ICO urges ‘Privacy by Design’

A new report published today by the Information Commissioner's Office (ICO) has found traditional security methods are failing to ensure sufficient protection of private data.

The ICO commissioned report from the Enterprise Privacy Group was unveiled at its Privacy by Design' conference in Manchester this morning. It found executives are failing to understand data privacy risks or prioritise responsibility and accountability for it.

It also said the commercial risks of data leaks remain unclear to organisations, while traditional risk assessment methodologies fail to take the value of personal information into account. And risk assessment approaches also fail to manage privacy needs throughout the data lifecycle, so bespoke and off-the-shelf systems are being built without proper privacy controls.

Jonathan Bamford, assistant commissioner told today's conference that many organisations have invested in new technology to enable them to exploit our personal information more efficiently.

But he asked: "Have those organisations devoted the same effort to privacy protection? We are concerned that some organisations are still failing to realise the business risks associated with holding vast collections of personal data and we continue to urge organisations to minimise the amount of personal data they hold."

The report also recognised that privacy enhancing technologies (PETs), like anti-virus and firewall software, face an uphill struggle keeping up with technology developments around Web 2.0, cloud computing and service oriented architecture (SOA). But it urged both vendors and companies alike to encourage their adoption.

But it also urged both public and private organisations to improve their level of engagement in designing privacy protection into the business case for any plans and projects.

Bamford added: "Before a new system is set up to collect more personal details, organisations should make sure that privacy solutions are hardwired in from the start, rather than added at a later stage."

And the report said privacy impact assessments should be carried out more widely to determine the impact of collecting and holding people's personal details. It advocated that PETs should be integrated into new systems from the outset, rather than bolted on as an after thought.

The research can be downloaded from the ICO's website.