Irish companies that loose the personal data of more than 100 people will be obligated by law to report the breach to the authorities according to the new rules proposed by the Data Commissioner.

The only instance where a company or organisation can avoid having to report the breach is ensuring that data is encrypted and protected by a strong password, or in the case of lost or stolen equipment that a remote memory-wipe feature on a device be activated immediately.

In 2008 the Irish Government ordered a review to determine whether or not reporting obligations protected individuals sufficiently. It recommended that some kind of official guidance was necessary in the event of a breach.

The Irish Data Protection Commissioner has now published a draft Code of Practice outlining exactly when reports to him must be made.

“I have sought to bring forward a draft Code as quickly as possible after the Review Group report to respond to public concern in relation to organisations losing personal data under their control while at the same time not imposing an undue burden on those organisations,” said Irish Data Protection Commissioner Billy Hawkes.

In the event of an organisation loosing data comprising of sensitive medical or financial data then this must still be reported even if fewer that 100 people are involved.

“Data controllers who are required to report to the Office of the Data Protection Commissioner in accordance with this Code must do so within two working days of becoming aware of the incident,” said the guidance.

“Such data controllers are required to provide a detailed report of the incident reflecting careful consideration of … the amount and nature of the personal data that has been compromised; what action is being taken to secure and / or recover the personal data that has been compromised; what actions are being taken to inform those affected by the incident or reasons for the decision not to do so; what actions (if any) are being taken to limit damage or distress to those affected by the incident; and a chronology of the events leading up to the disclosure,” it said.

“The Office of the Data Protection Commissioner will investigate the issues surrounding the data breach,” it said. “Investigations may include on-site examination of systems and procedures and could lead to the use of the Commissioner’s legal powers to compel certain actions. Such actions may include a recommendation or requirement to inform data subjects about a security breach incident where a data controller has not already done so.”

The draft code of practice can be found here.

In the U.K. in April 2010 The Information Commissioner for the first time gained the power to fine organizations for violating the Data Protection Act. Fines up to £500,000 can be levied. In the case of Banks and Insurances companies other agencies have the power to impose even greater fines.

The European Union approved a data breach notification law last year as part of telecoms law reforms however this law only applies to telecoms firms. The Commission and Council rejected EU Parliament proposals to have the law apply to businesses that operate online, such as shops and banks.

Recently I stumbled upon an article on Law360.com which discussed the reluctance of Legal Firms & Practices to spend money on IT Security. Although this mainly concerns American firms I believe that Irish firms are on par.

With an abundance of confidential information solicitors practices will and have already become targets for Cyber attacks. It is well known that selling IT Security Systems to legal firms proves to be a very tough sale when in fact it should be one of the easiest given the predicament a law firm might find itself in after a breach of it’s data.

Without regurgitating the whole article on Law 360, I believe that Irish firms need to take a good hard look at securing their IT infrastructure. From a brief look a few Law Practices it is quiet obvious that security is taking a back seat. From insecure wireless networks to easily guessed passwords I would have no doubt in my mind that if targeted the majority of Solicitors Practices in Ireland could easily be breached and without the proper measures in place have almost no possibility of tracking how or where the attack came from. Without a managed security system in place it can be very easy for an intruder to remove all traces of how, when and from where  an attack took place.

If you would like to read the full article on Law360 you can do so by clicking here.