A4e is fined £60,000

Posted on November 25, 2010. Filed under: a4e, Action 4 Employment, Benefit Busters, Community Task Force, DWP, emma harrison, Flexible New Deal, New Deal, unemployment, Work Programme | Tags: a4e, a4e stolen laptop drama, Action 4 Employment, ICO, Information Commissioner, Information Commissioners Office |

One of the largest Welfare to Work parasites A4e have been fined after a data breech with thousands of clients details. A4e are the first entity ever to be fined for Data Breeches under the Data Protection Act 1998. The soft £60,000 fine was lucky for A4e, as the maximum that can be imposed is £500,000.

Have lessons been learnt? We hope so. Alertboot (who provides encryption solutions for business) has suggested many interesting points. Please click the above link for full article.

The reason? The BBC had reported that “training company A4e said the data was held on a personal computer of an employee which was stolen.” Today, it turns out that A4e was essentially lying, or the BBC really needs to choose its words wisely.

According to the ICO’s monetary penalty notice,

[A4e] issued [the employee] with a laptop computer which did not contain any personal data but with the knowledge that it would be used for home working. The employee then loaded personal data and some sensitive personal data onto the laptop from the central secure servers. The only security on the laptop computer was password protection.

Does this sound like a personal computer to you?

and

* A4e had already begun an encryption program in March 2009 (the above computer was stolen June 2010), with the first roll out phase completed in January 2010
* Someone tried to access the computer after it had been robbed
* A4e knew that the laptop would eventually contain personal info

What’s most shocking to me is that, as far as I can tell, only 1,000 computers needed encryption: only 1,000 out of a total staff of 3,250 were working from home. I know I’m tooting AlertBoot’s horn here, but our endpoint security encryption software doesn’t take over three months to roll out encryption to 1,000 computers, much less 12 months.