Reply to: data breach

[TheBA]

Of course he is ... Just when the time is right. don't 'forget' those cloud backups

[northernladuk]

Are you going to delete them?

[Fred Bloggs]

I apologised and agreed to delete the files. Client decided not to pursue the matter further.

Thanks everyone for some excellent advice.

Lucky outcome, learn from it.

[Andy2]

So, what was the outcome?

I apologised and agreed to delete the files. Client decided not to pursue the matter further.

Thanks everyone for some excellent advice.

[DallasDad]

Then point him to the thread about gaps in CVs

[northernladuk]

So, what was the outcome?

He only gets 10 mins internet a day so no time to respond. Give about 6 months and he'll be back with an update.

[fidot]

So, what was the outcome?

[WTFH]

OK, tim if that's your view of the situation, fair enough.


Others of us have a different opinion/experience and have stated it, backing it up with perfectly valid examples.

[tim123]

No, I didn't say that. I'm saying we don't know what data has been taken; there could be sample data in the document(s) for all we know. We simply don't know what's there so cannot discount data protection issues.

Oh come on

live "real person" data as samples in project documentation,

and you think that the use of that data by project personnel could be a breach of "data protection" by that user?

As before, if that data were there, then it would be there intending it to be used by project personnel, then the only person in the targets for prosecution if that use is unlawful, is the person responsible for putting it in the document, not the person using it.

The whole company structure has to take responsibility for DP. As a manager, you can't absolve your own responsibility by getting your underlings to sign some contract saying that it is always their fault.

tim

[tim123]

Nope, the protected data may have included information that should protected (we're not talking about the piffly data protection act).
.

Sorry, but the people to whom I responded were talking about the piffly data protection act

tim

[WTFH]

So what you are saying is that someone (working on a specific project) has (may have) taken some project specific documents which just happen to contain the name, address and phone numbers (any other personal details) of other people working on that same project, and that act is a data breach?

I think that's pretty far fetched, because surely the dissemination of those details to other people involved with the project is exactly why you might want these details to be there in the first place.

If anyone is guilty of a data protection "crime" in this scenario, it will be the company for not correctly documenting/protecting the use that they were going to make of the data when they asked their employee for it, not the project numpty who copies it into his personal address book.

tim

Nope, the protected data may have included information that should protected (we're not talking about the piffly data protection act).


Let's say he was working for Thales and the project was to fix a bug in the guidance laser of the Starstreak which meant while it couldn't be jammed, it could sent off course. And let's say that was detailed in the project document which also discussed the solutions and showed which one was chosen along with any problems that occurred as a result.


That would be valuable data that should be protected.

[LondonManc]

So what you are saying is that someone (working on a specific project) has (may have) taken some project specific documents which just happen to contain the name, address and phone numbers (any other personal details) of other people working on that same project, and that act is a data breach?

I think that's pretty far fetched, because surely the dissemination of those details to other people involved with the project is exactly why you might want these details to be there in the first place.

If anyone is guilty of a data protection "crime" in this scenario, it will be the company for not correctly documenting/protecting the use that they were going to make of the data when they asked their employee for it, not the project numpty who copies it into his personal address book.

tim

No, I didn't say that. I'm saying we don't know what data has been taken; there could be sample data in the document(s) for all we know. We simply don't know what's there so cannot discount data protection issues.

[tim123]

No we don't.

We know it's "just" project docs. I've seen a lot of project documents contain valuable data, including contact details.

So what you are saying is that someone (working on a specific project) has (may have) taken some project specific documents which just happen to contain the name, address and phone numbers (any other personal details) of other people working on that same project, and that act is a data breach?

I think that's pretty far fetched, because surely the dissemination of those details to other people involved with the project is exactly why you might want these details to be there in the first place.

If anyone is guilty of a data protection "crime" in this scenario, it will be the company for not correctly documenting/protecting the use that they were going to make of the data when they asked their employee for it, not the project numpty who copies it into his personal address book.

tim

[PurpleGorilla]

Nope.

If you steal defence information you definitely won't be acting on behalf of your company, which is why they put the individual working on the contract through security clearance not all the company directors. Same with financial and government information - how did you think the press got their stories?

Other industries make you sign an NDA as an individual. So while your company has one in it's contract, you as an individual also has one.

Industries with confidential information are well aware of people trying to hide behind the corporate veil to steal information.

Official Secrets Act

[WTFH]

Yup, and the NDA (and any ClientCo security paperwork) will trump your contract, or anything the agent has.