NESTA Crime Online - University of Brighton Repository

e-mail addresses, etc), their low supply might be a direct result of the difficulty in
compiling such information.
However, other continuous data breaches are also exposing personal information on a
large scale. Seven hundred data breaches were reported worldwide from 2007 to 2008,
which resulted in 200 million identities exposed. 64 This figure represents an increase of
83 per cent compared to the previous year. In the UK, numerous Government data
breaches have made the news. 65 But the problem affects all sectors: one survey has
reported that 55 per cent of British companies have lost data in 2008, 66 and 96 per cent
of the UK companies with more than 500 employees reported a computer related
security incident in 2007. 67 The proliferation of larger centralised databases threatens
more personal data being lost or abused. 68
Despites this, the UK government announced in 2008 that it will not be implementing a
data-breach notification law, similar to laws in many US states. 69 The importance of
reporting private data breaches has been a recurrent critical concern raised by the
majority of our interviewees, including IT security firms, IT experts, academics and the
police. 70 This was also the view of the House of Lords Science and Technology committee
in their personal security report: "a data security breach notification law would be
among the most important advances that the UK could make in promoting personal
Internet security". As there is no UK legislation that demands the publication of private
breaches, the full extent of the problem remains unknown.
64 See http://datalossdb.org/.
65 For example, HM Revenue and Customs (HMRC) lost 25 million child benefit records in November 2007. In
January, the Ministry of Defence lost a laptop containing the details of over 1 million people. In May 2008, the
Department for Transport lost the data of three million learner drivers. More recently, in November 2008 the
Ministry of Justice admitted it had lost 45,000 people's details throughout the 2008.
66 Leo King, “Over half of UK firms have lost data”, Computerworld UK, 13/10/2008; available at
http://www.computerworld.com.au/index.php/id;1869348852;fp;39;fpid;26027.
67 Department for Business, Enterprise & Regulatory Reform (BERR): Information security breaches survey
(2008).
68 Speech by Richard Thomas, information commissioner, in October 2008. In Alan Travis, “Bigger databases
increase risks, says watchdog”, The Guardian, Wednesday 29 October 2008; available at
http://www.guardian.co.uk/technology/2008/oct/29/data-security-breach-civil-liberty/print.
69 It is already mandatory for public-sector organisations to report any significant actual or potential losses of
data to the Information Commissioner's Office (ICO).
70 Interviews conducted from November 2008 to April 2009.
Page 24