{"id":850,"date":"2013-08-09T23:57:44","date_gmt":"2013-08-09T22:57:44","guid":{"rendered":"http:\/\/www.halkynconsulting.co.uk\/a\/?p=850"},"modified":"2013-10-25T21:55:00","modified_gmt":"2013-10-25T20:55:00","slug":"sensitive-data-should-not-go-by-fax","status":"publish","type":"post","link":"http:\/\/www.halkynconsulting.co.uk\/a\/2013\/08\/sensitive-data-should-not-go-by-fax\/","title":{"rendered":"Sensitive data should not go by fax!"},"content":{"rendered":"

You may want to check your calendars again. Even though we are now well into the 21st century, it seems that some organisations are still sending sensitive data by fax machine – and not just the NHS (who were fined \u00a355,000 for the inevitable breach<\/a>). It seems banks, who really should know better, cant help themselves.<\/p>\n

\"Fax<\/a>
Fax Machines – Dont use for sensitive data<\/figcaption><\/figure>\n

This month (August 2013), the ICO has issued a Civil Monetary Penalty (fine) of \u00a375,000 to Bank of Scotland<\/a> for repeatedly faxing customer’s sensitive data to incorrect fax numbers.<\/p>\n

In the press release about the fine, the ICO notes that Bank of Scotland were even notified about the problem in 2009 but failed to take any corrective action. As a result, over 30 faxes were sent incorrectly. The faxes themselves included pay statements, bank account details, names, addresses etc. In all, an ideal haul for anyone looking to commit identity theft.<\/p>\n

In light of this, the fine itself seems pretty trivial compared to what the ICO is able to issue. To emphasise this point, this is what Stephen Eckersley, Head of Enforcement at the ICO said<\/a>:<\/p>\n

To send a person\u2019s financial records to the wrong fax number once is careless. To do so continually over a four year period, despite being aware of the problem, is unforgivable and in clear breach of the Data Protection Act.<\/p><\/blockquote>\n

It is unforgivable.<\/p>\n

Protecting sensitive data – lessons learned<\/h2>\n

The first point we want to hammer home is that you should not use fax machines for sensitive data. You really shouldn’t. If you are doing this, then stop now.<\/p>\n

However, if you really must, and you have it on your risk register, then learn to do it properly.<\/p>\n