• Home
• About Us
• Our Services
• Contact Us

• Web Design & Hosting
• Photography
• Computer Repairs
• Tech Articles
• My Account

Online Security - New Guidelines from the Information Commissioner

by Richard Cunliffe

The online world is developing and changing all the time. Increasing numbers of people depend on the Internet for information, shopping, banking and social interaction with friends.  The gap between the real world and our online world is becoming increasingly blurred and this presents a challenge to our privacy. 

Some of the biggest uses of the Internet also pose the largest threats to our information security and privacy. As our experience of the Internet increases, so does our dependence on its convenience. As the uses of the Internet snowball, the risks we take also increase. We will happily tweet, telling everyone we are going on holiday, yet we leave the lights on in our houses when we're away to pretend we're in. 

Is this an example of our increasingly liberal attitudes to online privacy or do we feel protected behind a keyboard and mouse?

More and more information is captured as our online footprint expands. Everything you click on Amazon is recorded to analyse your browsing and shopping habits. This creates an online profile that allows Amazon to recommend products to us. A cunning marketing strategy or an invasion of privacy? Would you allow someone to shadow you in Tesco with a clipboard, marking which products we looked at? No, but we all carry Tesco Clubcards which record everything we buy, where we bought them and how we paid. 

Companies also face this problem when deciding how to set up online privacy. Currently all companies operating in the UK have to comply with the Data Protection Act (1998). This act, implemented in 2000, provides a set of principles that governs the actions of organisations when processing personal data. 

The Act's application can be poorly applied in the online world and this has led to a new online privacy code being developed.  This code covers all information collected by PCs, mobile phones, computer games consoles, media devices; basically anything connected to the Internet.

The code is a set of guidelines that go above and beyond the DPA requirements. The code only covers the use of information that can be used to identify an individual. This is problematic as many people can use one computer, for example. The difficulty is that non-obvious identifiers such as IP addresses are linked to one particular device; not an individual user. 

Here is what the Online Privacy Code says:

• Collect personal data at an appropriate time - asking for information too early will discourage people
• Don't misuse the information you collect and only collect necessary information
• If you're using a third party, check what information they collect as they may be collecting too much
• Conduct audits of the data to ensure it remains accurate
• Use partial data where possible e.g., use the first part of someone's postcode rather than the whole thing if you only require the rough address of that person
• Do not be secretive about why you're collecting personal data
• Do not change the reason you're collecting data.
• If people tell you they don't want to receive any further information, do not contact them again
• Undertake risk assessments on your system to identify where vulnerabilities may occur
• Remove all unnecessary access rights where possible
• Disable auto-complete options on web forms and install good anti-virus software
• Dispose of data securely
• Train staff to handle data securely

• Encrypt data prior to transferring it overseas
• Ensure the individual receiving the data is adequately trained to handle data
• Take copies of the receiver's security policies and ensure they match your expectations

It will take time to see whether adopting this code leads to increase trust and better relationships with individuals online. It may result in fewer breaches of the DPA and therefore fewer fines handed out from the Information Commissioner. The larger question remains whether this will lead to an increase of online services or simply put barriers in place to their use.

Copyright © caeus.com Ltd. 2010. This article and all its contents are the property of caeus.com Limited and are protected by copyright. You may not distribute, modify, transmit, reuse, repost, or use the content of this article for public or commercial purposes (including text and images) without written permission from caeus.com Limited. The views expressed in this article and sites linked to herein are solely those of the author or individual(s) providing them and do not reflect the opinions of caeus.com Ltd., its parents, affiliates or subsidies. Any trademarks and brands mentioned in this article are the property of their respective owners and their use does not imply any affiliation with, or endorsement by, caeus.com Limited. The content of this article is provided in good faith and for information purposes only; you follow any advice given entirely at your own risk and no responsibility can be taken for any consequences which may arise as a result of following advice given in this article.