPC) was released this week and showed the "shift in the nature and type of complaints received by his Office with individuals concerned about the security of their personal data and the uses made of that data by software and technology applications."
The commissioner also highlighted the increased demand on the resources of his office as a result of the location of the world’s largest technology players in Ireland and the potential for reputational damage for the country if his office is not in a position, due to resource issues, to perform its statutory responsibilities. This is a reference to the major audit of Facebook that took place in 2011, watched by the world.
The report states that during 2011 the office opened 1,161 complaints for investigation, a record high when compared with the 783 complaints in 2010. Complaints concerning access rights (562) accounted for nearly half of the overall total reflecting a growing level of public awareness of the right of access to a copy of personal data.
Last year for the first time, says the report, the number of data breach notifications outstripped the number of complaints opened for investigation with 1,167 data security breach incidents reported to the office up from 410 in 2010. The commissioner said that this does not necessarily represent an increase in the number of breaches occurring but rather a raised awareness of the need to notify his office.
The introduction of the data security breach Code of Practice in July 2010 has continued to have a marked effect on personal data security breach notifications to the DPC, says report. During 2011 the DPC received 1167 data security breach notifications from 186 different organisations. This is a 300% increase in the numbers reported on in 2010 when it received 410 notifications. In 2009, before the introduction of the Code of Practice, the number of breach reports received by the DPC was 119.
The coming into force of S.I. 336 of 2011 in July 2011, which gave effect to the revised ePrivacy Directive, imposed mandatory reporting of data security reaches on all Telecommunication and Internet Service Providers. These data controllers are now required to notify the DPC, without undue delay, of a data security reach.
They are also required to notify individuals in all cases where there is a risk to their personal data. 75% of reported breaches related to errors in postal mailing. In most cases, the breaches involved either multiple letters in the same envelope or a page relating to another individual incorrectly attached to a letter. These data security breaches are usually explained by human error.
Other causes of breaches such as equipment theft, web site security and e-mail account for just over 12% of breaches. While the private sector still accounted for the majority of data breaches, the public sector still represented a worrying 21% of breaches, though that is down from 27% in 2010.
The commissioner carried out 28 audits in 2011, which included that of Facebook Ireland, which is described as "the most extensive and resource intensive audit yet undertaken" by the office.
"The implications of our increased European responsibilities were brought home to us forcefully in relation to our audit of the activities of Facebook-Ireland. Facebook-Ireland had unambiguously placed itself under our Office’s jurisdiction through changes in its contractual arrangements with its EU users and the establishment of clear responsibility for the processing of their data," said the report.
The report mentioned cloud computing in the context of the siting here of data centres by various cloud computing providers. "The main issues for data protection are the respective responsibilities of the ‘cloud’ provider and its clients and the additional responsibilities that apply where data is being transferred outside of Europe," said the report.
The commissioner said that his office was working with a group set up by the Minister for Jobs, Enterprise and Innovation, which was to consider the potential for further developing the potential of cloud computing in Ireland. The report does not go into further detail except to say that the group is expected to report to Government in 2012.
The DPC report was welcomed by the Association of Data Protection Officers (ADPO). "In a year of record complaint numbers, budgetary cuts and reduced resources, the DPO would like to thank the Commissioner for his continued support of this important area and recognise the steps he has taken to highlight the need to defend privacy rights and enforce formal obligations when it comes to data," said the ADPO in a statement.
"The right to privacy is a fundamental right, and every organisation in Ireland has a duty to protect that right for both its customers and its employees," said Hugh Jones, data protection specialist, ICS. Organisations continually fail to understand that acquiring and storing personal data brings responsibilities under the data protection legislation."
TechCentral Reporters
Ltd
