So, I managed to get a piece run on the Guardian Public Leaders network on the continuing incidents of or risks of exposure of sensitive personal data in pivot tables. I tried to argue that those in the know probably know about these risks, and that those not in the know don’t. I suggested the Information Commissioner’s Office (ICO) and the government could do more to alert the latter.
Although I got nice and positive feedback from friends/colleagues/fellow professionals, there appears to have been very little interest. Clearly it’s not a subject that interests lay people (or rather, it’s probably a subject which actually repels lay people). But that was rather my point: as long as the relevant regulators and policy-makers don’t take sufficient steps to issue warnings and guidance these and similar breaches of data security will continue to happen.
What I’m slightly surprised at is the lack of any response from the ICO. I noticed that Tim Turner asked the ICO twitter account if they had a response to the piece, but, unless it was off-line, he appeared to get no response. And I asked their press office, again, with no reply (maybe the press office was the wrong place to ask?).
In the article I also called on government departments to do more. That’ll be my next move. The problem of inadvertent internet disclosure of sensitive data, normally through ignorance of technology, continues, and it goes broader than pivot tables. As public authorities, in particular, are being required to open up more and more data to promote transparency and economic growth, this is going to become more and more serious. We can’t pretend the gulf between those ambitions and the technological knowledge of some of those doing the “opening up” is a minor problem. Authorities need guidance, and, where appropriate, warnings, and these need to be targetted at the right people within organisations. The ICO and government cannot always rely on, say, data protection officers to do this.
informationrightsandwrongs 