Infosec 08: Officials held responsible for data security

Government officials will be held to account for future data losses and information security mishaps, it has been revealed.

Information Commissioner Richard Thomas announced details of new government guidelines at an Infosecurity 2008 conference in London, despite the fact that Cabinet Secretary Gus O'Donnell has yet to publish his report on data security.

Thomas noted that the new measures designed to increase data security will mean that senior Whitehall figures will now be held personally responsible when personal information is lost or mishandled.

Cabinet Secretary Gus O'Donnell's report on data security, which was commissioned by Prime Minister Gordon Brown after 25 million child benefit claimant records

went missing, is expected in late May.

Although the Cabinet Office would not comment on Thomas's admission, a spokesperson said: "The Cabinet Secretary published his interim report on data handling in December. The Government has already accepted its recommendations, which include a commitment to create tougher penalties for people who break the Data Protection Act. The final report will be published later in the spring."

As far back as last year, Thomas was telling a House of Commons Justice Committee report on the Protection of Private Data that there was a "need to ensure that safeguards are achieved in practice".

Although, the Information Commissioner's Office (ICO) refused to comment on O'Donnell's report before its official release, according to the Times newspaper Thomas said that the report focused on "issues of accountability and governance".

Thomas also confirmed that UK companies will face spot checks later this year on the way they handle data-protection law. Previously the ICO had to ask permission before it inspected public and private sector firms.

According to the Times report, Thomas believes that senior officials are likely to take responsibility for any future data breaches.

"It has to be the likes of chief executives (of NHS trusts) and permanent secretaries who are held accountable when things go wrong," he said.

"They can't simply make assumptions that everything is in the hands of the 'techies'," Thomas added.

For more Infosec 2008 coverage, see IT PRO's roundup page here.