ICO raps Virgin Media for data breach

Virgin Media has been found in breach of the Data Protection Act following the loss of an unencrypted CD containing the personal details of over three thousand customers.

The telecoms provider reported the breach to the Information Commissioner's Office (ICO) earlier this year following the loss of a compact disc that was passed to Virgin Media by Carphone Warehouse containing the personal details of individuals interested in opening a Virgin Media account in a Carphone Warehouse store.

The ICO said it had ordered to implement a number of security measures with immediate effect to protect customers' personal information more effectively. These include encrypting all portable or mobile devices that store and transmit personal information.

And any company processing personal information on behalf of Virgin Media must also now use encryption software, which must be clearly stated as a requirement in all contracts.

The ICO has also required Virgin Media to sign a formal undertaking to comply with the principles of the Data Protection Act. And it said failure to meet the terms of the undertaking would be likely to lead to further enforcement action.

Mick Gorrill, ICO assistant commissioner, said this latest in a series of clampdowns on organisations found to have lax security procedures proved the ICO is taking all data breaches seriously, one of which involved the Liberal Democrats only earlier this week.

"The Data Protection Act clearly states that organisations must keep personal information secure," he said. "Virgin Media recognises the seriousness of this data loss and has agreed to take the immediate remedial action that we have outlined in order to protect its customers' personal details."

A Virgin Media spokesperson said: "This was an isolated incident which occurred in May and only affected a small number of people."

"Through our own undertaking we also took the decision to proactively contact all of the affected customers directly to ensure we met all of our responsibilities and support them through the process. Since our internal review, we have implemented all of the requirements stipulated by the ICO," the spokesperson added.