Watchdog reveals data security breaches

London: Companies and government departments have suffered an "inexcusable number" of security breaches since the loss of millions of personal details last year, a watchdog said yesterday.

Information Commissioner Richard Thomas said he had been told of 94 data breaches since November, with two-thirds from the public sector and half from financial institutions.

Prime Minister Gordon Brown ordered an urgent review after the tax authority HM Revenue and Customs (HMRC) said it had lost data on 25 million people, exposing them to the risk of identity theft and fraud.

Priority

The watchdog said the government, banks and other organisations must make data security a priority.

"It is particularly disappointing that the HMRC breaches have not prevented other unacceptable security breaches from occurring," Thomas said.

"The government, banks and other organisations need to regain the public's trust by being far more careful with people's personal information."

The breaches included the loss of laptops, computer discs, memory sticks and paper records, he added. Some were stolen, others lost in the post. They included a wide range of personal details, such as financial and health records.

Thomas said company bosses and civil servants were taking data protection more seriously, but that more must be done to "eradicate inexcusable security breaches".

A separate report by PricewaterhouseCoopers for the Department for Business, Enterprise and Regulatory Reform found evidence that security measures had been tightened in past few years. The amount spent on defences has tripled in the past six years, it said.

Among its other findings:

- Four-fifths of companies that have computers stolen have not encrypted hard drives.

- Two-thirds do nothing to prevent confidential data leaving on memory sticks.

- A third don't control staff use of instant messaging.

- One in 10 sites that accept online payment do not encrypt transactions, leaving customers open to the risk of fraud.